"Vibe coding" — prompting an AI tool to generate an entire app or feature and shipping largely on whether it looks right and runs — is a legitimate way to build certain things fast. It's also how we've seen production Supabase databases exposed to the public internet because nobody checked the row-level security policy the model generated. The line between the two outcomes is knowing what category of work you're doing before you start.
Where vibe coding is a genuinely good call
Internal tools with no external users, throwaway prototypes to validate an idea with a stakeholder, marketing landing pages with no data persistence, and one-off scripts for a data migration you'll run once and discard are all reasonable places to let an AI tool drive and accept output on vibes. The cost of a mistake is low and the speed gain is real — we've built internal admin dashboards for client review in an afternoon this way that would have taken three days hand-coded.
Where it actively creates liability
- Anything handling personal information under PIPEDA or Quebec's Law 25. Consent logic, data retention rules, and cross-border data transfer restrictions are legal requirements, not code patterns an LLM has reliably internalized. Vibe-coded intake forms have shipped without proper consent capture more than once in code we've reviewed.
- Authentication and payment flows. A prompted Stripe integration that "works" in testing can still mishandle webhook idempotency, meaning duplicate charges under retry conditions that only show up at volume.
- Anything requiring WCAG 2.2 AA compliance, which is a legal obligation for many Canadian organizations under AODA and the Accessible Canada Act. AI-generated markup routinely produces plausible-looking but non-compliant ARIA usage that fails real assistive technology testing.
- Database schema and migrations for production data. Prompted migrations have shipped column drops and type changes that silently truncate data — reversible in theory, painful in practice once real customer data is involved.
A simple decision test before you prompt-and-ship
Ask three questions: does this touch real user data, does a mistake here cost money or create legal exposure, and will someone other than the original prompter need to maintain this in six months. Two or more "yes" answers means the output needs a structured review before it ships — someone reading the actual logic line by line, not just confirming the feature works in the browser.
How we structure AI-assisted work to get the speed without the risk
We let AI tools generate freely in the exploration and prototyping phase, including full vibe-coded first passes on internal tools. Before anything touches a shared staging environment, it goes through the same review a hand-written PR would: a senior developer reads the diff, checks any auth, data, or payment logic specifically, and the author has to be able to explain the design decisions, not just point at working output. This roughly doubles delivery speed on greenlit prototype work while keeping the actual liability surface — auth, payments, personal data, accessibility — under the same scrutiny it always had.
The tell that a codebase was fully vibe-coded with no review
Inconsistent error handling, database queries with no input sanitization pattern reused across the codebase, and comments that describe what the code does in generic terms rather than why a specific approach was chosen, are all signs the code was accepted rather than understood. None of these are visible from a working demo, which is exactly why demo-based vendor evaluation misses them.
If you've got a vibe-coded MVP that's getting real traffic and you want an honest read on what needs hardening before it scales, send it over and we'll flag the actual risk areas rather than just its code style.
Surrey, BC
A full-service digital agency working in WordPress, Drupal, Shopify, Webflow, React, and React Native. We partner with universities, governments, and growing brands to ship sites and products that hold up after launch.
