Vibe Coding Backed by Jotform Founder for MVPs and Side Projects

A veteran programmer backs vibe coding

The sharpest argument for vibe coding in 2026 is not coming from first-time founders. It is coming from people who spent decades writing code by hand. In an essay published August 26, Jotform founder and CEO Aytekin Tank said he has been a software developer for about 20 years and is now fully committed to building software from plain-language prompts. His commitment comes with conditions, and those conditions matter more than the headline suggests.1

Tank writes from both of his roles. As a programmer, he still thinks people should understand how code works. As a founder, he is excited that vibe coding lowers the cost of turning an idea into a working product, especially at a startup's earliest stage.1 His examples are deliberately ordinary: a gardener with an idea for a plant-care app who no longer needs a technical co-founder, a restaurant owner who wants a custom reservations tool, and a consultant who needs a dashboard for clients.1

The essay matters less for what it says than for who says it. Tank started Jotform because he got tired of hand-building web forms at an early job, so automating tedious coding has been part of his career from the start.1 When someone with that background treats vibe coding as a real tool and not a toy, the debate moves on from whether to use it to how to use it.

Where Tank says it works: MVPs and the jobs nobody owns

Tank's main claim is that vibe coding makes the minimum viable product live up to its name. He recalls Profile Manager, a membership platform he built in college. It worked and drew attention, but he admits it was clunky, and he says a better version would now take a small fraction of the time.1 In his view, an MVP's purpose has not changed: learn as much as possible for as little as possible. What has changed is the time between having an idea and shipping a prototype.1

His second use case is personal and arguably more interesting. Tank says he used Claude Code to build an app that works as a personal trainer and nutrition coach based on his own habits and preferences. He has no plans to sell it or keep developing it.1 His advice is to find the weekly tasks that are "genuinely nobody's job" and build small tools for them. If you can describe a better version of a task that eats your time, he argues, you can probably build it.1

Other coverage of the trend backs up this choice of targets. One 2026 guide describes highly customized personal tools, such as reading trackers and habit trackers with AI coaching, that can be built in a weekend and can beat off-the-shelf apps because they fit one person's workflow.12 Daily.dev also says vibe coding works best for testing ideas quickly and building internal tools.5

The caveat is the real story

The most important part of Tank's essay is his warning. He says vibe coding cannot be relied on entirely. He cites estimates that about 45% of AI-generated code has security weaknesses, and he points to a scan of 1,645 apps built with Lovable that found 120 exposing users' personal data.1 He says authentication, payment processing and encryption still need human expertise that current models cannot reliably supply.1

Security researchers have reached the same conclusion. The 45% figure comes from Veracode's tests of more than 100 large language models, which found OWASP Top 10 vulnerabilities in nearly half of the code samples. Java failed about 72% of the time.16 The Cloud Security Alliance notes that this pass rate did not improve across testing cycles from 2025 into early 2026, despite vendors' claims.16 In other words, models are getting better at producing code that runs, but not at producing code that is safe.

The trend in vulnerabilities that reach the public is worse. Georgia Tech's Vibe Security Radar, which tracks published vulnerabilities traced to AI coding tools, found about 18 cases over seven months in the second half of 2025, then 56 in the first quarter of 2026. March alone produced 35, more than all of 2025.14 The confirmed cases include command injection, authentication bypass and server-side request forgery.14 The researchers call their count a minimum, because they can only attribute code that still carries tool signatures. They estimate the real number is five to ten times higher.1618

One point from that research weakens the idea that vibe coding is fine for throwaway projects. Because many developers use the same models, the same bugs show up across many projects. An attacker who finds one pattern can search for it across thousands of repositories.14 A small personal tool may be fine to build quickly, but a vibe-coded customer product inherits flaws that may be shared by everyone else using the same model.

Production scans tell a similar story. Escape.tech scanned more than 1,400 vibe-coded production apps and reported that 65% had security issues and 58% had at least one critical vulnerability. It also found more than 400 exposed secrets.17 A Tenzai study of 15 apps built with five major coding tools found that none had CSRF protection and none set security headers.1517 GitGuardian data shows AI-assisted commits leaking secrets at about twice the baseline rate, 3.2% versus 1.5%.17 Reports also document "slopsquatting": about one in five AI-generated code samples refer to software packages that do not exist, and attackers register those names with malicious code.1617

Experience as the deciding factor

Tank says vibe coding works best when the person directing the AI understands the logic underneath, instead of accepting whatever comes out.1 Industry reporting increasingly supports this, though not consistently.

One line of evidence favors him. Developers with ten or more years of experience report productivity gains of about 81%, while junior developers show no significant measurable improvement.69 An analysis of more than 30 million GitHub commits found a modest overall increase in output, with experienced developers capturing almost all of it.6 Hashnode's review of the year concludes that the engineers doing well are those who understand code well enough to catch the AI's mistakes.9

The main counterpoint is METR's randomized trial. Sixteen experienced open-source developers working on mature codebases were 19% slower with AI tools, yet afterward they believed they had been about 20% faster.89 Other studies are more positive. An MIT trial of 4,867 developers found 26% more tasks completed, and Google's internal data showed a 21% speed-up on multi-file work.4 One way to reconcile these results is that gains are real on greenfield work and boilerplate but shrink or reverse inside large, existing codebases.48

That reading fits Tank's essay well. MVPs and one-person tools are exactly the greenfield projects where the evidence for speed is strongest. He is not claiming vibe coding will help maintain a million-line system, and the data suggests he should not.

The democratization tension

The essay pulls against itself in one place. Tank praises vibe coding for opening software to people without technical training, like the gardener and the restaurant owner.1 He also says the best results come from people who understand the code.1 Those two claims fit together uneasily. The non-coders he welcomes are the users least able to spot a missing access-control rule or an API key exposed in the browser. Security writers call this the "comprehension gap."18

Gartner has warned that prompt-to-app development by citizen developers could increase software defects by 2,500% by 2028.15 Keyhole Software points to a pipeline problem: hiring of junior developers aged 22 to 25 has reportedly fallen 20%, which could leave fewer senior engineers in the future to oversee AI-generated code.4

Where the practice actually stands

Vibe coding in Tank's sense is still less common than the hype suggests. Stack Overflow found that about 72% of developers say vibe coding is not part of their professional work, and only about 12% say it is.8 Meanwhile, about 90% of software professionals use AI at work in some form.8 Trust has also dropped: 46% of developers say they distrust AI tools, compared with 33% who trust them, and experienced developers are the most skeptical.6

The overall verdict is mixed. Tank's essay captures the current consensus better than either enthusiasts or critics do. Vibe coding is very useful for prototypes and personal tools, and it needs careful supervision for anything that handles authentication, payments or user data. The evidence supports his conclusion that experienced developers get the most out of the approach, but it also shows how much damage it can do in the hands of the newcomers he hopes to bring in. Given how fast AI-attributed vulnerabilities are growing, the most important line in his essay may be the one telling readers not to rely on vibe coding completely.