The term "vibe coding" refers to developer workflows centered around high-level prompting. An engineer describes what they want, the AI generates the lines, and the engineer runs it. If it works, they move on. It feels fast, productive, and satisfying. But as software architects, we have to look past the initial demonstration.
The Illusion of Velocity
Writing code is only 20% of the software engineering lifecycle. The other 80% is reading, refactoring, testing, debugging, and maintaining. While AI can draft a single page or function in seconds, it lacks context about your entire systems landscape.
This lack of context results in copy-paste logic, duplicated helper functions, and inconsistent patterns. Over a few weeks, these code bases grow exponentially in file size, but crawl in iteration speed.
Under-the-Hood Security Risks
LLMs generate code based on statistical patterns from training datasets, which include thousands of legacy repositories containing security vulnerabilities. When prompted, AI often generates code that:
- Omits robust server-side input validation.
- Introduces SQL injection risks by skipping parameterization.
- Hardcodes credentials or lacks token validation blocks.
- Pulls in outdated dependencies with known CVEs.
The Scalability Bottleneck
AI does not naturally plan for databases, caching layers, or request rate limits. Prompts usually build simple, straightforward implementations that break under load. A typical AI-generated endpoint might fetch millions of rows directly to the server memory instead of utilizing proper database pagination and indexing.
How to "Vibe" Safely
At Saham, we embrace AI code assistants (like Copilot and Cursor) but enforce strict quality controls:
1. AI as Assistant, Not Architect: Humans must design the data architectures, routing layers, and system boundaries. Use AI to fill in the code blocks within those established guidelines.
2. Automated Guardrails: Set up automated CI/CD pipelines with security linters (SonarQube, Snyk) to check code for vulnerabilities before it goes anywhere near production.
3. Rigorous Peer Reviews: Every single line of generated code must go through a code review by another senior developer. If you cannot explain what the generated code does line-by-line, it does not get merged.