QWE AI Academy The part most vibe coding tutorials skip
Andrej Karpathy coined vibe coding in a February 2, 2025 X post: fully give in to the vibes, forget the code exists, accept all diffs, paste raw errors back in. He also said the result can grow past normal comprehension. That warning – not the hype – is where a beginner guide should start.
Collins Dictionary made it Word of the Year for 2025. Tools multiplied. People ship small apps in an afternoon. Reality check: the same loop piles up credit burn, silent security holes, and architecture you cannot debug three months later. Those are the main plot, not a footnote.
Quick context: what you actually do
Plain English in. Files, stack choices, sometimes a backend out. You click around, complain in English, iterate. Syntax memorization is optional for v1.
As of late 2026 two families dominate. Prompt-to-full-app builders (Lovable, Base44, Bolt, Replit Agent) aim at non-coders and return hosted apps. AI IDEs and agents (Cursor, Claude Code, Windsurf) sit nearer classic coding once chat-only gets cramped. Start on a builder. Switch when the project forces you to.
Free tiers exist and run out fast. Lovable (official pricing): 5 daily build credits, roughly capped near 30/month on free. Cursor Hobby stays limited on Agent/Tab. Replit Starter and Base44 Free (25 message credits/month per their pricing pages) are fine for a first afternoon. Paid entry usually lands around $20-25/month when you need real iteration headroom – Lovable Pro from $25/mo (100 monthly credits), Cursor Pro $20/mo, Replit Core about $20/mo annual with effort-based Agent billing on heavier runs. Numbers move; check the live pages before you budget.
Hands-on vibe coding tutorial for beginners
Build a personal subscription spend tracker. Not a todo list. Goal: streaming/software/gym rows, monthly total, renewals inside 14 days lit up, data that survives refresh. Small enough for free credits. Useful enough you might keep it.
Pick and open the tool
Absolute beginner? Browser only – Lovable or Base44, free signup. Already live in an editor? Cursor Hobby and a blank project.
Write one master prompt, not five vague ones
Vague fails. Specific holds. Paste something like:
Build a clean single-page web app called SubTrack for one user.
- Add / edit / delete subscriptions: name, monthly cost (USD), billing day of month (1-31), category (streaming / software / fitness / other), optional notes.
- Show a table sorted by next renewal date.
- Big number at top: total monthly spend.
- Highlight any renewal in the next 14 days in amber.
- Persist everything in local storage so data survives refresh. No login needed yet.
- Mobile-friendly, minimal UI, dark mode toggle.
- After generating, explain the file structure in 3 bullet points.Local storage. One user. Exact fields. Without those fences the model happily invents multi-tenant SaaS you never asked for – and burns the credit pack doing it.
Generate, run, then iterate in tiny steps
Hit generate. Wait for preview. Click. Broken? Paste the exact error or the visual bug: “Total is yearly instead of monthly – fix only the sum logic.” One change. Broad “make it better” is how free daily credits vanish and yesterday’s feature re-breaks.
Pro tip: before you accept a fat diff, ask the model to explain its own code in plain English. That habit is the cheap counter to Karpathy’s “beyond comprehension” trap.
Next feature only when the last one works: “Export CSV.” Then “Bar chart of spend by category, lightweight library.” Stop when it does the job. Publish via the platform’s one-click path (Lovable subdomain, Replit, or export to Vercel).
What the first session should feel like
30-90 minutes on free credits if the master prompt is tight. A page you can bookmark. That’s the win. Stop there.
Weird part nobody puts in the marketing screenshots: after the second or third successful generate, you start trusting the green preview more than your own checklist. That feeling is useful fuel. It is also how hardcoded secrets and “temporary” auth stubs survive into a share link.
Common pitfalls to avoid
- Credit death spiral – Retries and “fix what you just broke” still spend credits. Free daily allotments disappear in one messy evening. On paid tiers (Lovable Pro from $25/mo, Replit Core ~$20 with effort-based Agent usage, Cursor Pro $20) a looping agent can chew past the included pool while the UI still looks busy. Watch the meter before you ask for a full rewrite.
- Silent security holes – Hardcoded secrets (yes, strings like
supersecretkeyshow up), missing rate limits, broken or absent row-level security, wide-open endpoints. Georgia Tech SSLab’s Vibe Security Radar had logged 74 AI-linked CVEs (14 critical) by early 2026, with a sharp spike (35 in March alone) and estimates of 5-10× more untraced issues; separate audits of vibe-coded repos often land near a 90% vulnerability hit rate. Prototype on fake data. No real keys. No real users until a human security pass. - Unintended side effects – “Add dark mode” sometimes rewrites auth or wipes local storage. Re-test the old path after every change.
One more observation from actual use: the model is rewarded for screens that look finished. It is not rewarded for leaving you a mental model you can still hold next quarter.
Performance and results you can expect
Speed is real for personal tools. Longevity is the tax.
| Stage | Typical time | What you get | Real constraint |
|---|---|---|---|
| First prototype | 20-60 min | Working UI + basic data | Free credit cap |
| Usable personal tool | 1-3 hours | Persistence + 2-3 features | Iteration quality |
| Shareable MVP | 1-2 days | Deployed + basic auth | Security review needed |
| Anything past ~3 months | Ongoing | Growing debt | Comprehension wall |
User-facing or long-lived? First version = sketch, not prod.
When NOT to use vibe coding
Safety-critical, heavily regulated, or picky about latency (real-time, complex games, medical, money movement): skip pure vibe. Same if you refuse to read or test output – that path is how auth gets inverted. Prototypes, internal dashboards, throwaway automation, learning: fair game. The moment real users or real data show up, go hybrid – AI draft, human review, actual tests. Remember the table row at ~3 months: that wall is not theoretical; Karpathy called the comprehension problem on day one.
FAQ
Do I need any coding knowledge to start?
No. Describe outcomes. Read the short explanations you force the model to give after each diff.
Which free tool should I open today?
Want a hosted app with almost no setup? Lovable or Base44. Want files and a built-in database visible? Replit Starter. Already live in an editor? Cursor Hobby. All of those free tiers can finish the SubTrack prompt above. Plan on hitting the wall after a few dense sessions – that is normal, not a personal failure.
Is the code actually safe to put online?
Default answer: not yet. The failure mode is not “AI might be wrong sometimes.” It is boring, repeated gaps – secrets in source, missing access checks, no rate limits – showing up in public CVE tracking and repo audits (see the Georgia Tech numbers in the pitfalls section). Before any public deploy, run a short checklist: secrets scanned, auth paths tested logged-out, admin routes blocked, rate limits on write endpoints. Asking the model to audit itself helps a bit. It does not replace you clicking the hostile path once.
Open Lovable or Cursor, paste the SubTrack master prompt, ship v1 before the free credits reset. One finished page beats another hour of tab-reading.