"Vibe coding" — describing what you want to an AI and accepting whatever it builds — went from meme to mainstream fast. Business owners are building booking forms, quote calculators and internal tools by chatting with an AI, and some of it works. We use AI heavily in our own engineering, so this is not an anti-AI piece. It's a map of where the cliff edges are.
What AI Building Is Genuinely Good At
- Prototypes and internal tools. A rough tool for your own team — a calculator, a tracker, a dashboard — can be vibe-coded in an afternoon. If it breaks, the cost is annoyance, not liability.
- First drafts of real software. Professionals now use AI to produce the first 70% and spend their expertise on the 30% that matters: architecture, security, edge cases.
- Learning. Asking an AI to explain what it built is the best free software education that has ever existed.
- Content and admin automation. Document drafting, email triage, WhatsApp auto-replies — high value, low blast-radius.
Where It Ships Disasters
The pattern in every AI-built failure we've been called to fix is the same: the system worked in the demo and nobody knew what it was doing underneath.
- Security is invisible until it isn't. AI-generated code happily stores passwords in plain text, exposes admin routes, and leaks API keys in frontend code. It looks identical to secure code in the demo.
- POPIA doesn't care who wrote the code. If your vibe-coded form collects client data into an unsecured database, the liability is yours — up to R10 million of it. "The AI built it" is not a defence the Information Regulator recognises.
- Nobody can maintain what nobody understands. Six months later the tool breaks, the AI conversation is gone, and no engineer wants to inherit 4,000 lines of unstructured generated code.
- Payments and integrations are where the demo dies. Real payment gateways, real WhatsApp Business API, real invoicing — these have failure modes, retries, and edge cases that prompt-and-accept development does not surface.
The guardrail people skip first
Never paste client personal information, patient records, or contracts into consumer AI chatbots. Under POPIA that is a disclosure to a third-party processor — and most consumer AI tools' terms allow training on your input. Use business-tier AI with data controls, or strip identifying data first.
The Guardrails That Actually Matter
- Match the tool to the blast radius. Internal tool, no client data? Vibe away. Client-facing, takes payments, stores personal information? That needs engineering review — at minimum.
- Secrets never live in the frontend. If an API key appears anywhere a browser can see it, assume it is already stolen.
- Every input is hostile. AI code tends to trust user input. Validation, rate limiting, and authentication are the difference between a tool and a breach.
- Have a human who can read it. If nobody in your business can explain what the code does, you don't own a tool — you own a mystery with your name on the liability line.
- Version control from day one. Put it in Git even if you don't fully understand Git yet. Future-you, or the engineer you eventually hire, will need the history.
DIY or Hire? An Honest Decision Rule
DIY with AI when
It's internal, it handles no personal client data, no payments, and the worst-case failure is inconvenience. This covers more than you'd think — go build.
Bring engineering in when
Clients touch it, money moves through it, personal information lives in it, or your reputation depends on it staying up. The cost of engineering is real; the cost of a public failure is bigger.
The middle path is often best: vibe-code your prototype, prove the idea works, then hand the prototype to engineers as a specification. You'll get a better quote and a faster build, because the hardest part of software — knowing what you actually want — is already done.
How we use AI: our virtual receptionists, intake assistants and automation flows are AI-powered — you can try a live one on our How We Work page. The difference is what's wrapped around the AI: authentication, input handling, POPIA-compliant data flows, and a human who owns every line in production.