Vibe Coding and Citizen Development

Introduction

The emergence of vibe coding has captivated the software development community with its promise of democratized application creation. Coined by Andrej Karpathy in early 2025, this approach allows users to describe their desired functionality in natural language while artificial intelligence generates the underlying code. For organizations struggling with developer shortages and mounting IT backlogs, vibe coding appears to offer an attractive solution. Yet beneath this seductive simplicity lies a fundamental tension that enterprises cannot afford to ignore. While vibe coding represents an important evolution in how we create software, the evidence overwhelmingly suggests it cannot stand alone as the foundation for citizen development. The challenges span security vulnerabilities, quality degradation, contextual limitations, and governance requirements that demand a more sophisticated approach. Understanding these limitations is essential for organizations seeking to harness AI-powered development while maintaining the stability, security, and scalability that enterprise systems demand.

The Security Vulnerability Crisis

Security represents perhaps the most pressing concern with vibe coding as a standalone approach to citizen development. Research reveals a disturbing pattern of vulnerabilities in AI-generated code that stems from fundamental limitations in how large language models operate. These systems learn from vast repositories of public code, inevitably absorbing not just best practices but also the security failings that pervade these codebases. The specific vulnerabilities that emerge are both common and dangerous. SQL injection flaws, insecure file handling, and improper authentication mechanisms appear regularly in AI-generated code. Even more concerning, vibe-coded applications frequently include hardcoded API keys visible directly in webpage code, authentication logic implemented entirely on the client side where it can be easily bypassed, and missing authorization checks in handlers that verify only that users are authenticated but not whether they have permission to access specific resources.

Security represents perhaps the most pressing concern with vibe coding as a standalone approach to citizen development​

Systematic studies of AI-generated code have identified the most prevalent security issues as code injection, OS command injection, integer overflow, missing authentication, and unrestricted file upload. These are not theoretical concerns. The compromise of the Nx development platform through a vulnerability introduced by AI-generated code demonstrates the real-world consequences of these security gaps.​ The core challenge is that AI tools lack awareness of organization-specific security policies and requirements. When developers implement vibe coding without proper security oversight, they create authentication gaps, expose data inadvertently, and introduce injection vulnerabilities that LLMs are not inherently designed to prevent. For citizen developers who typically lack security expertise, the likelihood of missing these problems before deployment becomes dangerously high.​

Quality Degradation

The code often works just well enough to pass initial tests but proves brittle and poorly organized beneath the surface.

Beyond security, vibe coding introduces significant code quality challenges that compound over time. Research examining millions of lines of code reveals troubling trends in how AI-assisted development affects the software we create. The most striking finding is an eightfold increase in duplicated code blocks during 2024. While duplicated code may function correctly initially, it represents a marker of poor quality that adds bloat, suggests lack of clear structure, and increases the risk of defects when the same code requires updates in multiple locations.​ The accuracy statistics for AI code generation paint a sobering picture. ChatGPT produces correct code just 65.2% of the time, GitHub Copilot manages 46.3%, and Amazon CodeWhisperer achieves only 31.1% accuracy. More than three-quarters of developers report encountering frequent hallucinations and avoid deploying AI-generated code without human review. One quarter of developers estimate that one in five AI suggestions contains factual or functional errors. The problem intensifies dramatically with complexity. While AI tools can generate simple login forms or single API calls with reasonable precision, accuracy declines sharply as projects become more intricate. The mathematical reality is stark: even assuming an impressive 99% per-decision accuracy rate, after 200 successive decisions the probability of making no mistakes drops to approximately 13%. This compounding probability means that minor errors accumulate rapidly in complex tasks, significantly diminishing accuracy precisely when enterprises need it most.​ AI-generated code also tends to be harder to maintain and scale as projects grow. The code often works just well enough to pass initial tests but proves brittle and poorly organized beneath the surface. Developers working on vibe-coded projects later typically find inconsistent structure, minimal comments, ad hoc logic, and a complete absence of proper documentation. This technical debt becomes a burden that organizations must eventually address, often at significant cost.​

This technical debt becomes a burden that organizations must eventually address, often at significant cost.

