# How to vibe code safely: a practical workflow

URL: https://agentvera.dev/en/blog/how-to-vibe-code/ · Published: 2026-10-22

How to vibe code without losing control: idea, spec, small steps, tests, git commits, review and deploy, plus tool choice, prompts that work and when to stop.

**In short:**

- Safe vibe coding wraps the prompt loop in structure: a one-paragraph idea with a “not in v1” list, a short SPEC.md of numbered tasks, and one task per prompt.
- Commit after every working step and ask the agent to run tests and show the output; rolling back beats asking it to fix its own fix again.
- Logins, payments, personal data, database migrations and anything public need a human read of the code before real users touch them.

To vibe code, you describe what you want to a coding agent in plain language, let it write and run the code, check the result yourself, and keep steering with short follow-up messages. Doing it *safely* means adding a little structure around that loop: a short spec, small steps, tests, a git commit after each step that works, a review before anything goes live.

The term comes from Andrej Karpathy’s February 2025 post about letting the AI write code while you “forget that the code even exists”; Collins Dictionary later picked it as its Word of the Year for 2025. For the definition, history and risks, see [what is vibe coding](/en/glossary/vibe-coding/ "What is vibe coding?"). This post is about the how.

## The workflow at a glance

| Step | What you do | What you get |
| --- | --- | --- |
| 1. Idea | Write one paragraph: who it’s for, what it does | A scope you can say no to |
| 2. Spec | Ask the agent to turn it into a short plan | A list of small, ordered tasks |
| 3. Small steps | One task per prompt | Changes small enough to check |
| 4. Tests | Ask for tests on anything that matters | A way to know it still works |
| 5. Commit | `git commit` after each working step | A safe point to go back to |
| 6. Review | Read the diff, or have another model read it | Fewer surprises later |
| 7. Deploy | Ship to a host with preview builds | A live link you can share |

The steps look obvious written down. Skipping them is what turns a fun afternoon into a weekend of “it worked an hour ago”.

## Step 1: Start with a small idea

Write the idea in a few sentences before opening any tool. Name the user, the one thing the app must do, and what is out of scope for the first version.

> A page where my running club logs weekly distances. Members sign in with a magic link, add a run, and see a leaderboard for the month. No payments, no mobile app, no admin panel in v1.

That last sentence matters most. Agents are happy to build features you didn’t ask for; a clear “not in v1” list keeps the project small enough to finish.

## Step 2: Turn it into a short spec

Don’t ask for the app yet. Ask for a plan:

> Read this idea. Propose a stack, a folder structure and a numbered list of 6–10 small tasks to build v1. Each task should be doable in one session and testable on its own. Don’t write code yet.

Read the plan and push back. Is the stack something you can host for free? Is any task really three tasks? Save the final version as `SPEC.md` (or `PLAN.md`) in the repo so every later session can read it. If you use more than one agent, a short CLAUDE.md or AGENTS.md with the commands and rules helps too; [agentic coding](/en/glossary/agentic-coding/ "Agentic coding") works best when the agent has the same context every time.

## Step 3: Build in small steps

Now take task 1 and only task 1:

> Do task 1 from SPEC.md: set up the project and a home page that says “Hello”. Run it and tell me the URL.

Then open it, check it, and move to task 2. A good rhythm is one task, one check, one commit. If a step produces more than a few hundred lines of changes, it was probably too big; ask the agent to split it next time.

When something breaks, paste the exact error, not a description of it. “It doesn’t work” makes the agent guess; the full stack trace usually doesn’t.

## Step 4: Ask for tests on what matters

You don’t need 100% coverage on a side project. You do need tests on the parts that would hurt if they broke silently: the leaderboard maths, the sign-in flow, anything that touches money or data.

> Add tests for the monthly leaderboard: ties, a member with no runs, runs on the last day of the month. Run them and show me the output.

Ask the agent to *run* the tests and show the output, not just write them. Then, when you change something later, “run the tests” becomes your one-line safety check.

