Vibe Coding vs Engineering

What is it

Vibe Coding vs Engineering is the emerging cultural and technical fault line between two ways of building software with AI. "Vibe coding" — a term popularized by Andrej Karpathy in early 2025 — means prompting an LLM, accepting whatever code it generates, and iterating by feel rather than by understanding. Engineering means the same AI tools, but wrapped in code review, tests, type systems, observability, and accountability.

The technical essence is a question of who owns correctness: the human or the model. The business significance is enormous. If vibe coding is "good enough" for a growing share of software, then the value of traditional engineering discipline gets repriced — and so does every tool that enforces it. If it isn't good enough, a whole generation of AI-generated codebases becomes a maintenance liability, and the winners are the tools that audit, secure, and govern AI-written code. Either way, there is money in the gap between the two camps.

Why now

Three forces collided in 2025-2026 to make this a real debate rather than a Twitter argument.

First, capability. Models like Claude 3.7/4, GPT-5-class systems, and Gemini 2.5 crossed the threshold where non-engineers can ship working apps. Cursor hit roughly $500M ARR, Lovable reportedly crossed $100M ARR faster than any European startup in history, and Replit's Agent made "describe an app, get an app" mainstream. When the tool works, the discipline question stops being academic.

Second, consequences. AI-generated code now accounts for a large and growing share of commits at major companies. Security researchers have flagged rising rates of vulnerable patterns in AI output — hardcoded secrets, missing auth checks, dependency confusion. GitClear's data showed a measurable rise in code churn and copy-paste duplication after 2023, which is exactly what vibe coding produces at scale.

Third, culture. A generation of developers who learned to code with AI never internalized the rituals of engineering, and they resent being told their work doesn't count. The debate is now a status conflict, and status conflicts generate content, community, and tooling demand. That's why the trend surfaced on dev.to and Lobsters rather than in a vendor's marketing blog.

Market Evidence

The signal is early but clean. Two independent sources — dev.to and Lobsters — produced four mentions with a 100% growth rate, and the trend was first seen on 2026-09-14. A trend score of 64/100 with a nascent stage means this is a topic with accelerating mindshare but essentially zero commercial infrastructure built around it yet.

That's a specific and useful profile. A trend that appears on Lobsters (a technically conservative, anti-hype community) as well as dev.to (a broader, more promotional audience) is not just vendor noise — it's crossing from marketing into developer identity. The 100% growth rate off a tiny base of four mentions is statistically meaningless on its own; what matters is the direction and the venue.

My read: this is real demand, but it's demand for opinions and validation, not yet demand for products. The opportunity score of 0/100 and market score of 0/100 reflect that no one has monetized it. That's the classic pre-product window. The hype risk is that the debate stays a debate — endless thinkpieces, no willingness to pay. The way to tell the difference is whether people start asking "how do I check this" instead of "is this okay." They are starting to.

Who's Behind It

The whales are the AI coding platforms themselves, because the debate is existential for their positioning. Cursor (Anysphere), GitHub Copilot, Replit, Lovable, Bolt, and Windsurf all benefit from vibe coding being legitimate — their core pitch is "you don't need to be an engineer." Conversely, GitHub, GitLab, Sonar, Snyk, and the entire DevOps/security toolchain benefit from engineering discipline being non-negotiable, because their products exist to enforce it.

The intellectual anchors are Andrej Karpathy, who coined the term and later walked it back as "not something to aspire to for production," and Simon Willison, who has become the most-cited voice arguing for "AI-assisted engineering" as the honest middle. On the community side, Lobsters and Hacker News host the skeptics; dev.to and YouTube host the practitioners.

The competitive dynamic is a framing war. Whoever defines the vocabulary — "vibe coding," "AI-assisted engineering," "agentic development" — shapes which tools buyers think they need. Right now nobody owns the "quality layer for AI-generated code" category. That's the opening.

TAM & Market Size

The buyers split into three segments.

Professional engineering teams (largest budget): roughly 30 million developers worldwide, of whom perhaps 8-10 million work in organizations with real compliance and security requirements. These teams already pay $20-100/developer/month for tooling (GitHub, Snyk, SonarQube, Datadog). A tool that governs AI-generated code plausibly commands $15-40/seat/month. Even 1,000 teams of 20 seats at $25 is $6M ARR.

Vibe-coding solo builders and small agencies: tens of millions globally, but low willingness to pay — $10-30/month, freemium-heavy. High volume, high churn.

Compliance and audit buyers: regulated industries (fintech, health, gov) where "who wrote this code and was it reviewed" becomes a legal question. Highest price tolerance ($50k-500k/year enterprise contracts) but longest sales cycles.

The demand score of 0/100 reflects that no one has proven willingness to pay yet. My position: the professional engineering segment will pay, and fast, because the pain is concrete — a security incident traced to AI-generated code is a career-ending event for an engineering leader. The solo segment will not pay meaningfully. Build for the middle-up, not the bottom.

