Ask HN: Are you hesitant to install vibe-coded apps?

No. I simply don't (apart from company mandated ones like Claude Code), or do it in isolated VMs.

At this point, I always ask my AI tool of choice to audit the Github before installing an open-source tool, so I'm not that concerned about security.

I'm mostly hesitant to install vibe-coded apps because they sadly tend to be shiny but quickly-abandoned slop, with tons of bugs or performance issues.

Speaking from the builder side: In my case no. To prevent this sort of problem I would like to learn relate knowledge then ask agent to audit one by one. User side: write a skill then ask Agent to audit it rather than just ask agent with one sentence

Depends on the type of app, complexity, and product space. If it’s something I know well and it’s simple — why not vibe code my own?

How do you know if it's vibe coded or not? 60% of any app is third party dependencies that some random guy across the globe maintains, and the developer never even checked how the code is written.

Also, why vibe coded apps are prone to have viruses, and non vibe coded apps are virus free and have perfect security?

If it's open source, you can check the code, vibe coded or not (I doubt the majority does).

If it's a commercial app, the developer(s) probably care more about making money than writing the "perfectly secure" app, vibe coded or not.

depends on the source, but if it is open source and someone I trust I suppose the same amount of suspiciousness asa non vibe coded app?

I'm hesitant to, but more because it seems that many vibe coded apps* that I've come across have a week's worth of commits and no activity for the past 2-3 weeks. I have trouble imagining somebody who one-shotted an app is going to support that app for any reasonable lifespan. And, to your point, not only am I concerned about longevity of the app, but security and data harvesting concerns are also there.

*"vibe coded apps" in this context are ones whose description is full of emojis, the repo is in somebody's recently created personal GitHub account, and where there are likely already other apps addressing the same or similar use cases.

I would ask why they chose for it to need to be installed, rather than just delivering some web application

I'm hesitant to even use Linux due to vibe coding bleeding into the kernel.

I avoid them. Some look cool, and might even be useful… but is there something lurking in the code the developer doesn’t even know about? Will it get support? Was there any thought or care when it comes to security? How long before the developer moves on to their next vibe coded project… an hour?

The only pure vibe coded apps on my computer (that I’m aware of), are ones I made myself.

Lindy's law applies here: https://en.wikipedia.org/wiki/Lindy_effect

I'm not going to install vibecoded Photoshop when gimp exists.

It is not vibe-coded or not, but who vibe-coded it, and what do others say about, like the stars on github.

If it feels vibe coded, chances are that they haven't run it through sufficient QA or a mindful design approach yet.

Or they simply haven't developed the taste to understand why it feels off, and likely aren't domain experts either.

No. I see the risk of a vibe coder getting prompt-injected to be negligible compared to a programmer being malicious themselves, and I've been running closed source executables for decades.

In general, I find that new vibe coded (or at least AI-assisted) user-facing software tends to be good, actually. LLMs don't have a 9 to 5 job, and don't get burnt out or tired. Vibe coded software tends to have attention to detail that I don't see in human-written open source software because a human wouldn't bother.

I'm enjoying democratization of software. Maybe in a few years we will have a vibe-coded open source Windows replacement.

Generally, yes. Not because I'm afraid of supply chain attacks or other funny business (though they're still concerning), but because:

- I like my software to contain as few bugs as possible

- I like my software to be maintained (90+% of these vibe coded projects are abandoned almost immediately, "just fork it bro" is not an answer)

- I like my software to do a few things well

- I like my software to use as little system resources as necessary to do its job

Pre-AI software was already bad enough, but if I see something that looks vibe coded, I have found I can reliably assume it meets none of my criteria.

I agree with many others in the thread. It’s pretty much impossible to not install apps that have “vibe coded” aspects to them now, if not completely vibe coded. We see this with Amazon/AWS boasting that a large percent of their code is now AI generated.

I think with that in mind, scanning tools like Trivy become more useful.

I am building a tool (https://github.com/trypando/pando) to help people deploy vibe coded apps at companies more safely and easily, and share them securely.

This has been really well received, and I think it’s because YES there are risks with AI generated apps, but the risks don’t currently outweigh the productivity gains.