Vibe coding for beginners: build your first app safely
You can describe an app in plain English and have an AI tool write it. That part is real. What tutorials skip is everything around it: where your work is saved, what happens to the password you pasted into the chat, and how you'd know if the app is quietly wrong. This guide walks through a first project with those habits built in from the start.
Not affiliated with or endorsed by any of the tools or companies mentioned. Tools change quickly, so check their own docs.
What "vibe coding" means
The term comes from Andrej Karpathy, who posted on X on February 2, 2025: "There's a new kind of coding I call 'vibe coding', where you fully give in to the vibes, embrace exponentials, and forget that the code even exists." In the same post he described accepting every change without reading the diffs, and said it was "not too bad for throwaway weekend projects".
That last part matters. In its original sense, vibe coding meant not reading the code, and he pitched it for throwaway projects. Today people use the term more loosely, for any app built mostly by prompting an AI. Either way, a first app is a good time for it, as long as you add a few safety nets. That's what the rest of this guide is about.
Pick a tool
There are two broad kinds of tool for this:
- App builders run in the browser. You describe the app, they build and host it, and you never install anything. This is the quickest way to see something working.
- AI code editors run on your computer and edit real files in a folder you own. There's more setup, but you can see, save and move every file.
Either kind works for the project below. If you pick an app builder, check whether you can export or download the code, and where it's stored.
A safe first project: a habit tracker
Build something that's useful to you and can't hurt anyone if it breaks. A habit tracker fits: a page where you tick off today, and it shows your streak.
What makes it safe:
- No accounts and no passwords. It saves to your own browser with
localStorage, so there's no server and no database. - No payments and no other people's data. Leave both for a later project, once you can read what the AI wrote.
- No API keys, so there's nothing secret to leak.
Start with a prompt like this:
Build a single-page habit tracker in plain HTML, CSS and JavaScript (no framework).
- One habit for now. A button marks today as done.
- Show the current streak: days in a row, ending today.
- Save to localStorage. No server, no login, no external services.
- Put the streak logic in its own function in streak.js so I can test it.
- Explain each file in two sentences.
Then work in small steps: one change per prompt, and check it works in the browser before asking for the next. "Add a second habit" is a good prompt. "Make it better" isn't, because you won't know what changed.
Review what the AI wrote
You don't need to understand every line. You do need to look. On each change, ask yourself:
- Did it change only what I asked? If you asked for a button color and three files changed, ask why.
- Did it add anything new? New packages, new websites the app talks to, or a login you didn't ask for all deserve a question.
- Can it explain it? Ask "explain this change like I'm new to coding". If the explanation doesn't match the code, that's a warning sign.
AI tools can be confidently wrong, and a common beginner trap is accepting fixes until the error goes away without knowing why it went away.
Save your work with git
Git keeps a history of your project. The Git book describes each commit as a snapshot of all your files at that moment. So when an AI change breaks everything, you can go back.
The habit is simple: commit every time something works.
git init
git add .
git commit -m "Streak shows on the page"
Most AI editors can run these for you, and many app builders have a version history or export option. Then keep a second copy somewhere other than your computer, such as a private repository or another drive.
Keep secrets out
Sooner or later, a project needs an API key. Before that happens:
- Never paste keys into a chat, and never put them in your code. Put them in a
.envfile and list that file in.gitignore. A.gitignoretells git which files to leave out, but it doesn't affect files git is already tracking, so set it up before your first commit. - Keep push protection on if you use GitHub. GitHub says push protection "blocks pushes that contain secrets before they reach your repository". It's on by default when you push to public repositories, so don't switch it off.
- If a key leaks, replace it. GitHub's guide to removing sensitive data says the first step is to "revoke and/or rotate that secret". Deleting the file isn't enough, because it's still in the history.
- Keys in front-end code are public. Anything that runs in the visitor's browser can be read by the visitor. OpenAI's API key safety guide says: "Never deploy your key in client-side environments like browsers or mobile apps." Keys belong on a server.
Test it
Clicking around isn't enough, because you'll only test what you expect. Ask the AI for small tests of the logic. Here's the streak function from our version of this project, and the tests for it:
// streak.js: counts how many days in a row ending today are marked done.
// days is a list of dates as 'YYYY-MM-DD' strings, in any order.
export function streak(days, today) {
const done = new Set(days);
let count = 0;
const d = new Date(today + 'T00:00:00Z');
while (done.has(d.toISOString().slice(0, 10))) {
count += 1;
d.setUTCDate(d.getUTCDate() - 1);
}
return count;
}
import { test } from 'node:test';
import assert from 'node:assert/strict';
import { streak } from './streak.js';
test('no days means no streak', () => {
assert.equal(streak([], '2026-10-15'), 0);
});
test('three days in a row ending today', () => {
assert.equal(streak(['2026-10-13', '2026-10-14', '2026-10-15'], '2026-10-15'), 3);
});
test('a gap breaks the streak', () => {
assert.equal(streak(['2026-10-12', '2026-10-14', '2026-10-15'], '2026-10-15'), 2);
});
test('today not done means 0, even if yesterday was', () => {
assert.equal(streak(['2026-10-14'], '2026-10-15'), 0);
});
test('works across a month boundary', () => {
assert.equal(streak(['2026-09-30', '2026-10-01'], '2026-10-01'), 2);
});
test('order and duplicates do not matter', () => {
assert.equal(streak(['2026-10-15', '2026-10-14', '2026-10-15'], '2026-10-15'), 2);
});
They use Node's built-in test runner. With Node.js installed, run node --test in the folder. Ours printed pass 6, fail 0 on Node 22. The tests cover the cases people forget: a gap, today not done yet, the end of a month, and the same day saved twice.
When a test fails, paste the output to the AI and ask it to fix the code, not the test. Read the change to make sure it didn't just delete the test.
When to stop and learn
Vibe coding can get a small project working, but it has limits. It's time to slow down and learn the basics of what you're building when:
- You're going in circles. The AI keeps "fixing" the same bug and it keeps coming back.
- You're about to handle other people's data: logins, emails, payments or anything private. Mistakes here hurt someone else, so learn how sign-in, storage and access rules work first, or bring in someone who knows.
- You can't explain what a file does, and it's a file that matters.
- You're about to spend money, such as hosting, paid APIs or a domain. Set spending limits first.
Learning doesn't mean stopping. Ask the AI to teach you instead of doing it for you: "walk me through how this streak function works, line by line".
Next step
- Compare browser-based tools on our vibe coding app builders page, or editors on our AI code editors page.
- When your app has a working first version, put it online with a host's free tier, and check what the free tier allows before you rely on it.
Not affiliated with or endorsed by any of the tools or companies mentioned. Tools change quickly, so check their own docs.