How to Hire a Vibe Coding Developer: questions, red flags & contracts
Want an app built with AI but don't want to build it yourself? Or did your own vibe-coded project hit a wall? This guide explains what a vibe coding developer or agency actually does, the questions to ask before you hire, the red flags to walk away from, and how to make sure you own the code and accounts when the job is done.
To hire a vibe coding developer, write a one-page brief, shortlist two or three freelancers or agencies who can show live apps they built with AI tools, ask how they test and secure AI-written code, start with a small paid milestone, and get a written agreement that gives you the code, the accounts and the data. The AI does a lot of the typing; you're really hiring the person's judgment about what to build, what to check and what to throw away.
That last point is the whole game. Anyone can type a prompt into an app builder. What separates a good hire from an expensive mistake is everything around the prompt: understanding your business, keeping secrets out of the browser, testing the boring edge cases, and leaving you with something you can run without them. This guide shows you how to tell the difference before you sign anything.
- Who to hire: a freelancer for a small, well-defined app; an agency or small team for bigger builds; a "rescue" developer if you already have a vibe-coded app that's broken or unsafe.
- What to ask: show me live apps, how do you test AI-written code, where will secrets and data live, who owns the accounts, how does handover work.
- Biggest red flags: no live examples, "the AI handles security", work done in their accounts only, no written agreement, refusing a small paid first milestone.
- Ownership: put code, IP and account ownership in writing. Software built by a contractor isn't automatically yours under US copyright rules.
- Handover: repository, hosting, database, domain, secrets list and a short "how to update this" document, all in your name.
What does a vibe coding developer actually do?
"Vibe coding" is the term Andrej Karpathy coined in a post on X on February 2, 2025, for building software by describing what you want to an AI and accepting what it generates, without reading every line of code. (Our complete guide to what vibe coding is covers the full story, and the vibe coding meaning homepage has the short version.)
A vibe coding developer, then, is someone who builds apps for other people mainly by directing AI tools: browser app builders, AI code editors and coding agents. In practice the label covers a wide range of people, from a self-taught builder who has shipped a few apps in Lovable or Bolt to an experienced software engineer who now writes most of their code with an AI agent.
That range matters, because the strict meaning of vibe coding is "don't look too closely at the code". Developer Simon Willison put it well in March 2025: not all AI-assisted programming is vibe coding. When you're paying someone to build something your customers will use, you want the fast part of vibe coding and the careful part of engineering: someone who reviews, tests and understands what the AI wrote. Karpathy himself proposed the term "agentic engineering" in early 2026 for that more disciplined style of working with AI agents.
A good vibe coding developer typically handles:
- Scoping: turning your idea into a short list of screens, features and rules.
- Building: using AI tools to generate the app quickly, then fixing and refining what the AI gets wrong.
- Data and logins: setting up a database, user accounts and permissions correctly.
- Security and testing: checking that secrets stay out of the browser and users can only see their own data.
- Deployment: putting the app on a real address, often on your own domain.
- Handover: transferring code and accounts to you, with simple instructions.
Curious about the person rather than the job? Our explainer on what a vibe coder is covers the different kinds of vibe coders and how they compare to traditional developers.
Freelancer, agency or rescue developer: who should you hire?
There are a few common shapes of help. None is "best"; it depends on the size and risk of what you're building.
| Option | Good for | Watch out for |
|---|---|---|
| Freelance vibe coder | Small, well-defined apps: a booking form, an internal dashboard, a client portal, a prototype to show investors | Single point of failure; skill levels vary a lot; make sure you own the accounts |
| Agency or small studio | Larger apps, several user types, payments, integrations, ongoing support | Who actually does the work; whether "AI-powered" is real or just marketing |
| Rescue / cleanup developer | You already built something with AI and it's broken, slow, insecure or stuck | Ask for an assessment first; sometimes a rebuild is cheaper than a fix |
| Experienced engineer who uses AI | Apps handling money, health or personal data; anything that must scale or pass a security review | May be more process-heavy than you need for a simple tool |
| Do it yourself | Learning, personal tools, low-risk experiments | Your time; security gaps if nobody reviews the code |
The rescue option is a real and growing niche. In September 2025, 404 Media reported on freelancers and firms building businesses around fixing vibe-coded software, including dozens of Fiverr sellers offering to review and fix "vibe code", a site matching vibe-coded projects with experienced developers, and an established software firm marketing its cleanup service with the line "we clean up after vibe coding. Literally." One founder described "credit burn": builders spending heavily on AI usage near the end of a project, when every new feature seems to break an old one. If that sounds familiar, you're not alone, and it's a perfectly good moment to bring in help.