Context Awareness Limitation

One of the most fundamental limitations of vibe coding as a complete solution stems from AI’s inability to truly understand context. While large language models can generate syntactically correct code, they lack deep understanding of business context, domain-specific requirements, and the broader architectural landscape within which their code must function. This contextual blindness manifests in multiple ways. AI coding assistants cannot grasp the “big picture” of complex projects. They operate on pattern recognition rather than genuine comprehension of the problem space, treating each prompt in relative isolation. When tasks require integrating with existing systems, understanding organizational workflows, or aligning with long-term strategic goals, AI tools consistently fall short because they lack access to the tacit knowledge and institutional understanding that guides human decision-making.​ The context window limitations of large language models create additional problems. As conversations become longer and more context-heavy, models begin to “forget” earlier information, leading to degraded performance and hallucinations. Forty-five percent of developers report that debugging AI-generated code takes more time than initially expected. Research shows that even advanced models like GPT-4o see accuracy drop from 99.3% at baseline to just 69.7% in longer contexts.​ For enterprise applications, this context limitation proves particularly problematic. AI cannot understand how its generated code interacts with broader system architecture, what security controls exist in the deployment environment, or how runtime configurations might expose vulnerabilities in production.

The resulting “comprehension gap” between what gets deployed and what teams actually understand increases the likelihood that serious issues will go unnoticed.​

Governance

Effective governance requires multiple elements that vibe coding alone cannot provide

The governance challenges surrounding citizen development become exponentially more difficult when vibe coding enters the equation. Research reveals that 73% of organizations using low-code platforms have not yet defined governance rules. When AI-generated code proliferates without oversight, the risks of shadow IT, security blind spots, and compliance violations multiply dramatically.​ Without robust governance frameworks, organizations face a cascade of problems. Citizen developers may create applications in isolation, leading to data silos that hinder cross-departmental collaboration. When different teams build separate applications without aligning data models or integration strategies, the result is duplicated efforts, inconsistent data, and operational inefficiencies. Applications may fail to integrate with existing enterprise systems, reducing their strategic value and creating friction rather than enabling efficiency. The lack of traceability in vibe coding creates particular challenges for regulated industries. Without structured processes to track who wrote what code, when, and why, organizations struggle to meet audit requirements and demonstrate compliance. Security vulnerabilities introduced by rapid, intuition-driven development can increase the attack surface in production environments. Developers may bypass formal approval processes, creating u-nmonitored services or integrations that put organizational data at risk.​ Effective governance requires multiple elements that vibe coding alone cannot provide. Organizations need clear roles and responsibilities defining who oversees development, ensures compliance, and manages application lifecycles. Governance policies must cover security, data protection, access controls, regulatory compliance, and application lifecycle management from development through retirement. Regular monitoring and reporting are essential to track platform activity, identify security incidents, and demonstrate compliance. Training and support programs must ensure users understand governance policies, procedures, and best practices.​

The Role of Professional Developers

The complexity of these challenges reveals why professional developers remain essential even as citizen development expands. The notion that vibe coding can eliminate the need for technical expertise fundamentally misunderstands the multifaceted nature of enterprise software development. Professional developers provide the architectural vision, security expertise, integration capabilities, and governance oversight that citizen developers typically lack. The business technologist role represents an important bridge in this ecosystem. These professionals, who possess both business acumen and technical expertise, translate business requirements into technical solutions, guide enterprise system selection and implementation, and ensure technology initiatives remain aligned with business goals. Their 35% reduction in requirement changes and 24% lower implementation costs compared to traditional approaches demonstrates the value of combining domain knowledge with technical understanding

The Low-Code Platform Advantage

Low-code platforms provide governance, security, and structure that pure vibe coding cannot match. These platforms offer enterprise-grade capabilities specifically designed to balance rapid development with organizational control. Understanding the distinctions between vibe coding and low-code approaches reveals why enterprises need both rather than relying solely on AI generation. Low-code platforms provide visual development tools that allow users to build applications with minimal hand-coding while maintaining guardrails that vibe coding lacks. They include role-based access control defining who can build, review, and deploy applications. Environment separation keeps development, testing, and production workloads appropriately isolated. Built-in monitoring and audit trails provide visibility into who created what, when, and how. Data loss prevention policies prevent sensitive information from flowing to unapproved connectors or destinations.​ The scalability and integration capabilities of low-code platforms address another critical gap in pure vibe coding approaches. Enterprise low-code tools support high availability, handle performance under load, and scale gracefully as usage grows. They provide reusable components, version control, and multiple development environments that help teams manage and grow their applications effectively. Built-in connectors and support for custom API integrations make it easier to synchronize new applications with legacy systems, CRMs, ERPs, and external databases.​

Built-in connectors and support for custom API integrations make it easier to synchronize new applications with legacy systems, CRMs, ERPs, and external databases.​

Security features embedded in low-code platforms include encryption, access controls, and compliance certifications that vibe coding alone cannot provide. These platforms undergo rigorous security reviews and maintain compliance with regulations like GDPR and HIPAA. This built-in security posture reduces the burden on citizen developers while providing IT teams confidence that applications meet organizational standards.​

