How to build an MVP with AI: what vibe coding gets right and what production needs
AI gets you to a prototype in days. The rest of the road needs your eyes open.
- Vibe coding
- Building software by describing what you want to an AI model in natural language rather than writing the code line by line. The term was coined by Andrej Karpathy and named Collins Dictionary's Word of the Year for 2025 (Collins, 2025).
Can you really build an MVP with AI?
Yes, for the part whose job is learning: screens, flows, a simple database, a demo to put in front of customers. What used to take weeks can take days, and a non-technical founder can show something concrete in the very first round of interviews.
The hard part is not building; it is trusting what got built. Even professional developers are wary: in the Stack Overflow 2025 survey, 84% use or plan to use AI tools, yet 46% distrust the accuracy of the output and 66% name answers that are almost right, but not quite, as their top frustration.
Speed is also less automatic than it feels. In a randomised trial run by METR in early 2025, 16 experienced open-source developers took 19% longer on 246 real tasks when AI tools were allowed, despite believing afterwards that they had been about 20% faster. METR itself flags that the results reflect early-2025 tools and one specific setting, so treat it as a warning about perception, not a verdict on AI.
Where does AI genuinely help when building an MVP?
In how quickly it turns an idea into something people can react to.
- Demo-ready prototypes: realistic screens and flows to use in customer interviews instead of static mock-ups.
- Internal tools: admin panels, lightweight back-office tools for a concierge MVP, import scripts.
- Exploring options: three versions of the same flow in an afternoon, to see which one users understand.
- Boilerplate: forms, validation, basic tests and documentation, provided someone reviews them.
One especially sensible pattern is Wizard of Oz: generate the interface with AI, have a person do the work behind it, and measure whether anyone values the result before automating it. More in types of MVP.
Where do vibe-coded MVPs usually break?
Almost always in the parts nobody sees in a demo: who can read which data, what happens when something fails, how the code changes without breaking everything else. This is the checklist we run when reviewing an AI-generated prototype.
| Area | What often goes wrong | What to check |
|---|---|---|
| Access control | Over-permissive database rules; one user's data visible to another | Every table has access rules; try reading another account's data |
| Secrets and keys | Service keys shipped in code that reaches the browser | No private keys client-side; rotate any key that was exposed |
| Personal data | Data collected without a reason, no privacy notice, unknown hosting | What you collect, where it lives, who sees it, how it is deleted |
| Payments | Subscription status decided in the browser; app store rules ignored | Server-side verification; in-app purchases where stores require them |
| Errors and edge cases | The happy path works, nothing else does | Slow networks, empty fields, double clicks, expired sessions |
| Maintainability | Code nobody can explain, rewritten on every prompt | Version control, automated tests, someone who can read the code |
| Backups | None, or never tested | Automated backups and a restore you have actually rehearsed |
45%
Veracode's July 2025 report used curated tasks, so the figure is not an average across all AI-written code in production. It is still a clear signal that generated code needs review, particularly for the categories in the OWASP Top 10:2025, where broken access control sits at number one.
How do you build an MVP with AI without getting burnt?
Let AI speed up the learning, and keep human attention on anything that touches data or money. Five working rules:
Five rules for an AI-built MVP
Start from the assumption, not the tool
The question you need answered comes before the first prompt. Without it, AI will help you build the wrong thing very quickly. The method is in what is an MVP.
Prototype with fake data
Until access rules and protections are verified, no real personal data: invented names, test email addresses, payment providers in test mode.
Use version control from day one
Track every change with git so you can see what happened and roll back when a prompt breaks something that used to work.
Get data and money paths reviewed
Access rules, permissions, secrets and payments should be reviewed by an experienced developer before real users arrive. That is where mistakes are most expensive.
Decide before launch: harden or rebuild
Assess honestly whether the generated code can grow or whether the critical parts should be rebuilt. Criteria below.
What does it take to put an AI prototype into production?
The same things any software with real users needs. AI does not remove them; it just makes them easier to forget.
- Verified access control: each user sees only their own data, and you have proved it from a second account.
- Secrets kept secret: no private keys in public code, environment variables managed on the server.
- Lawful handling of personal data: privacy notice, lawful basis, known processors and storage locations, as the GDPR requires for anyone serving people in the EU; see GDPR for startups.
- Server-side payments: the browser never decides subscription status, and app stores' own rules apply in their stores.
- Tested backups: automated, with a copy off the main server and at least one rehearsed restore.
- Automated tests and releases: checks that run on every change before it reaches users.
- Error monitoring: knowing something broke before a customer tells you.
- Dependency updates: libraries and third-party services kept current, because that is where many vulnerabilities come from.
Should you rewrite a vibe-coded prototype or harden it?
It depends on how readable it is and what it has to carry. If the code is understandable, under version control and on a mainstream stack, hardening it piece by piece is usually cheaper; if it is a pile of contradictory generations nobody can explain, rebuilding the critical parts beats patching.
- Harden when a developer can explain the code within an hour, the data sits in a standard database and the problems are local.
- Rebuild the critical parts when access control, payments or the data model are wrong at the root: patches will not hold there.
- Start again only when the prototype is locked into a platform that lets you export neither code nor data.
The broader choice between no-code platforms and custom code has its own guide, no-code vs custom development; for budget drivers see MVP development cost. If you are still deciding what to build, start with MVP vs prototype vs proof of concept.
Frequently asked questions
Is a vibe-coded MVP ready for production?
Not by default. It can be, once it has passed the same checks as any other software: access control, secrets, personal data, payments, backups and tests. How the code was written matters less than how thoroughly it was checked.
Is a vibe-coded MVP good enough to raise a round?
It can be enough to show the product and early usage, which is what matters at the earliest stage. A careful investor will still ask who can access the data, how the code is structured and who maintains it, and clear answers count as much as the demo.
How much does it cost to build an app with AI tools like Lovable or Base44?
The prototype itself is cheap: mostly subscriptions and your time. The real cost sits in making it safe for real users, which depends on what needs hardening; the drivers are in MVP development cost.
What data can I use in an AI-built prototype?
Only invented data until access rules and protections have been verified. Once real personal data comes in, the GDPR applies if you serve people in the EU, regardless of which tool built the app.
Do AI coding tools make developers faster?
It depends on the context. METR's 2025 trial found experienced developers 19% slower on codebases they knew well with early-2025 tools, while they believed they were faster; METR stresses those results are dated and narrow. For quick prototypes on new projects the speed-up is usually obvious.
Sources
- Collins Dictionary, Word of the Year 2025: vibe coding (6 novembre 2025) (19 October 2026)
- Stack Overflow, 2025 Developer Survey: AI (19 October 2026)
- Veracode, 2025 GenAI Code Security Report (comunicato del 30 luglio 2025) (19 October 2026)
- OWASP Top 10:2025 (19 October 2026)
- NIST National Vulnerability Database, CVE-2025-48757 (19 October 2026)
- METR, Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity (10 luglio 2025) (19 October 2026)
Figures and definitions checked on the dates shown.
