The relevance on software engineering in WebApps and the danger of vibe coding

Introduction

Artificial Intelligence (AI) has fundamentally transformed the way software is developed. Today, developers can use AI-powered tools to generate website interfaces, write backend logic, establish database connections, and even deploy functional applications using simple natural-language instructions.

What previously required hours or days of programming can now be accomplished in a fraction of the time.

However, there is an important distinction that developers must understand: building an application that works is not the same as engineering an application that is reliable, secure, scalable, and maintainable.

As AI-assisted development becomes increasingly popular, a practice commonly known as vibe coding is attracting attention. Although this approach makes software development more accessible, excessive reliance on AI-generated code without proper technical understanding, testing, and evaluation introduces significant risks.

This raises an important question: In an era where AI can generate applications within minutes, why does Software Engineering remain essential?

The answer lies in the difference between producing software and engineering dependable software systems.

1. Understanding Vibe Coding

The term vibe coding was introduced by computer scientist Andrej Karpathy in February 2025. It describes an approach to software development in which developers use natural-language prompts to instruct AI systems to generate code, often accepting and running the generated output without carefully examining the underlying implementation.

Rather than manually writing and understanding every part of an application, developers concentrate on describing what they want and evaluating whether the resulting application appears to work.

For example, a developer might instruct an AI tool:

“Create a service marketplace where users can register, search for service providers, and contact them directly.”

Within minutes, an AI tool might generate the interface, database structure, authentication functionality, and backend operations.

Although impressive, the resulting application may contain implementation problems that are not immediately visible.

Vibe coding is not inherently harmful. It can be extremely useful for prototyping, experimentation, learning, and developing small personal projects. The problem arises when developers treat AI-generated output as production-ready software without applying appropriate engineering practices.

Research by Chou et al. (2026), titled Building Software by Rolling the Dice: A Qualitative Study of Vibe Coding, examines how people engage in vibe coding. The findings highlight the uncertainty developers may experience when repeatedly relying on generated suggestions without fully understanding the resulting code.

This demonstrates that generating software quickly does not automatically guarantee that the software is correctly engineered.

1. The Hidden Risks of Building Applications Without Software Engineering

A web application may look professional, respond to user interactions, and perform basic operations successfully. However, these visible characteristics do not necessarily indicate that its internal architecture is reliable.

Without proper Software Engineering principles, several problems can emerge.

2.1 Security Vulnerabilities

Security is one of the most important considerations in modern web application development.

AI-generated code may contain insecure implementation patterns, particularly when developers fail to review authentication, authorization, database queries, input validation, and data protection mechanisms.

Common security risks include:

• SQL injection resulting from improperly constructed database queries.
• Cross-Site Scripting (XSS) caused by unsafe handling of user-generated content.
• Exposed API keys, database credentials, and other sensitive information.
• Weak authentication and authorization mechanisms.
• Insecure file uploads and inadequate access controls.

Research by Fu et al. (2025) examined security weaknesses in AI-generated code and highlighted the importance of reviewing generated implementations before using them in real-world applications.

The OWASP Top 10 (2025) also identifies major web application security risks, including broken access control, security misconfiguration, injection, insecure design, and authentication failures.

Therefore, developers must treat security as an essential part of the development process rather than something to consider only after an application has been completed.

2.2 Poor Scalability and Performance

An application that performs well with a small number of users may struggle when the number of users increases.

Consider a service marketplace that initially supports five users. Its database queries may execute quickly, and its pages may load without noticeable delays.

However, when the application grows to thousands of users, poorly designed database queries, inefficient API operations, inadequate caching, and unsuitable server architecture may result in performance degradation.

Scalability requires developers to consider:

• Database normalization and indexing.
• Efficient API communication.
• Caching mechanisms.
• Load balancing where appropriate.
• Resource management.
• Appropriate system architecture.

Without these considerations, an application may experience slow response times, database bottlenecks, service interruptions, or unexpected infrastructure costs.

The important point is that scalability must be considered during system design, not simply after performance problems appear.

2.3 Technical Debt and Maintainability Problems

Technical debt refers to the additional work and future costs created when developers choose quick or convenient implementation approaches instead of more sustainable solutions.

In AI-assisted development, technical debt can accumulate when developers repeatedly request new features without understanding how those features interact with existing code.

