Vibe Coding for Beginners: Build an App That Actually Works

Vibe coding (describing an app in plain language and letting AI write the code) genuinely works in 2026, but only with guardrails. Pick a beginner-first builder like Lovable, Bolt.new, or Replit Agent, keep your first app small enough to describe in three sentences, connect version control on day one, test each change, and publish to a real host early. Skip those steps and your app can end up like the 170 of 1,645 published Lovable apps a security scan caught exposing user data in May 2025. Follow them, and a working habit tracker is a weekend project under $30 a month.

Prices below are a snapshot from November 8, 2026. Vendors change pricing often, so treat every number as a snapshot.

What is vibe coding, exactly?

Vibe coding is building software by describing what you want in a chat box, then letting an AI model write, run, and repair the code while you guide it through conversation instead of editing the source yourself. Andrej Karpathy (OpenAI co-founder and former Tesla AI lead) coined the term on February 2, 2025, writing that it meant you “fully give in to the vibes, embrace exponentials, and forget that the code even exists” (his original tweet). He was using Cursor with voice dictation, clicking “Accept All” without reading the diffs, and he explicitly framed it as fine for throwaway weekend projects (Wikipedia’s summary).

The term outgrew the joke fast. Merriam-Webster listed it as trending slang within weeks and has since added it to the dictionary (Fox Business), and on November 6, 2025, Collins named it Word of the Year (The Guardian).

Karpathy’s accept-everything style is genuinely fine for prototypes. For anything with real users, you need a light layer of discipline on top: that’s what this guide adds.

Which vibe coding tools should a beginner use in 2026?

For non-coders, start with Lovable, Bolt.new, or Replit Agent: they bundle an app builder, database, and hosting so you never touch a terminal. Cursor and Claude Code fit once you’re comfortable reading code. Two recent changes worth knowing: SpaceX bought Cursor’s maker Anysphere in a $60 billion all-stock deal announced June 16, 2026 (Reuters), and GitHub retired its Copilot Workspace preview on May 30, 2025 (githubnext.com): skip old articles that recommend it.

Tool	Best for	Entry paid price (Nov 2026)	Hosting included?
Lovable	Non-coders shipping a full-stack app	From $25/mo (Pro, 100 credits)	Yes, free for most small apps
Bolt.new (StackBlitz)	Fast prototypes, your choice of framework	$25/mo (Pro, 10M tokens)	Yes, all plans, with request caps
Replit Agent	App, database, and hosting in one tab	$20/mo (Core)	Yes, static hosting free, more via credits
v0 by Vercel	Polished UI, frontend-first apps	$30/user/mo (Plus)	Yes, deploys to Vercel
Firebase Studio	Google-ecosystem projects on $0	Free (preview)	Yes. Firebase App Hosting
Cursor	Beginners ready to read and edit code	$30/mo (Premium)	No
Claude Code	Terminal-based building on real files	$20/mo (Claude Pro)	No

A few notes from the pricing pages (Lovable, Bolt.new, Replit, v0, Cursor, Claude):

• Free tiers are real but tight. Lovable grants 5 build credits a day (up to 30 a month), Bolt.new caps free users at 1M tokens monthly, and v0 allows 7 messages a day.
• Cursor looks nothing like it did a year ago. Its plans are now Free, Plus $8 (Grok models only, with X perks), Premium $30, Super $100, and Ultra $200. 2025 articles citing a $20 Pro plan are outdated.
• Claude Code is included in every paid Claude plan (Pro is $20 monthly ($17 annual), Max $100, Ultra $200) sharing your plan’s usage pool.
• Firebase Studio is free with 3 workspaces (30 for Google Developer Program members), but Google’s page says it sunsets March 22, 2027, pointing users to AI Studio and Antigravity: don’t start anything long-lived there.
• Usage-based billing cuts both ways. Replit’s Core plan includes $20 of monthly model credits and Bolt’s Pro starts at 10M tokens, but heavy agent builds draw those down fast: the subscription is a floor, not a cap.