The Hybrid Path Forward

The future of citizen development lies not in choosing between vibe coding and structured platforms but in thoughtfully combining them. Leading organizations are discovering that vibe coding and low-code platforms serve complementary purposes when integrated strategically. Vibe coding excels at creative exploration, rapid prototyping, and generating initial functionality. Low-code platforms provide the structure, governance, and production-readiness that enterprises require.​ This hybrid approach allows organizations to leverage the strengths of each method. Teams can use vibe coding for idea generation and prototyping unique features, then integrate those concepts into low-code workflows for broader implementation. Vibe coding speeds up creation while low-code platforms sustain and scale the solutions. The result is faster innovation without sacrificing the control and quality that production systems demand. Implementing this hybrid model requires clear frameworks and processes. Organizations should establish sandbox environments where vibe coding can occur safely, separate from production systems. Code generated through vibe coding should undergo security reviews, testing, and refinement before integration into enterprise platforms. Professional developers and business technologists should guide the transition from prototype to production, ensuring that innovative ideas become robust, maintainable solutions.​ The governance framework for hybrid development must balance empowerment with control. Centers of excellence can provide standards, review applications, and mentor new builders while allowing experimentation within appropriate boundaries. Clear policies should define when vibe coding is appropriate for exploration versus when structured low-code development becomes necessary. Automated testing, security scanning, and code review processes should apply regardless of how code originates, ensuring consistent quality standards.​

The Path to Responsible Innovation

Moving forward, organizations must embrace a more nuanced approach to citizen development that recognizes both the potential and limitations of AI-powered code generation. Vibe coding represents a valuable tool in the developer toolkit, but it cannot carry the full weight of enterprise application development. The path to responsible innovation requires integrating vibe coding within governance frameworks that ensure quality, security, and alignment with organizational goals. This integration begins with establishing clear policies defining when and how vibe coding is appropriate. Organizations should create designated environments where AI-assisted development can occur with appropriate oversight. Security scanning, code review, and testing processes should apply to all code regardless of origin, ensuring consistent standards. Professional developers should guide citizen developers in understanding when prototypes need hardening before production deployment and which use cases suit rapid AI generation versus structured development.​

Moving forward, organizations must embrace a more nuanced approach to citizen development

Training programs must equip citizen developers with the knowledge to recognize security vulnerabilities, understand basic architectural principles, and know when to seek professional guidance. Business technologists should serve as bridges between business needs and technical implementation, helping citizen developers frame problems effectively while ensuring solutions align with enterprise architecture. Regular governance reviews should retire unused or outdated applications and identify promising projects for further investment. The technology platforms organizations choose should reflect this balanced approach. Rather than pure vibe coding environments or traditional low-code platforms alone, enterprises need integrated solutions that combine AI assistance with governance controls. Platforms that embed security by design, provide automated testing and validation, support structured workflows, and enable collaboration between citizen and professional developers offer the best path forward.​

Conclusion

The emergence of vibe coding represents an important milestone in the democratization of software development, but it cannot and should not become the sole foundation for citizen development. The evidence across security, quality, governance, and sustainability reveals fundamental limitations that make vibe coding unsuitable as a standalone approach for enterprise application development. Organizations that treat vibe coding as a complete solution expose themselves to security vulnerabilities, accumulate technical debt, fail to meet compliance requirements, and ultimately undermine the very agility and innovation they seek to achieve. The future belongs not to vibe coding or traditional development alone but to thoughtfully designed hybrid approaches that leverage AI-powered code generation within governance frameworks that ensure quality, security, and strategic alignment. Low-code platforms provide essential structure, professional developers supply critical oversight and expertise, business technologists bridge business and technical domains, and citizen developers bring domain knowledge and innovation closer to business problems. This ecosystem of complementary capabilities, when properly orchestrated, delivers the speed of vibe coding with the sustainability and governance that enterprises require. As organizations navigate the rapidly evolving landscape of AI-assisted development, the imperative is clear: embrace innovation while maintaining control, empower citizen developers while providing guardrails, and recognize that the most powerful solutions emerge not from technology alone but from the thoughtful combination of human expertise and AI capabilities. The organizations that thrive will be those that resist the temptation to view vibe coding as a silver bullet and instead build comprehensive approaches that balance agility with accountability, innovation with security, and democratization with governance. Only through this balanced approach can citizen development realize its full potential while avoiding the pitfalls that unchecked vibe coding inevitably creates.

References: