Over the past year, we’ve witnessed a transformative shift in software development: “vibe coding” — the practice of using AI tools to generate, debug, and optimize code — has moved from novelty to necessity. As Tom, a partner at Y Combinator, shares from his recent experiments, these tools have become “remarkably good,” and developers can get “measurably better” results by adopting certain techniques.

This evolution echoes the prompt engineering boom we saw a year or two ago, when new techniques emerged weekly and spread rapidly across social media. What’s particularly interesting is that the most effective vibe coding approaches mirror traditional software engineering best practices, suggesting that AI isn’t replacing good engineering so much as augmenting it.

Let’s explore practical advice from YC partners and founders on how to get the most out of these powerful new AI coding assistants.

Starting Your Vibe Coding Journey

If you’re completely new to coding, visual interface tools like Replit or Lovable provide excellent entry points. Many product managers and designers now skip mockups entirely, going straight to code implementation because it’s become so accessible. While these tools excel at UI changes, they can struggle with precise backend modifications.

For those with some coding experience (even if rusty), more sophisticated tools like Windsurf, Cursor, or Claude Code offer deeper capabilities.

Best Practices for Effective Vibe Coding

Always Start with a Comprehensive Plan
Rather than diving straight into code, work with your AI to develop a detailed project plan:

Create a markdown file in your project folder to outline the entire implementation

Go through this plan deliberately, removing anything too complex

Maintain a “future ideas” section for features out of current scope

Implement section by section, testing and committing as you go

Have the AI mark completed sections as you progress

As Tom notes, “I probably wouldn’t expect the models to oneshot entire products yet, especially if they’re complicated.” Breaking projects into manageable chunks ensures more consistent results, though this advice may change as models continue to improve rapidly.

Use Version Control Religiously
Version control isn’t just a good practice — it’s essential when vibe coding:

Make clean git commits before starting each new feature

Don’t hesitate to use git reset --hard HEAD if the AI goes off track

Be wary of multiple fix attempts that accumulate “layers of bad code”

If you finally solve an issue after multiple attempts, reset and implement the clean solution on a fresh codebase

Prioritize Testing
Tests provide guardrails that prevent AI coding assistants from making unexpected changes:

Focus on high-level integration tests rather than unit tests

Simulate real user interactions rather than just testing functions

Ensure tests catch when the AI makes unnecessary changes to unrelated logic

Write tests before moving to the next feature

Leverage AI Beyond Coding
These tools can handle many adjacent tasks that previously required specialized knowledge:

DNS configuration

Server setup and hosting

Image creation and manipulation

DevOps tasks

As Tom experienced, having Claude 3.7 Sonnet configure DNS servers (a task he “always hated”) and set up Heroku hosting “accelerated my progress like 10x.”

Streamline Bug Fixing
When encountering bugs:

Simply copy-paste error messages directly to the AI

For complex bugs, ask the AI to consider 3–4 possible causes before writing code

Reset to a clean state after failed fix attempts

Add logging liberally

Switch models if you’re stuck — different AIs excel at different problems

Create Custom Instructions
Most AI coding tools allow for custom instructions:

Write detailed guidelines for how the AI should interact with your codebase

Some founders maintain hundreds of lines of instructions

These dramatically improve the AI’s effectiveness with your specific project

Make Documentation Accessible
While AI models’ ability to access online documentation remains inconsistent:

Download the relevant API documentation to your project folder

Direct the AI to read this documentation before implementing features

Use the AI as a teacher to explain unfamiliar code line by line

Handle Complex Features Methodically
For sophisticated functionality:

Build a standalone reference implementation in a clean codebase first

Direct your AI to follow this implementation while integrating into your main project

Maintain modular architecture with clear API boundaries

Keep files small and focused

Choose Stack Wisely
Some technology stacks work better with AI than others:

Mature frameworks with established conventions (like Ruby on Rails) often produce better results

Newer languages with less training data available (like Rust or Elixir) may be more challenging

This gap may close as more training examples become available

Utilize Visual and Voice Interfaces
Modern AI coding assistants offer multimodal capabilities:

Use screenshots to demonstrate bugs or design inspiration

Try voice input tools like Aqua to dictate at 140 words per minute

AI’s tolerance for minor errors makes voice input highly effective

Refactor Frequently
Once you have working code with tests in place:

Ask the AI to identify refactoring opportunities

Keep files small and modular

Follow professional software development best practices

Keep Experimenting
The landscape evolves weekly:

Try each new model release

Different models excel at different tasks

For example, Gemini currently shines at codebase indexing and planning, while Claude 3.7 Sonnet often implements changes more effectively

Practical Tips from YC Founders

YC founders shared several practical insights from their daily work with AI coding tools:

“If you get stuck with one AI tool, try pasting your code into the LLM’s direct interface” — Sometimes the IDE integration limits the model’s capabilities

“Load up multiple AI tools on the same project” — Different tools offer complementary strengths

“Think of AI as a new programming language where you program with natural language” — Provide detailed context for best results

“Start with handcrafted test cases before generating code” — Set clear guardrails for the AI

“Spend an unreasonable amount of time planning architecture before coding” — Don’t let the AI freestyle in your codebase

“Watch for rabbit holes” — If the AI keeps regenerating similar code without progress, take a step back

The Future of Vibe Coding

As these tools continue to evolve at breakneck speed, we’re likely to see:

Automatic error detection without human copy-pasting

More sophisticated architecture patterns optimized for AI collaboration

Continued convergence between traditional software engineering best practices and AI-assisted development

The key insight is that vibe coding doesn’t replace good software engineering — it amplifies it. By following these practices, you can harness the incredible productivity of AI coding assistants while maintaining code quality and avoiding common pitfalls.

What techniques have you discovered for effective vibe coding? Share your experiences in the comments!

This article was created based on insights from Tom, a Y Combinator partner, and various YC founders discussing their experiences with AI-assisted coding.

Here is the source of the article: https://www.youtube.com/watch?v=BJjsfNO5JTo

CTI Threat Relationship Graph2 Knoten / 1 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

IR-PLAYBOOK-RCEHIGH

Schritte anzeigen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

WAF MitigationSofort

Virtuelles Patchen am Reverse Proxy / WAF für gefährdete URL-Pfade und Payloads aktivieren.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

Web Shell ScanSofort

Web-Root auf neu angelegte Scripts, anomal modifizierte Dateien und Persistence scannen.

find /var/www -type f -name "*.php" -mmin -120

Outbound FilteringSofort

Ausgehenden Datenverkehr (Reverse Shells zu unbekannten IPs/Ports) blockieren.

ss -tunp | grep -E ":(4444|1337|8080|9001)"

Vendor Patching

Hersteller-Update in Staging validieren und schnellstmöglich in Produktion ausrollen.

apt update && apt --only-upgrade install <pkg>

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - The Rise of Vibe Coding
id: cc6c463d-bd48-470f-9bd0-2daba6e483b3
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "The Rise of Vibe Coding" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("The Rise of Vibe Coding")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*The Rise of Vibe Coding*"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "The Rise of Vibe Coding"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 1 Min

Squid Game - Staffel 3: Stirbt Gi-hun?

IT Nachrichten

NÄCHSTER BEITRAG 1 Min

RTL übernimmt Sky: Was sich jetzt für Zuschauer ändert

IT NachrichtenWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich The Rise of Vibe Coding.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')