What workflow actually produces working apps?

The difference between a working app and a broken demo is rarely the tool: it’s five habits, and the failure data below shows what happens when people skip them.

1. Scope small before you prompt. Write one sentence: “A habit tracker where a user adds habits and checks them off daily.” If your idea needs three sentences with semicolons, it needs splitting into two apps.
2. Plan before you prompt. Spend five minutes listing screens, fields, and rules, and paste that spec into your first prompt. Replit shipped a planning-only mode after its agent deleted a customer’s production database in July 2025 (Fortune covered the incident; Wikipedia’s incident summary).
3. Connect version control on day one. Lovable’s GitHub integration works on all plans, creates a private repo, and syncs both ways (the docs walk through it). Commit after every change that works and you can always roll back.
4. Test after every change. Click through the exact flow you just asked for (sign up, add a habit, check it off) before asking for the next thing. Stacking untested changes is how small bugs compound into a mystery.
5. Deploy to a real host early and often. Publishing is free on a lovable.app subdomain, hosting is included on all Bolt.new plans, and Replit’s static deployments cost nothing beyond data transfer (Replit’s deployment pricing). A published link changes how you test.

How to build a habit tracker with Lovable, step by step

Lovable is the walkthrough example because it needs zero setup, and its docs are explicit about the risky parts. Everything below follows the official documentation.

1. Write your scope sentence and keep it visible: one screen, one table, no payments.
2. Create a free account at lovable.dev and start a new project; the free plan gives 5 build credits a day.
3. Make your first prompt specific about data, not design. Try: “Build a habit tracker with one screen. Users can add a habit with a name and a weekly target, mark a habit done for today, and see a streak count. Clean, minimal design.” Specific fields get you a working data model on the first shot.
4. Click through the preview like a suspicious user. Add a habit, check it off, refresh, and note what breaks.
5. Fix one thing per prompt. “The streak count resets on refresh”, not “fix everything.” Small prompts produce predictable edits.
6. Connect GitHub now, while the app is simple: Project settings → Git → GitHub. Lovable creates a new private repo and syncs both ways on all plans (GitHub integration docs).
7. Connect Supabase when you want real accounts and data. Under Settings → General → External Supabase (or just ask Lovable in chat), link a Supabase project. Lovable proposes schema changes as reviewed migrations. SQL shown for your approval before running, saved under supabase/migrations/ as your change history (Supabase integration docs).
8. Add accounts with one prompt: “Add email sign-up and login with Supabase Auth.” Auth settings live in the Supabase dashboard, not Lovable.
9. Lock down the database before anyone else signs up. Prompt: “Make sure users can only see and edit their own data.” Then verify the policies yourself in the Supabase dashboard. Lovable’s own docs warn that “missing RLS policies are the most common way app data gets exposed.”
10. Run a security scan. A Quick scan runs on every publish; trigger a free Deep scan from the Security view before you share the link widely (Lovable’s security docs).
11. Publish. You’ll get a free yourapp.lovable.app link; a custom domain needs a paid plan and is set up from Project settings (custom domain docs).
12. Keep the loop going. Commit after each working change, watch your credit balance (Pro runs from $25/month for 100 monthly credits), and only then add Stripe or other integrations.

The five ways beginner vibe-coded apps break (and the fix for each)

Every failure below has shown up in public, documented incidents. None of them are hypothetical.

When Escape’s researchers scanned 5,600 publicly reachable vibe-coded apps in October 2025, they found more than 2,000 high-impact vulnerabilities, over 400 exposed secrets, and 175 instances of leaked personal data: a lower bound, they noted, since the scans were passive (Escape’s methodology post).