For instance, an AI tool might generate three different functions that perform similar operations in separate parts of an application. Although the application may work initially, updating the functionality later could require modifying multiple sections.

This creates problems such as:

• Duplicated code.
• Unnecessary dependencies.
• Poor separation of responsibilities.
• Inconsistent programming patterns.
• Inadequate documentation.
• Difficult debugging and maintenance.

Developers who cannot explain their own application’s architecture may struggle when unexpected errors occur or when new requirements are introduced.

2.4 Unreliable Debugging

Debugging is an essential part of software development.

In conventional development, programmers investigate errors by examining program execution, identifying the source of the problem, and applying corrections based on their understanding of the system.

However, when developers depend entirely on AI-generated solutions, debugging can become a repetitive cycle of submitting error messages and accepting suggested corrections without understanding their consequences.

A correction that resolves one problem may introduce another.

For example, modifying an authentication function might unintentionally affect user registration, session management, or access to protected pages.

This is particularly dangerous in applications where different components depend on one another.

The solution is not to stop using AI but to combine AI assistance with systematic debugging, code inspection, and testing.

1. Why Software Engineering Remains Essential

Software Engineering provides the principles, methodologies, and technical practices required to develop dependable software systems.

According to Sommerville (2015), professional software development involves more than programming. It includes requirements engineering, system design, implementation, validation, and software evolution.

These activities remain relevant regardless of whether code is written manually or generated using AI.

The following principles demonstrate why Software Engineering remains indispensable.

3.1 Requirements Engineering and System Analysis

Before developing an application, engineers must understand the problem the software is intended to solve.

Requirements Engineering helps identify user needs, system expectations, functional requirements, and non-functional requirements.

For example, when developing a service marketplace, functional requirements may include:

• Users must be able to register and log in.
• Service providers must be able to submit their service information.
• Administrators must be able to approve or reject submitted listings.
• Customers must be able to search for available services.

Non-functional requirements may include:

• The application must protect user information.
• Pages must load within acceptable response times.
• The system must support increasing numbers of users.
• The application must remain maintainable and reliable.

Without proper requirements analysis, developers may build applications that look impressive but fail to address the actual needs of their intended users.

AI can help interpret and organize requirements, but developers must verify that the resulting system satisfies them.

3.2 System Architecture and Modularity

Software architecture defines the overall structure of an application and how its components communicate.

A properly engineered web application commonly separates its major responsibilities into:

• Frontend: Handles the user interface and interactions.
• Backend: Processes application logic and requests.
• Database: Stores and manages application information.
• APIs: Enable communication between different application components.
• Security layer: Protects resources, user accounts, and sensitive information.

This separation of responsibilities makes applications easier to understand, test, modify, and maintain.

For example, a developer should be able to improve the search functionality of a marketplace without unnecessarily rewriting its authentication system.

Modular architecture also allows different components to evolve independently, reducing the likelihood that changes in one area will negatively affect the entire application.

3.3 Software Testing and Quality Assurance

Testing is one of the most important activities in Software Engineering.

An application should not be considered reliable simply because it runs successfully during development.

Developers must verify that individual components and the complete system behave as expected.

Important testing approaches include:

Unit Testing: Tests individual functions or components to ensure they work correctly.

Integration Testing: Examines whether different components communicate and operate correctly together.

System Testing: Evaluates the complete application against its specified requirements.

Acceptance Testing: Determines whether the application satisfies the expectations of its intended users.

Security Testing: Identifies vulnerabilities and weaknesses that could compromise the application.

Test-Driven Development (TDD) provides another disciplined approach in which developers write tests before implementing the corresponding functionality.

AI can assist in generating test cases, but developers must ensure that those tests are meaningful and cover important application scenarios.

Automated testing also helps prevent existing functionality from breaking when new features are introduced.

3.4 Version Control and Change Management

Modern software development requires effective management of changes.

Git and platforms such as GitHub allow developers to track modifications, collaborate with other programmers, maintain project history, and restore earlier versions when necessary.

Version control is particularly important in AI-assisted development because AI-generated changes can affect multiple files and introduce unexpected behaviour.

By using version control, developers can:

• Track changes to source code.
• Compare different versions of an application.
• Review AI-generated modifications.
• Create branches for new features.
• Restore previous working versions.
• Collaborate effectively with development teams.

