Vibe coding vs custom software: can an AI app builder run your business?

What “vibe coding” actually means

“Vibe coding” describes building software by describing what you want in plain language and letting an AI write the code. Tools like Lovable, Bolt.new and Base44 take this further: you type “a booking app for my clinic with a dashboard”, and a few minutes later you have something that runs, with screens, a database and a public link.

For business owners, that’s genuinely exciting. Ideas that used to need weeks of budget discussions can now be clicked through in an afternoon. The real question is not whether these tools work. They do. It’s what they are good for, and where they quietly become a risk.

Where AI app builders shine

Used for the right job, AI builders save real time and money:

• Prototypes and clickable demos to show investors, partners or your own team what you mean.
• Internal tools with no sensitive data, such as a simple tracker or a one-off calculator.
• MVP validation: testing whether customers actually want something before investing in a full build.
• Exploring UX ideas quickly, then throwing away what doesn’t work.

In all of these cases, the app is short-lived, low-stakes, or not exposed to real customer data. That’s the sweet spot.

What the security research is showing

The trouble starts when a prototype quietly becomes production: real users, real data, real payments. Several research teams have looked at what that looks like in practice. Many of these findings come from security vendors, who have an interest in the topic, but the pattern is consistent:

• Escape scanned about 1,400 production apps built on vibe-coding platforms (including Lovable, Base44 and Bolt.new) and reported 2,038 highly critical vulnerabilities, more than 400 exposed secrets such as API keys, and 175 instances of exposed personal data, including medical and financial information. (Escape blog)
• Red Access scanned more than 5,000 publicly deployed vibe-coded apps and reported that around 40% exposed sensitive data.
• Researchers at Wiz reported that Base44 had exposed undocumented registration endpoints without authentication, which could have let attackers create verified accounts on private apps.
• The Cloud Security Alliance tracked CVEs attributable to AI-generated code rising from 6 in January 2026 to 15 in February and 35 in March 2026. The numbers are small, but the trend is clear. (CSA research note)

There is also a newer supply-chain risk. Language models sometimes “hallucinate” software packages that don’t exist. Attackers can register those names and fill them with malicious code, a technique now called slopsquatting. If nobody checks what the AI installed, your app may be pulling in code from a stranger.

The real problem isn’t AI

It’s tempting to conclude that AI-written code is bad. That’s not the lesson. Professional engineering teams, ours included, use AI coding tools every day. The difference is what surrounds the AI:

• Code review by people who understand what the code does.
• Authentication and authorization designed deliberately: who can log in, and what each role can see and change.
• Secret management, so API keys never sit in the browser or a public repository.
• Tests and security checks that run before anything reaches users.
• Architecture and deployment hygiene: environments, backups, monitoring and updates.

Vibe-coded apps get into trouble when these steps are skipped, not because a model wrote the first draft.

AI builder or engineered software?

An AI builder is fine when…	You need engineered software when…
It’s a prototype or demo	Real customers log in and store data
Data is fake or non-sensitive	You handle personal, medical or financial data
One person uses it	Different roles need different permissions
No payments are involved	You take payments or issue invoices
It stands alone	It must integrate with ERP, CRM, payment gateways or WhatsApp
It’s short-lived	It must run reliably for years and scale with traffic
No regulator cares	You have compliance or data-residency requirements

The hybrid path we recommend

You don’t have to choose between speed and safety. A sensible path looks like this:

1. Prototype fast with AI. Use Lovable, Bolt.new or similar to turn the idea into something people can click.
2. Validate with real users. Show it, watch how people use it, and decide what is worth building.
3. Rebuild or harden with an engineering team before real data goes in. That means proper authentication and role-based access control (RBAC), audit logs, backups, monitoring, data residency where required, Arabic and RTL quality that feels native rather than mirrored, and performance that holds up under load.

The prototype becomes a living specification. It saves weeks of discussion, and the final system is built on decisions you have already tested.

Already shipped a vibe-coded app? Start here

If an AI-built app is already live with real users, run through this checklist now:

1. Rotate all API keys and secrets, and move them to server-side environment variables.
2. Check your database rules: confirm row-level security (or equivalent) is on, so users can only read their own records.
3. Review what is public: storage buckets, admin pages, API endpoints and preview links.
4. Add or tighten authentication, including on every API route, not just the login screen.
5. Review dependencies for unknown or suspicious packages, and update outdated ones.
6. Set up backups and test that you can actually restore them.
7. Get a security review from someone who didn’t build the app.

How Cortex can help

We like these tools, and we use AI in our own workflow to deliver faster. What we add is the engineering around it: architecture, security, integrations and long-term support. If you have a prototype that’s proving itself, we can help turn it into a production-ready web platform or review what you’ve already shipped. A good first step is our project quote wizard.