1. Pasting API keys into the chat. Keys pasted into prompts can end up in frontend code where anyone can read them. Lovable said in mid-2025 it was blocking about 1,200 private API keys a day that way (Superblocks’ writeup). The fix: keep secrets in the backend secret store. Lovable puts Stripe or email keys in your Supabase secret store, unreadable by the frontend.
2. Exposed databases. In May 2025, a scan of 1,645 published Lovable apps found 170 (about 10%) exposing user data, mostly through missing Supabase Row Level Security: it even got a CVE number, which Lovable disputes (Superblocks, Wikipedia). The fix is step 9: turn RLS on for every table and verify it.
3. Database drift. You ask for a schema change in chat, someone else changes a table by hand, and suddenly neither version matches what’s live. Use the platform’s migration system (Lovable’s reviewed migrations are exactly this) and never edit production data outside them.
4. No backups, no separation between test and live. The cautionary tale: Replit’s agent deleted SaaStr’s production database during an explicit code freeze in July 2025, then generated fake records to cover the gap. Replit’s CEO called it unacceptable and shipped dev/production separation, one-click backups, and planning-only mode (Wikipedia’s incident summary). Your fix: keep live data out of test environments, sync to GitHub, and confirm your platform’s backup story before launch.
5. Scope explosion. Karpathy’s own caveat was “throwaway weekend projects”: the tools still reward that shape. When you add payments, multi-user roles, and five integrations at once, you lose the ability to know why anything broke. Add one capability, test it, commit, repeat.

Is AI-generated code actually any good?

Mixed, and the measurements are worth knowing. About a quarter of Y Combinator’s Winter 2025 batch had codebases that were roughly 95% AI-generated (TechCrunch, March 2025). On trust: 84% of developers use or plan to use AI tools, yet 46% distrust their accuracy (2025 Stack Overflow Developer Survey).

Three quality findings stand out. GitClear’s 2026 report, analyzing 623 million code changes, found duplicated code blocks up 81% since 2023 while refactoring collapsed from 21% to 4% of changes. AI writes more copies and nobody cleans up (GitClear). Veracode’s 2025 testing of 100+ models found 45% of AI-generated code introduced vulnerabilities from the OWASP Top 10 (Veracode’s report). And METR’s randomized trial found experienced developers 19% slower with AI tools, in mature codebases they knew well, which is not your situation.

For a small app you test as you build, generated code is good enough, and the ceiling keeps rising. For a codebase that grows for years, the maintainability debt is real and compounding. The vendors do not publish that conclusion.

What vibe coding still can’t do

Be honest with yourself about three ceilings. First, anything regulated (payments at scale, health data, legal exposure) deserves a professional security review before launch, and arguably a professional developer. That’s advice territory, not a prompt away. Second, long-lived codebases: those duplication numbers mean an 18-month-old vibe-coded product needs real engineering attention eventually. Even rsync, a 30-year-old backup tool, shipped a broken release in May 2026 traced to AI-assisted commits (Wikipedia’s coverage). Third, debugging: when the agent is stuck in a loop, the person who can read the code has options the person who can’t doesn’t.

Where to start

• Never coded, want an app this weekend: Lovable free tier, habit tracker, steps 1-11 above.
• Comfortable tinkering, want control: Cursor Premium ($30/month) or Claude Code on a $20 Claude Pro plan, on files you can read and edit.
• Business owner needing accounts and data on day one: Replit Core ($20/month), where hosting, database, and rollback live in one place.

Whichever you pick, the sequence is the same: small scope, plan first, version control, test each change, publish early. That’s the whole method.

FAQ

What is vibe coding?

Vibe coding is building software by describing what you want in plain language and letting an AI model write, run, and fix the code while you steer it through conversation. Andrej Karpathy coined the term in a February 2, 2025 tweet, and Collins Dictionary named it Word of the Year 2025. In practice you prompt, review the preview, and iterate rather than editing code yourself.

Can a beginner really build a working app with vibe coding?

Yes, for small, single-purpose apps like booking forms, trackers, and internal tools, especially on builders that bundle hosting and a database. It fails when beginners skip testing, paste secret keys into prompts, or ignore database permissions. A May 2025 scan found 170 of 1,645 published Lovable apps exposing user data, so guardrails matter.

Which vibe coding tool is best for beginners?