Demand for this kind of work is showing up in freelance marketplaces too. Upwork's In-Demand Skills 2026 report, released in February 2026 and based on what US clients actually paid freelancers for during 2025, found that spending on AI integration work grew 178% year over year, and demand for skills that explicitly reference AI grew 109% overall.
Should you hire someone or vibe code it yourself?
Many people can build a useful small app themselves with today's tools. Our guide on how to start vibe coding walks you through a first project step by step. So when is hiring worth it?
| DIY usually makes sense when… | Hiring usually makes sense when… |
|---|---|
| The app is just for you or a few trusted people | Customers or the public will use it |
| It stores no personal, payment or health data | It handles logins, payments or personal details |
| You enjoy learning and have time to experiment | Your time is better spent running the business |
| A mistake would be annoying, not damaging | A mistake could cost money, data or reputation |
| You're testing whether an idea is worth anything | The idea is proven and needs to work reliably |
A common middle path: build a rough prototype yourself, then hire someone to review, harden and deploy it. You'll communicate much better with a developer once you've felt the tools firsthand. If you're a business owner weighing this up, our guide to vibe coding for small business covers what's sensible to build first and when buying existing software beats building.
Before you hire: write a one-page brief
The best way to get accurate quotes and avoid surprises is a short, clear brief. It doesn't need to be technical. It needs to answer: who uses this, what do they do, and what must never go wrong?
Include:
- The problem in two or three sentences.
- The users: who logs in (customers, staff, admins) and what each can see and do.
- The must-have features for version one, and a separate "later" list.
- The data: what you store, especially anything personal, financial or health-related.
- Integrations: payments, email, calendars, spreadsheets, existing software.
- Examples: two or three apps or screenshots of things you like.
- Constraints: deadline, budget range, preferred tools if any, and who will maintain it afterwards.
You can use an AI tool to help you write it. Paste this prompt into any chat assistant:
// Turn your idea into a brief a developer can quote on "I want to hire a developer to build an app. Interview me one question at a time to write a one-page project brief. Cover: the problem, who the users are and what each can see and do, must-have vs later features, what data we store (flag anything personal or financial), integrations, examples I like, deadline and who maintains it after launch. When you're done, write the brief in plain English and list the 5 biggest risks or unknowns a developer should ask about."
Stuck on the idea itself? Spin the Vibe Machine idea generator for inspiration, or see our vibe coding prompts that actually work for more copy-paste templates.
12 questions to ask before you hire
These questions work for freelancers and agencies alike. You don't need to understand every technical detail in the answers. You're listening for clear, specific explanations rather than vague reassurance.
| Question | A good answer sounds like… |
|---|---|
| 1. Can you show me live apps you've built? | Working links you can click, plus an honest note on what they did vs what the AI did |
| 2. Which AI tools do you use, and why for my project? | A reasoned choice (app builder vs AI editor vs coding agent), not "whatever's newest" |
| 3. How do you check the code the AI writes? | Reading key parts, testing, reviewing logins and data access, not "the AI is very good now" |
| 4. Where will secret keys live? | "In the host's environment variables or server-side, never in browser code" |
| 5. How will you make sure users only see their own data? | Database access rules (for example Row Level Security) and tests with two accounts |
| 6. Whose accounts will the code, hosting and database be in? | "Yours, from day one" or a clear plan to transfer them |
| 7. What does handover include? | Repository, accounts, secrets list, short docs, a walkthrough call |
| 8. How do we split the work into milestones? | Small, testable stages with something you can click at each one |
| 9. What happens when something breaks after launch? | A defined support window or an optional maintenance arrangement |
| 10. Will this run on a tool's paid plan or usage credits? | A clear list of the services you'll pay for and which plans they need (check current pricing yourself) |
| 11. What would you not build with AI here? | A thoughtful answer, for example payments logic or permissions reviewed by hand |
| 12. Can I talk to someone you've built for? | A real reference, or an honest "I'm new; here's a smaller paid test instead" |
Question 3 is the one to lean on. AI tools are excellent at generating code that looks right. Veracode's 2025 GenAI Code Security Report tested more than 100 AI models on 80 coding tasks and found AI-generated code introduced security flaws in 45% of cases. A developer who can't explain how they catch those problems is asking you to take that risk on trust.
