Vibe coding: when it works, where it stops, and when to involve an agency
Vibe coding is an excellent way to start. It is not always the right way to continue alone.
ChatGPT Canvas, Claude Artifacts, Lovable, Bolt, and Replit can turn an idea into an interactive interface within hours. That is genuine progress: teams can show, test, and revise a concept before committing to a full build. The boundary appears when the demonstration becomes a product that people, data, or a business operation start to depend on.
The debate is often reduced to two bad positions. Either vibe coding is dismissed as a toy, or it is presented as making developers obsolete. Both confuse speed of creation with responsibility for what happens next.
A working prototype and a production application solve different problems. The first helps a team learn. The second must keep working when a user makes a mistake, the network drops, a dependency changes, or someone actively looks for a weakness.
The same tool can support two very different practices
The useful boundary is not between AI and hand-written code, nor between a no-code builder and an IDE. It is between work that is merely tried and work that is understood, verified, and owned.
Vibe coding
You describe an outcome, try what the model generated, and continue while the interface appears to work. That can be entirely reasonable when errors are visible, reversible, and inexpensive.
AI-assisted engineering
The same models accelerate delivery, while architecture, permissions, data, tests, and deployments are reviewed by someone who can intervene without relying on the next prompt.
Appik Studio does not work against AI. We use it to move faster, within an engineering process that turns a plausible answer into a verifiable result.
When vibe coding is the right tool
It creates the most value when it shortens a learning loop without creating a dependency that will be difficult to take over.
Make an idea visible
An interactive screen aligns a team, investor, or prospective user better than a long description. Misunderstandings surface while they are still cheap to fix.
Fictional data and no operational commitment.
Test a journey
A team can learn whether sign-up, booking, or a dashboard makes sense before choosing the final architecture.
The test validates usability, not yet security or resilience.
Automate a local need
A calculator, personal tool, or small internal interface can remain simple when mistakes are easy to spot and no sensitive data is involved.
Few users, limited impact, and an obvious fallback.
Write a better product brief
The prototype reveals real screens, missing business rules, and questions nobody had formulated. Even if its code is discarded, that learning remains valuable.
Treat the prototype as a hypothesis, not an established foundation.
The useful question: what happens when the software is wrong?
Project size is a poor indicator. A small administration page can be more critical than a large demonstration app. Assess the consequences, reversibility, and who will be accountable.
Errors are visible and reversible
You are learning faster than you are accumulating risk. Vibe coding can remain the primary tool.
- Mock-up or demonstration
- Personal tool without sensitive data
- Experiment using fictional data
Real people are starting to depend on the product
A targeted review prevents a prototype from quietly becoming the company's infrastructure.
- User accounts and roles
- The first customer records
- Business integrations or automations
Errors are costly, sensitive, or difficult to reverse
The product needs explicit technical ownership, reproducible controls, and an operating plan.
- Payments or irreversible operations
- Sensitive health, financial, or personal data
- A service that a team or customers rely on
As long as an error is easy to detect, reversible, and inexpensive, continuing alone can be rational. When users, data, money, or an operation depend on the product, the standard of evidence must change.
What a successful demonstration does not prove
A screen that works along the intended path says little about everything that happens outside it. Production readiness means replacing those unknowns with controls.
Security and data access
Permissions must be enforced on the server, secrets kept out of the browser, and every role restricted to the data it owns. Uploaded files, dependencies, and AI providers receiving context also need review.
Architecture and maintenance
AI can solve each local request while producing an incoherent whole. A durable architecture remains understandable, documented, based on widely used technology, and transferable to another team.
Testing and continuous delivery
CI/CD does not prevent regressions by itself. It becomes useful when critical journeys — sign-in, payment, permissions, synchronization — have tests that genuinely block a defective release.
Observability, analytics, and alerts
An error discovered only when a customer writes in is not being monitored. A tool such as Sentry should connect incidents to releases and alert a named person. Security alerts should also flag exposed secrets, vulnerable dependencies, or abnormal access. Product analytics such as PostHog helps reveal the journeys people actually use. Logs, replays, and events still need sensitive-data masking, limited collection, appropriate consent, and a defined retention period.
Backups, rollback, and continuity
Teams need to restore data and return to a stable release; a backup that has never been restored remains an assumption. The client should also control the repository, accounts, domains, environments, and documentation. If the original creator or tool disappears, the product should not disappear with them.
Real-world use and accessibility
Users do not share the same device, connection, or way of interacting. Keyboards, screen readers, small screens, invalid input, and interruptions belong to the product, not to optional finishing work.
A solid stack is not a list of logos. It is a product that can be explained, tested, deployed, observed, restored, and handed over.