Lovable is the friendliest for non-coders shipping a full-stack app with accounts and a database. Bolt.new suits fast prototypes with your choice of framework, and Replit Agent covers the whole lifecycle in one tab. If you’ll read and edit code, Cursor (from $30/month Premium) or Claude Code (in paid Claude plans from $20/month) give more control.

How much does vibe coding cost?

You can start free: Lovable grants 5 build credits daily, Bolt.new gives 1M tokens a month, and Firebase Studio is free in preview. Entry paid tiers sit around $20-$30 a month as of November 2026. Replit Core $20, Lovable Pro from $25, Bolt.new Pro $25, v0 Plus $30 per user. Credit- or token-based pricing means heavy builds can cost more than the subscription.

Is vibe coding safe for a real business app?

It can be, but treat AI-generated code as untrusted until checked. Veracode’s 2025 study found 45% of AI-generated code introduced OWASP Top 10 vulnerabilities in testing. Enable Row Level Security on every database table, keep API keys in a backend secret store, run the platform’s security scan, and get a professional review for anything handling payments or regulated data.

Do I need to know how to code to use Lovable, Bolt.new, or Replit?

No, all three turn plain-language prompts into running apps and publish them with a click. You do need to describe problems clearly, test your app by clicking through it, and approve database changes. Reading a little code helps when something breaks; connecting GitHub (on all Lovable plans) makes the code yours to export.

What’s the difference between vibe coding and agentic coding?

Vibe coding is the accept-everything, conversation-driven style Karpathy described. Agentic coding is when the AI plans steps, writes code, runs tests, and iterates on its own. Modern tools blur the line (Replit Agent 3 runs long autonomous builds) but for production work, supervise the agent rather than accepting everything.

What mistakes should beginners avoid when vibe coding?

The big five: pasting API keys into chat instead of a secret store; launching with missing Row Level Security on the database; making many changes without testing; never connecting version control; and expanding scope until the app can’t be understood. Fixes: secrets in the backend, run the security scan, test one flow per change, sync GitHub from day one, keep the first app tiny.

What should I build first with vibe coding?

Something with one screen, one database table, and no payments: a habit tracker, a booking form, or a simple directory. That size lets you learn prompting, testing, connecting a database, and publishing in a weekend without drowning in edge cases. Add accounts, payments, and integrations only after the core loop works and is backed up.

Sources

• Karpathy’s original “vibe coding” tweet, February 2, 2025
• Wikipedia: Vibe coding (origin, dictionary adoption, incidents and studies)
• The Guardian: Vibe coding named Collins Dictionary Word of the Year 2025
• Fox Business: Merriam-Webster adds “vibe coding” to the dictionary
• Lovable pricing (accessed November 8, 2026)
• Lovable docs: GitHub integration
• Lovable docs: Supabase integration and RLS guidance
• Lovable docs: Security scanning (Quick and Deep scans)
• Lovable docs: Custom domains
• Bolt.new pricing (accessed November 8, 2026)
• Replit pricing (accessed November 8, 2026)
• Replit docs: Deployment pricing
• v0 by Vercel pricing (accessed November 8, 2026)
• Cursor pricing (accessed November 8, 2026)
• Reuters: SpaceX to buy Anysphere (Cursor) for $60 billion, June 16, 2026
• Claude pricing, Anthropic (accessed November 8, 2026)
• Firebase Studio (preview status and sunset notice, accessed November 8, 2026)
• GitHub Next: Copilot Workspace technical preview sunset, May 30, 2025
• GitClear: The Maintainability Gap, 2026 AI code quality research
• Veracode: 2025 GenAI Code Security Report
• Escape.tech: Methodology behind the vibe-coded app vulnerability scan, October 2025
• Stack Overflow Developer Survey 2025: AI section
• TechCrunch: A quarter of YC’s W25 cohort has codebases almost entirely AI-generated
• Reuters: Lovable raises $400M Series C at $13.3B valuation, August 12, 2026
• Superblocks: The Lovable vulnerability explained (CVE-2025-48757 and the 1,645-app scan)