Test your own vibe coding instincts
Before you talk to developers, try the two-minute Vibe Challenge. It's a quick way to learn the words they'll use and spot answers that don't add up.
Red flags: when to walk away
None of these automatically means someone is dishonest, but each is a reason to slow down, ask more questions or keep looking.
- No live examples. Screenshots and mockups are easy to fake or generate. Ask for working links.
- "The AI takes care of security." It doesn't. Someone has to check permissions, secrets and data access.
- Everything lives in their accounts. If the code, hosting, database and domain are all under the developer's login, you don't really control your app.
- No written agreement, or one that's silent on who owns the code.
- Refuses a small paid first milestone and wants the whole project paid upfront.
- Guaranteed timelines that sound impossible for apps with logins, payments or complex rules. AI speeds up building; it doesn't remove testing.
- Can't explain things simply. If they can't tell you where your customers' data is stored, that's a problem.
- Fake-looking social proof: huge client counts, star ratings with no names, or testimonials you can't verify.
- No plan for after launch. Every app needs updates, fixes and someone who knows how to republish it.
- Asks for your passwords instead of being invited to your accounts with their own login.
Start with a small paid test
The safest way to hire is to buy a small, useful piece of the project first. Good first milestones:
- A clickable prototype of the main screens, with no real data yet.
- A technical plan: which tools, which database, how logins work, what you'll pay for monthly.
- For rescue work, an assessment: a written list of what's broken, what's risky, and whether to fix or rebuild.
Judge the milestone on more than how it looks. Did they ask good questions? Did they explain trade-offs? Did they set things up in your accounts? Did they deliver what they said, when they said? A developer who handles a small job well usually handles a big one well too.
When the milestone arrives, you can even use AI to help you review it. Ask your developer for read access to the code, then try this:
// Use in an AI code editor or agent with read access to the repo "I'm not a programmer. A developer built this app for me. Review it and explain in plain English: 1. What the app does and how it's organized. 2. Where secret keys are stored, and whether any appear in code that runs in the browser. 3. How logins and permissions work, and whether one user could see another user's data. 4. Anything that looks unfinished, risky or hard to maintain. Don't change any code. Give me 5 questions to ask the developer."
Treat the AI's review as a list of questions, not a verdict. It can be wrong in both directions, and a good developer will happily walk you through anything it flags.
Contracts and code ownership: don't skip this
This is the part most people forget until it's too late. This section is general information, not legal advice; talk to a lawyer about your specific agreement.
Code written by a contractor isn't automatically yours
In the US, many people assume that if they pay for something, they own it. For copyright, that's not how it works by default. According to the US Copyright Office's Circular 30 on works made for hire, work by an independent contractor only counts as a "work made for hire" if it falls into one of nine specific categories and there's a written agreement, signed by both parties, that expressly says so. Computer programs aren't on that list of nine categories. Otherwise, the Copyright Office says, the author is ordinarily "the person or persons who actually created the work."
In practice, that's why development contracts usually include a written assignment of intellectual property rights to the client. Ask for one, in plain language, covering the code, designs and content created for your project.
The AI-generated part adds a twist
There's a second wrinkle that's specific to vibe coding. In its January 29, 2025 report on copyrightability (Part 2 of its AI report), the US Copyright Office concluded that purely AI-generated material isn't protected by copyright, and that prompts alone don't make someone the author, because prompts "do not control the way that idea is expressed." Human contributions, such as creative selection, arrangement or meaningful modification of AI output, can still be protected, judged case by case.
What does that mean for you? Mostly that the practical side of ownership matters even more: control of the repository, accounts and data, plus a contract that assigns whatever rights the developer has. Ask a lawyer if copyright protection of your code is important to your business (for example, if you plan to raise money or sell the company).