## Step 5: Commit after every working step

Git is the undo button of vibe coding. After each step that works:

```bash
git add -A
git commit -m "Add monthly leaderboard with tests"
```

Or just tell the agent: “Commit this with a short message.” When a later change goes sideways, `git diff` shows what changed and `git restore .` (or a reset to the last commit) puts you back. This beats asking the agent to fix its own fix for the fourth time, which tends to pile one patch on another.

## Step 6: Review before it goes live

Vibe coding works because you don’t read every line while building. Before deploying, someone has to. At minimum:

- Skim the diff of everything since the last deploy.
- Ask a second agent or model to review it for bugs and security problems, without the first agent’s chat history. A fresh reader catches what the author doesn’t.
- Click through the app yourself on a phone and a laptop.

The [AI code review guide](/en/blog/ai-code-review/ "AI code review") goes deeper into what to look for and how to set it up.

## Step 7: Deploy

For most vibe-coded web projects, a host that builds from a GitHub repo is the easy path: Vercel, Netlify or Cloudflare Pages for static sites and frameworks like Next.js or Astro. Push to a branch, get a preview link, check it, then merge to deploy. Keep secrets in the host’s environment settings, never in the repo.

## Choosing a tool

| Type | Examples | Good for |
| --- | --- | --- |
| Terminal agents | Claude Code, Codex, Gemini CLI | Full projects on your machine, running commands, real repos |
| Editor agents | Cursor | Staying close to the code while the AI edits |
| Browser app builders | Various hosted builders | A quick demo with hosting included |

Terminal and editor agents leave you with a normal code repo you own; hosted builders are faster to start but keep the code on their platform. If you are unsure, start with one terminal agent, such as [Claude Code](/en/agents/claude-code/ "Claude Code"), and use it for a whole small project before trying others.

## Prompts that work

Good vibe coding prompts share a shape: one goal, the constraints, and how to check it.

| Instead of | Try |
| --- | --- |
| “Build me a habit tracker” | “Do task 3 from SPEC.md: the add-habit form. Validate that the name isn’t empty. Run the tests when done.” |
| “It’s broken, fix it” | “Clicking Save shows this error: (paste). Find the cause before changing code, then explain the fix in two sentences.” |
| “Make it look better” | “Match this screenshot’s spacing and font sizes. Don’t change the layout on mobile.” |
| “Add login” | “Add magic-link login with the auth library from SPEC.md. Don’t store passwords. List every file you changed.” |

Three phrases are worth reusing:

- **“Don’t write code yet.”** For plans and investigations.
- **“Run it and show me the output.”** So you see evidence, not claims.
- **“List the files you changed.”** So the diff has no surprises.

## When to stop vibing

Vibe coding is great for prototypes, internal tools and personal projects. Slow down and read the code yourself, or get someone who can, when the work touches:

- **Logins and permissions.** One missed check exposes everyone’s data.
- **Payments.** Webhooks, refunds and edge cases need real tests.
- **Personal data.** Privacy law doesn’t care who wrote the code.
- **Database migrations.** A `DROP` or an `UPDATE` without `WHERE` is hard to undo in production.
- **Anything public with real users.** Rate limits, input validation, secrets handling.

Another signal: if you have asked the agent to fix the same bug three times and it keeps coming back, stop. Roll back to the last good commit, describe the problem from scratch, or read that part of the code yourself.

## Build something

Each of these guides follows the same workflow on a concrete project:

- [Build a website with AI](/en/blog/build-website-with-ai/ "Build a website with AI")
- [Build a SaaS MVP with AI](/en/blog/build-saas-mvp-with-ai/ "Build a SaaS MVP with AI")
- [Build a mobile app with AI](/en/blog/build-mobile-app-with-ai/ "Build a mobile app with AI")
- [Build a Chrome extension with AI](/en/blog/build-chrome-extension-with-ai/ "Build a Chrome extension with AI")
- [Build a Telegram bot with AI](/en/blog/build-telegram-bot-with-ai/ "Build a Telegram bot with AI")
- [Build an automation or scraper with AI](/en/blog/build-automation-scraper-with-ai/ "Build an automation or scraper with AI")
- [Build a data dashboard with AI](/en/blog/build-data-dashboard-with-ai/ "Build a data dashboard with AI")
- [Build an e-commerce store with AI](/en/blog/build-ecommerce-store-with-ai/ "Build an e-commerce store with AI")
- [Make a game with AI](/en/blog/make-a-game-with-ai/ "Make a game with AI")