Competitive Landscape

Existing players cluster in adjacent spaces, none owning this category directly.

Security scanners (Snyk, Semgrep, SonarQube, GitHub Advanced Security) detect bad code but don't distinguish AI-generated from human-written, and they're positioned as generic SAST — a feature, not a category.

AI code review (CodeRabbit, Greptile, Graphite Diamond) is the closest adjacent space. CodeRabbit has real traction and reviews AI-generated PRs, but its pitch is "faster review," not "accountability for AI code."

Provenance and attestation (Sigstore, SLSA, in-toto) can technically answer "where did this code come from," but they're infrastructure, not developer-facing products.

The gap: nobody is selling "AI code quality governance" as a first-class product — a tool that flags which lines were model-generated, scores their risk, and produces an audit trail. Big Tech will enter: GitHub is the obvious candidate (it owns the commit graph and Copilot). You have roughly 12-18 months before GitHub ships a native "AI contribution insights" feature. That window is enough to win a niche, not to win the category.

Business Model

Recommended: seat-based SaaS with a freemium developer tier and an enterprise audit add-on.

Why: the buyer is a team lead or platform engineer with a discretionary tooling budget, and seat-based pricing matches how every adjacent tool (Snyk, Sonar, CodeRabbit) is sold. Freemium gets you the solo vibe-coder audience for distribution and word-of-mouth without pretending they'll pay.

Pricing:

• Free: 1 repo, basic AI-code detection, 7-day history.
• Team: $19/developer/month (annual) or $24 monthly — unlimited repos, risk scoring, PR annotations, Slack alerts.
• Enterprise: from $35/seat/month plus a $15k-50k/year platform fee — SSO, audit logs, policy enforcement, on-prem option.

Rationale: $19 undercuts CodeRabbit's $24-30 and Snyk's ~$25/seat while staying above the "too cheap to trust" line for security buyers.

12-month forecast (assuming launch at month 3):

• Conservative: 40 paying teams, avg 12 seats = ~$110k ARR.
• Base: 150 teams, avg 15 seats = ~$510k ARR.
• Optimistic: 400 teams + 5 enterprise deals = ~$1.8M ARR.

CAC: $400-900 via content/community-led growth (this audience hates ads). Payback: 4-7 months on Team tier, under 3 on Enterprise. The model works if you keep CAC under control — which means content, not paid acquisition.

MVP Blueprint

Goal: a working product in 5 days that answers one question — "which code in this PR was AI-generated, and is it risky?"

Core features (build only these):

1. GitHub App that reads PR diffs via webhook.
2. Heuristic AI-code detector: flag commits with AI co-author trailers (Copilot, Cursor, Claude Code all add them), plus stylometric signals (uniform comment density, over-explaining comments, generic variable names).
3. Risk rules on flagged lines: hardcoded secrets, eval/exec, missing error handling, SELECT *, disabled TLS verification, TODO/FIXME density.
4. A single PR comment summarizing: "X% AI-generated, N risk flags, links to lines."
5. A one-page dashboard: repo-level AI-code percentage over time.

Cut: IDE plugins, multi-language deep analysis, policy engine, SSO, custom rules. All v2.

Stack: Next.js + TypeScript on Vercel, Postgres (Neon or Supabase), GitHub App via Octokit, a queue (Inngest or Trigger.dev) for webhook processing. No ML training — ship heuristics first, add a fine-tuned classifier in month 3 once you have labeled data from real usage.

Fastest path to launch: Post in the same dev.to/Lobsters threads where this debate is happening, with a free scan of a well-known open-source repo as the hook. Ship in 5 days, not 5 weeks.

Commercial Opportunities

1. AI Code Audit Service (productized consulting). Sell a one-time audit of a company's AI-generated codebase: security review, maintainability score, remediation report. Target: Series A-C startups that let engineers vibe-code fast and now face a due-diligence or security review. Price: $8k-25k per engagement. Expected: $20k-60k/month at 3-5 engagements. This beats pure SaaS early because it funds development and teaches you exactly what to automate.

2. CI/CD gate for AI code (API-first). A GitHub Action / GitLab CI step that fails the build if AI-generated code exceeds a risk threshold or lacks required review. Target: platform engineering teams at 100-2,000-person companies. Price: $500-3,000/month per org. Expected: $15k-80k/month. This beats the audit service on scale and recurring revenue.

3. "Vibe-to-Production" hardening platform. Take a Lovable/Bolt/Replit prototype and make it production-ready: add auth, tests, error tracking, CI. Target: non-technical founders who shipped a vibe-coded MVP and now need it to survive real users. Price: $2k-10k one-time plus $200-500/month maintenance. Expected: $10k-50k/month. This is the highest-volume, lowest-competition play because it serves the exact people the debate is about.