In Switzerland, server location is only part of the answer
The revised Swiss Federal Act on Data Protection applies to personal-data processing in Switzerland. The GDPR may also apply depending on the people concerned, target market, and processing involved. A serious application must know which data it collects, why, where that data travels, who can access it, and how long it is retained.
Appik can deploy infrastructure in Switzerland when sovereignty or client requirements justify it. But a Swiss database is not enough if logs, email, analytics, or an AI model then send the same data elsewhere.
Hosting in Switzerland can be a sound choice. It is not a security certificate.
The decision should follow the data map, approved subprocessors, backups, access model, and contractual requirements — not an isolated geographical promise.
Ten years of writing code by hand makes AI more useful, not less
I spent more than ten years building, debugging, and maintaining applications before AI agents arrived. That experience makes it easier to spot an unnecessary abstraction, an overly broad permission, a fragile dependency, or a fix that hides the actual problem.
Today, we delegate a meaningful share of generation, testing, documentation, and analysis to AI. The speed gain is real. But the decision to keep an architecture, release a migration, or accept a risk remains human.
“Experience is not about writing every line more slowly. It is about knowing what to delegate, how to verify it, and when to take back control.”
Gaspard Chevassus
Founder of Appik Studio · Mobile and web developer for more than 10 years
After launch, client autonomy matters as much as the code
A durable product needs more than occasional updates. Users need answers, and the client team should be able to take over a conversation without depending on Appik for every request.
- 1
AI answers from product context
ConvChat uses instructions and FAQs specific to the client to handle common questions. In BYOK mode, the client connects the provider and model it has approved.
- 2
The client team remains in control
Its staff access the shared inbox, see conversation history, and take over cases the assistant cannot solve. AI does not become a wall between the user and a person.
- 3
Appik handles technical issues separately
When a problem requires a product or infrastructure change, Appik can intervene under a separate maintenance agreement. Unlimited human support is not presented as free.
ConvChat is already integrated into products including Le Pool and Smatch. Its use is included for Appik clients, with access for their own support team members.
ConvChat access is included; BYOK provider usage and Appik's technical interventions remain under the client's control and contract.
Can you still reasonably continue alone?
Answer these questions honestly. A single yes does not condemn the project, but it suggests that an outside review may prevent an expensive decision.
- Do users or colleagues already depend on the product to do their work?
- Do you process personal, confidential, medical, or financial data?
- Does the application handle payments, permissions, or an operation that is difficult to undo?
- Are you unable to explain exactly who can read or change each piece of data?
- Did a recent fix break a feature that appeared unrelated?
- Do you have a separate test environment and a reproducible rollback?
- Have your backups ever been restored successfully?
- Does a named person receive actionable technical and security alerts, then know how to resolve a production incident?
- Have you verified that logs, analytics, and replays do not capture unnecessary sensitive data?
If the product has changed category, it does not necessarily need a rewrite. First determine what can remain, what needs reinforcement, and who will own the next stage.
Frequently asked questions
Is vibe coding suitable for a professional project?
Yes, especially for exploring a need, testing a journey, or creating a low-risk tool. Whether a project is professional depends less on the tool than on the consequences of errors and the controls in place.
Must an app created with ChatGPT, Claude, or Lovable be rewritten?
Not automatically. Interfaces, journeys, and some layers can often remain. The decision should follow a layer-by-layer audit of data, authentication, business logic, frontend, and operations.
Does Swiss hosting guarantee compliance with the FADP?
No. It can address residency or sovereignty requirements, but compliance also depends on purpose, access, subprocessors, transfers, retention, and security measures.
Is an agency using AI also vibe coding?
It may use the same models, but the practice changes when code is understood, reviewed, tested, and operated under a team's responsibility. AI then accelerates engineering instead of replacing it.
When should I ask for an outside opinion?
Before the product becomes critical: as soon as real users, sensitive data, payments, or business integrations arrive. A short review at that point costs less than a takeover after an incident.
Useful sources
NCSC — Vibe coding spectrum
A framework for oversight proportionate to risk and the autonomy given to AI tools.
OpenAI — ChatGPT Canvas
Official documentation for editing code and rendering React/HTML in Canvas.
Anthropic — Claude Artifacts
Official documentation for creating and sharing interactive prototypes and apps.
FDPIC — Legal basis for data protection
Official references for the revised Swiss Federal Act on Data Protection.
Sentry — Alerts
Official documentation for alerts tied to errors, metrics, and releases.
PostHog — Privacy
Controls for collection, processing, storage, and masking in analytics and session replay.
You do not need a proposal to learn whether your project has changed category.
In a free 30-minute initial conversation, we look at the context, users, data, and next milestone. We will tell you plainly whether continuing alone makes sense, whether a few areas need reinforcement, or whether a technical audit is justified. If a full audit is appropriate, it is proposed separately as a paid engagement with an explicit scope and deliverables.
Swiss Made Software