## Doing it with AgentVera

Everything above works with one terminal and git. [AgentVera](/en/download/ "Download AgentVera") runs your coding agents (Claude Code, Codex, Gemini CLI and others, with your own logins) side by side in real terminals, and adds a few safety nets around the same loop:

- **Undo per turn.** [Checkpoints](/en/features/checkpoints-and-replay/ "Checkpoints and replay") snapshot the working folder at the start of every turn, so you can undo one turn from the pane’s menu, and undo the undo. It is a quicker step back than a git reset, not a replacement for commits.
- **Automatic review.** With [code review](/en/features/code-review/ "Code review") turned on in project settings, a Claude model you pick reads the changes when a turn ends and reports findings with severity and file:line links; you can send them back to the agent.
- **Checking against what you asked.** [AgentVera Verify](/en/features/verify/ "AgentVera Verify") (Pro and Team) pulls the acceptance criteria out of your message and, when the turn ends, a separate verifier runs tests and marks each criterion pass or fail with evidence.
- **Migration checks.** [DB Guard](/en/features/db-guard/ "DB Guard") scans new migrations at the end of a turn for risky statements like `DROP` or `UPDATE` without `WHERE`.
- **Previews.** [Preview environments](/en/features/preview-environments/ "Preview environments") give each branch its own local address and can capture mobile, tablet and desktop screenshots.
- **One place to approve.** The review inbox collects every agent’s finished work so you can approve it or send it back with a note.

## Checklist

- [ ] The idea fits in a paragraph, with a “not in v1” list.
- [ ] A short SPEC.md with numbered tasks lives in the repo.
- [ ] One task per prompt; each one checked before the next.
- [ ] Tests exist for the parts that would hurt if they broke.
- [ ] A commit after every working step.
- [ ] The diff was reviewed before deploy, ideally by a fresh model and a human.
- [ ] Secrets are in environment variables, not the repo.
- [ ] Logins, payments, personal data and migrations got a careful human read.

## Wrapping up

Vibe coding is a real way to build software now, not just a joke about it. The difference between a prototype you can keep and one you throw away is rarely the model; it is whether you worked in small steps, committed often, tested what mattered and reviewed before shipping. Keep the vibes for the building and the discipline for the edges.

## Frequently asked questions

**Do I need to know how to code to vibe code?** Not for a small personal project. You do need to be able to run a few commands, read an error message out loud to the agent, and test the result yourself. The more the project matters, the more you need someone who can read the code.

**What is the best tool for vibe coding?** There is no single best one. Terminal agents like Claude Code, Codex or Gemini CLI give you a real project on your machine; editor agents like Cursor keep you closer to the code. Pick one, learn its habits, and add a second only when you need a second opinion.

**How do I stop the AI from breaking working code?** Work in small steps, commit after every step that works, and ask for tests on anything important. If a change goes wrong, roll back to the last commit instead of asking the agent to fix its fix three times in a row.

**Is vibe-coded software safe to put in production?** Only after someone has reviewed it. Logins, payments, personal data, database migrations and anything exposed to the internet need a human read of the code, real tests and a basic security check before real users touch them.

**How long should a vibe coding prompt be?** Long enough to state one goal, the constraints and how you will check it, usually three to eight lines. A single huge prompt for the whole app tends to produce a lot of code that is hard to review.

---

**About AgentVera.** AgentVera is a desktop app for macOS, Windows and Linux, built by Solviera Teknoloji. It runs 18 AI coding agents (Claude Code, Codex, Gemini CLI, Copilot, Cursor, Antigravity, opencode, Hermes, Qwen Code, Kimi Code, Kiro, Amp, Droid, Goose, Vibe, Crush, Aider, Cline) side by side, per project, in real terminals with the user's own CLI installs and logins. The free plan has unlimited agents. Download: https://agentvera.dev/en/download/ · Pricing: https://agentvera.dev/en/pricing/