Vibe coding explained before you pick a full stack developer course in Nepal

Vibe coding means building software by describing what you want to an AI tool and using the code it writes without reading it. The last part is the problem. If you are choosing a full stack developer course in Nepal that mentions AI, ask one thing first: will it teach me to read and check the code the AI writes?

Where does the term vibe coding come from?

Andrej Karpathy, a co-founder of OpenAI, used the term in February 2025. He described a style where you "fully give in to the vibes" and "forget that the code even exists". He meant quick personal projects, not apps that hold other people's data.

The term spread fast, and now people use it for almost any coding with AI. That causes confusion. The developer Simon Willison draws a clear line. Vibe coding is building with AI without reviewing the code. If you review it, test it and can explain it, that is normal software development with better tools.

His own rule is short. He will not commit code that he could not explain to somebody else. We think that is the right rule for a beginner too.

Is vibe coding bad?

No. For a small tool that only you use, it is fine. Build a page that tracks your own expenses, try an idea in one evening, and delete it if it breaks.

It becomes a problem when other people trust your app with their data. Think of a login form, a booking page for a client, or a shop that takes payments. The AI gets you most of the way fast. The bugs, security holes and unusual cases sit in the part you did not read.

The record so far supports this. In May 2025, a report found that 170 of 1,645 web apps made with the app builder Lovable let anyone read personal data. A Veracode study in October 2025 found that AI models had become better at writing code that works, but not at writing code that is safe.

What does an AI tool get wrong in a full stack app?

Two mistakes are easy to miss, because the app still looks fine in the browser.

A secret key that reaches the browser

In a Next.js app, any setting whose name starts with NEXT_PUBLIC_ is copied into the JavaScript that every visitor downloads. The Next.js docs say this plainly. Settings without that prefix stay on the server.

Say a page shows an error because it cannot read a key. An AI tool can "fix" it by adding the prefix to that key. The error goes away. Now your secret database key is readable by anyone who opens the browser's developer tools. Supabase's own docs say a secret key must never be used in the browser.

A user who can see someone else's data

Supabase warns that a table without row level security can be read and written by anyone with access to it. Row level security is a set of rules inside the database that decide which rows each user can see.

There is a catch. If your app talks to the database through Prisma, those database rules do not protect you. Your own code must check the logged-in user on every query. An AI tool can easily write a query that loads all bookings when it should load only this user's bookings. The page looks right while you test it alone. It breaks when the second user signs up.

What should a full stack developer course in Nepal teach about AI?

You can learn to type prompts in an evening. The hard part is reading code you did not write. So open the week by week syllabus and find where reading code comes in. If it comes after the first project, or never, the course is teaching vibe coding in Karpathy's sense.

Here is how our Full Stack Development with Vibe Coding course at Saarathi Academy in Old Baneshwor, Kathmandu handles it. The course runs 6 weeks, 2 hours a day, Monday to Friday. Week 1 covers how the web works: servers, DNS, databases and APIs. Week 2 spends about 3 hours on reading JavaScript and TypeScript. Reading, not writing. The goal is to read a change from the AI well enough to accept it or reject it.

Week 5 is a security checklist before the app goes online. No secret is exposed, every protected page is checked on the server, every input is validated, and every query is checked against the logged-in user. The two mistakes above are on that list.

Do you need to pay for AI tools to learn this way?

No. VS Code, GitHub, Vercel's Hobby plan, Supabase, Gemini CLI, GitHub Copilot Free and Cursor's Hobby plan all have free plans. Claude Code needs a paid plan, so treat it as optional. A laptop with 8 GB of RAM is enough if you run one app at a time.

Two limits matter once you show your work to others. Supabase free projects pause after a week with no activity, so a demo you send to an employer may be asleep when they open it. Client sites cannot run on Vercel's free Hobby plan, so hosting for a paying client goes into your quote.

One more thing in Nepal is free. You can get a .com.np address in your own name at register.com.np. It needs a scan of your citizenship and takes a few days, so apply early.

What can you try tonight?

Open any Next.js project you have, even one an AI tool made for you. Search the whole project for NEXT_PUBLIC_. For each match, ask whether you would be fine if a stranger saw that value. If not, remove the prefix and read that value only in server code.

Then pick one file the AI wrote and explain each line out loud, in English or Nepali. Mark every line you cannot explain. That list is your study plan for the next week.

The week by week plan for our course is on the course page, and the full syllabus is public.