The Beauty Of Vibe Coding
Where
Talks
hack.lu 2025
Duration
11 min
Follows one developer's attempt to build a web UI entirely through LLM prompting, and where that approach broke down.
Summary
The speaker set out to test whether a complete application could be built with vibe coding, where a large language model makes every technical decision and the human only prompts for changes. The test project was the user interface of an anonymous reporting tool that submits data to MISP. The front end stores no data, so it looked like a low-risk candidate. The model chose Alpine.js, Bootstrap and plain HTML and CSS, and early progress looked promising, including a dynamic form layer generated from MISP object definitions.
Problems grew as the project moved into refactoring. During one refactor the model silently dropped Alpine.js in favour of another approach, split a single-page design into separate HTML files with duplicated menus and drifting styles, and rewrote whole files so that unrelated parts broke. Limited context made it forget earlier decisions and drop parts of the codebase. A long chat also overwhelmed the browser. The generated code did no output sanitisation, which left it open to cross-site scripting.
The speaker finished the last part by hand. By their estimate the project took two to three weeks, when writing it manually might have taken about one. The takeaway is that the approach suited small, tightly scoped tasks and up-front planning, but not large, multi-file, long-running projects. Generated code can look clean while hiding defects, and the time spent waiting on prompts can disguise the real cost.
Related talks
Talks·40 min
Vineeta Sangaraju
Shows why LLMs need deterministic tooling, data preparation and human oversight to be useful for application security.
Talks·50 min
Chris Lindsey
Shows how AI-generated .NET and React code can ship with injection, XSS and authentication flaws, and how to catch them.
Common Ground·44 min
Kirill Efimov · Eitan Worcel
Shows why AI-generated vulnerability fixes often break applications, and how a hybrid approach can work better.


