We hear it every week: "I asked AI to build my website and it was ready in an afternoon. Why would I pay an agency?"
It's a fair question. Tools like Lovable, Bolt, v0, and Replit let you describe what you want in plain language and, minutes later, you have a working website, complete with a contact form, user login, and even payments. This is called vibe coding: building "by feel," accepting whatever the AI generates without really reviewing the code.
And it works. Until it doesn't.
What you see and what you don't
When AI builds a website, it optimizes for one thing: that it looks right and works in the demo. The button clicks, the form submits, the page loads. That's what you check, and that's what it delivers.
What you don't check, because you can't see it, is everything else:
- Who else can read the database where you store your customers' data?
- Where did your payment gateway keys end up?
- What happens if someone tries to guess passwords a thousand times a minute?
- Which libraries did the AI install, and do they actually exist?
A website can look perfect and still be wide open.
This is already happening
This isn't theory. In 2025, a researcher reviewed more than 1,600 apps built with Lovable, one of the most popular vibe coding platforms, and found that around 170 of them had misconfigured database permissions. The result: names, emails, financial information, and API keys belonging to their users were visible to anyone who knew where to look. The platform's response was an automated scanner… that checked whether security rules existed, not whether they worked.
And the problem is growing. Georgia Tech keeps a record of officially catalogued vulnerabilities traceable to AI coding tools: they went from 6 in January 2026 to 35 in March. Its own founder believes the real number is much higher, since most are never reported. A Veracode study found security flaws in roughly 45% of the AI-generated code it analyzed.
The five most common mistakes in AI-built websites
1. Secret keys inside the code. The AI needs to connect your site to Stripe, your database, or OpenAI, and the fastest way is to paste the key straight into the file. If that file ends up in the browser or in a public repository, anyone can use your account… and you pay the bill.
2. Open databases. Platforms like Supabase or Firebase are secure when configured correctly. AI tends to create the tables and forget the rules that decide who can read what. Your site works, yes, but it also works for a stranger querying every record you have.
3. Unprotected logins. AI-generated login forms almost never limit attempts. That lets a bot try thousands of passwords with nothing to stop it.
4. Libraries that don't exist. Sometimes AI "invents" a package name that sounds plausible. Attackers already know this: they register those made-up names with malicious code inside and wait for someone to install them.
5. Nobody knows how it was built. When something breaks, or when you need to change something six months later, nobody understands the code, including whoever "wrote" it. Every AI fix can break something else.
So, is AI the problem?
No. We use AI every day too: to write code faster, catch errors, audit performance, and test every flow before going live. The difference isn't whether you use AI, but who reviews what the AI delivers.
Think of it like a car: AI is an incredibly powerful engine. But an engine with no brakes, no seatbelt, and no one who knows how to drive won't get you anywhere faster. It just gets you to the crash faster.
Vibe coding is great for:
- Prototypes and mockups to validate an idea.
- Internal tools with no sensitive data.
- Learning and experimenting.
But when your website collects customer data, processes payments, or represents your brand, it needs what AI alone can't guarantee: a security review, sound practices, and someone accountable when something goes wrong.
If you already have an AI-built website, check this
You don't have to throw it away. Start with these questions:
- Are your keys outside the code? They belong in environment variables, never in files the browser can see.
- Does your database have access rules that are active and tested? It's not enough that they exist: try to read someone else's data and confirm you can't.
- Does your login limit attempts? After several failures, it should block or ask for verification.
- Do you know which libraries are installed? Make sure every one is real, well known, and up to date.
- Does your site pass a basic audit? Speed, SEO, and accessibility are often left half-done on generated websites too.
If any answer is "I don't know," that's where your risk is.
Use AI, but keep someone at the wheel
At WeDoo we combine the best of both worlds: the speed of AI and the judgment of a team that reviews, tests, and takes responsibility. That's how our AI-Powered Optimization service works: we audit your website, fix what exposes it or slows it down, and keep it secure and fast month after month.
You can start for free: our audit analyzes your website in under 60 seconds and shows you its performance, SEO, and accessibility.
Was your website built with AI and you want to know if it's secure? Tell us and we'll review it →
The bottom line
AI didn't remove the need to understand what's being built. It made it more important. Today anyone can publish a website in an afternoon, and that's exactly why the websites people trust are the ones someone reviewed carefully.
Building fast is no longer the advantage. Building fast and right is.