Product Ideas

🥇 VibeCheck — "Know which lines your AI wrote, and whether they're dangerous." A GitHub App that tags AI-generated code in every PR, scores its risk, and blocks merges that fail your policy. Target: engineering leads at 20-500-person companies who've adopted Cursor/Copilot and now worry about what's landing in main. Why now: AI co-author trailers are already in the commit graph, so the data exists — nobody has productized it. This is the wedge.

🥈 VibeAudit — "A security and maintainability audit for your AI-built codebase, in 48 hours." Productized service plus a self-serve scanner for founders who vibe-coded an MVP and need it to pass a real user's scrutiny or an investor's diligence. Target: non-technical founders, indie hackers post-launch. Why now: thousands of Lovable/Bolt apps are hitting production with no tests and no auth; the pain is arriving in waves.

🥉 EngGrader — "The engineering-maturity score for AI-assisted teams." A dashboard that benchmarks a repo against engineering best practices and shows the delta between "vibe" and "production-grade" — tests, coverage, review latency, incident history. Target: CTOs and VPs Engineering who need to justify tooling spend and report on AI-adoption risk to the board. Why now: boards are starting to ask "what's our AI code risk," and nobody has a number to give them.

Priority order: VibeCheck first (fastest to build, clearest buyer), VibeAudit second (funds the SaaS), EngGrader third (highest price, longest cycle).

SEO Opportunity

Search interest in "vibe coding" spiked through 2025 and is still climbing; "is vibe coding safe," "AI generated code security," and "vibe coding vs engineering" are rising with low competition. SEO difficulty is effectively 0/100 — no established authority owns these terms yet.

Target long-tails: "how to tell if code was AI generated," "AI code review tool," "vibe coding production ready," "Copilot co-authored commits security," "AI generated code audit."

Strategy: publish one definitive, data-backed piece — "We scanned 1,000 open-source repos for AI-generated code risk; here's what we found" — and let the data earn the backlinks. Original research beats keyword stuffing in a nascent category every time.

Risk Assessment

The thesis breaks if vibe coding gets absorbed into normal engineering so thoroughly that "AI-generated code" stops being a meaningful category — at which point governance tools have nothing distinct to govern. This is the most likely failure mode and it's a 2-3 year risk, not a 6-month one.

Risk 1 (market): The debate stays cultural and never becomes a budget line. Engineering leaders agree it's a problem but treat it as a process issue, not a tool purchase. Mitigation: validate with the audit service first — if nobody pays $8k for an audit, they won't pay $19/seat.

Risk 2 (tech): GitHub, GitLab, or the AI vendors themselves ship native AI-code attribution and risk scoring for free. GitHub already has the commit graph. Mitigation: go deeper than they will (custom policies, compliance reporting, multi-vendor detection) and move fast.

Risk 3 (execution): Detection heuristics produce false positives and the tool cries wolf, killing trust. Mitigation: ship as "signals, not verdicts," let users tune thresholds, and never block a merge by default in v1.

Cheap validation: Run the detector as a free script against 20 public repos, publish the results, and count inbound "can you do this for my repo" replies. If you get 10 serious ones in two weeks, build. If you get zero, walk away.

Action Plan

Today: Write the heuristic AI-code detector as a standalone script. Run it against 20 well-known open-source repos (including ones known to use Copilot heavily). You'll have real data by tonight.

Week 1: Publish the findings as a dev.to post and a Lobsters submission, framed as "we scanned 20 repos — here's how much AI-generated code is hiding in them." Include a waitlist link. Target: 50 signups, 10 "do my repo" requests. Simultaneously, DM five engineering leads you know and offer a free manual audit in exchange for a 30-minute feedback call.

Month 1: Ship the GitHub App MVP (5 dev days per the blueprint). Convert 3-5 of the free audits into paid pilots at $500-1,500/month. Instrument everything: which risk flags fire most, which users come back. Goal: 10 paying teams, $5k MRR.

Month 3: Add the CI gate and the enterprise audit-log feature. Raise Team pricing to $19/seat if conversion holds. Hire one content person. Goal: $25k MRR, 2 enterprise pilots, and a clear answer to "would you pay for this again next year?" If the answer is no, pivot to the VibeAudit service model, which has shorter sales cycles and no retention problem.

Related Terms

AI-assisted engineering — the "respectable" framing of the same practice; it's the vocabulary your enterprise buyers will use, so your marketing should mirror it even while the community says "vibe coding."

AI code provenance / attestation — the infrastructure layer (SLSA, Sigstore, co-author trailers) that makes detection technically possible; it's the supply side of this trend.

Agentic development — autonomous coding agents (Devin, Claude Code, Codex) push the vibe/engineering question from "did a human review this" to "did anyone review this," which is the next, harder version of the same problem.