Continuous Integration and Continuous Delivery (CI/CD) can further improve development by automating activities such as building, testing, and preparing applications for deployment.

These practices create a more controlled and predictable software development environment.

3.5 Documentation and Software Maintenance

Documentation explains how an application is structured, how its components operate, and how developers should maintain it.

Useful documentation may include system requirements, database structures, API descriptions, installation instructions, architectural diagrams, and explanations of important functions.

Without documentation, future developers may spend unnecessary time understanding existing implementations.

This becomes particularly problematic when an application is developed using AI and the original developer does not fully understand the generated code.

Proper documentation reduces dependency on individual developers and makes long-term maintenance more manageable.

1. Combining Artificial Intelligence with Software Engineering

The solution to the challenges of vibe coding is not to reject AI-powered development tools.

Instead, developers should adopt a more disciplined approach that combines AI’s speed with established Software Engineering principles.

AI can be used effectively for:

• Generating initial code structures.
• Creating user interface components.
• Explaining unfamiliar programming concepts.
• Suggesting database schemas.
• Identifying potential errors.
• Generating unit tests.
• Improving code readability.
• Producing technical documentation.

However, developers must remain responsible for reviewing, testing, securing, and maintaining the resulting software.

A practical AI-assisted development workflow should follow these stages:

1. Requirement Analysis: Identify the problem, target users, and system requirements.
2. System Design: Define the architecture, database structure, and relationships between components.
3. AI-Assisted Implementation: Use AI tools to generate or improve code.
4. Code Review: Examine generated code to understand its functionality and identify weaknesses.
5. Testing and Validation: Perform unit, integration, system, and security testing.
6. Deployment: Release the application through a controlled deployment process.
7. Monitoring and Maintenance: Monitor performance, fix defects, address vulnerabilities, and improve functionality.

This approach ensures that AI contributes to productivity without replacing the technical judgment required for dependable software development.

The National Institute of Standards and Technology (NIST), through its Secure Software Development Framework (SSDF), similarly emphasizes integrating security practices throughout the software development lifecycle.

The framework demonstrates that secure software development requires structured processes rather than relying solely on the tools used to produce code.

1. The Future of Software Development: Engineers and AI Working Together

The increasing adoption of AI does not make Software Engineering irrelevant. Instead, it changes the responsibilities and capabilities expected of modern software developers.

Developers are gradually moving beyond writing every line of code manually. They must increasingly understand how to communicate with AI systems, evaluate generated solutions, recognize architectural weaknesses, and ensure that applications satisfy technical and business requirements.

The most valuable developers will not necessarily be those who generate the largest amount of code in the shortest time.

They will be those who can transform ideas into dependable software systems by combining programming knowledge, engineering principles, critical thinking, and AI-assisted productivity.

AI can generate code, but it does not eliminate the need for accountability, verification, and sound engineering decisions.

Conclusion

Artificial Intelligence has introduced an exciting transformation in web application development. Through natural-language prompting and automated code generation, developers can build prototypes and explore software ideas faster than ever before.

Nevertheless, speed should never be confused with quality.

An application that works during a demonstration may still contain security vulnerabilities, architectural weaknesses, performance limitations, and maintenance challenges.

Vibe coding can be a useful starting point for experimentation and rapid prototyping, but it should not replace the discipline required to develop production-ready applications.

Software Engineering remains essential because it provides the foundation for understanding requirements, designing systems, implementing security, testing functionality, managing changes, and maintaining software throughout its lifecycle.

AI accelerates software development, but Software Engineering makes software dependable.

The future does not belong to developers who simply know how to prompt AI. It belongs to developers who understand how to use AI responsibly while applying the engineering principles necessary to build software that works not only today, but also tomorrow.

References

1. Karpathy, A. (2025). Vibe Coding.

2. Chou, Y. H., et al. (2026). Building Software by Rolling the Dice: A Qualitative Study of Vibe Coding.

3. Fu, Y., et al. (2025). Security Weaknesses of Copilot-Generated Code in GitHub Projects: An Empirical Study.

4. Sommerville, I. (2015). Software Engineering (10th ed.). Pearson.

5. NIST. (2022). Secure Software Development Framework (SSDF).

6. OWASP Foundation. (2025). OWASP Top 10: Web Application Security Risks.