What to put in writing
- Scope and milestones: what's included, what "done" means for each stage.
- IP assignment to you on payment, including code, designs and documentation.
- Account ownership: repository, hosting, database, domain, email and third-party services in your name.
- Tools and licenses: which AI tools and paid services will be used, and who pays for them.
- Confidentiality and data handling, especially if real customer data is involved.
- Security expectations: for example, "follows the checklist in the brief before launch".
- Support window after launch, and how extra work is handled.
- Handover deliverables (see the checklist below).
Security: what to expect from anyone you hire
You don't need to become a security expert, but you should expect your developer to handle the basics and to show you they did. The essentials:
- Secret keys (payments, AI providers, database admin keys) are never in browser code. They live server-side or in the host's environment variables.
- Database access rules are on for every table the app can reach, and tested with two separate user accounts.
- Admin pages and APIs can't be reached while logged out.
- Forms validate input and errors don't leak technical details.
- Dependencies are reasonably up to date, with a plan for updates.
Hand them our vibe coding security checklist (16 checks) and ask them to confirm each item before launch. For how the app gets onto the internet, and where secrets belong, our guide on how to deploy a vibe-coded app explains the main paths in plain English.
If your app handles payments, health information or sensitive personal data, consider an independent security review on top of the developer's own checks. A second pair of eyes is cheap compared to a data leak.
The handover checklist
At the end of the project, you should have everything needed to keep the app running if the developer disappears tomorrow. Tick these off before the final payment:
- Code repository in your own GitHub (or similar) account. GitHub's documentation notes that when a repository is transferred, its issues, pull requests, wiki and commit history move with it, and the new owner has to accept the transfer (the invitation expires after a day).
- Hosting account in your name, with the developer removed or downgraded once you're done.
- Database in your account, with a tested backup or export.
- Domain and DNS registered to you.
- App builder project (Lovable, Bolt, Replit or similar) owned by your workspace, if one was used.
- Secrets list: every API key and service the app uses, where it's stored, and how to rotate it. Rotate keys the developer had access to if you're ending the relationship.
- Third-party services: email sending, payments, analytics, maps, AI APIs, all in your name and billing.
- A short README: what the app does, how to run it, how to deploy an update, and known limitations.
- A walkthrough call, recorded if possible, showing you how to make a small change and republish.
- Admin access for you inside the app itself.
Hiring someone to fix a vibe-coded app
If you've already built something and it's misbehaving, a few steps will save time and money:
- Freeze changes. Stop prompting the AI to "fix everything". Each round can break something else and burn credits.
- Write down the symptoms: what's broken, when it started, what you changed last, exact error messages.
- Collect access: the app builder project, repository, hosting and database. Invite the developer with their own login.
- Ask for an assessment first, with a clear recommendation: patch, refactor or rebuild.
- Prioritize safety: exposed keys and open databases come before new features or design polish.
Rescue projects are one of the most common reasons people search for vibe coding services, and there's no shame in them. Getting a working prototype far enough to discover what's hard is often the cheapest way to learn what you actually need.
What vibe coding developers are worth to you
We don't publish prices here, because rates vary hugely by country, experience and project, and AI tool costs change often. Instead of comparing hourly rates, compare outcomes: a developer who costs more but delivers a secure, documented app in your accounts is often cheaper than one who delivers fast and leaves you with a tangle nobody can maintain.
Also remember the running costs. Your app will likely depend on a hosting plan, a database, maybe an app builder subscription and AI usage. Ask your developer for a list of every service and check each one's current pricing page yourself.
If you're on the other side of this table and want to be the developer people hire, our guides on making money with vibe coding and vibe coding jobs cover how freelancers find work and what clients look for.
Prefer to have it built for you?
VibeCodingMeaning.com also offers this service: you can hire a vibe coder through our site to scope, build, test and launch your app, then hand it over in your accounts. Everything in this guide applies to us too. Ask us the twelve questions, and expect clear answers. You can also see the kind of small apps we build in the Vibe Arcade: nine free games and mini apps that started as plain-English prompts.
Still comparing tools before deciding whether to build or hire? Browse the vibe coding tools directory or our roundup of the best vibe coding tools.
Frequently asked questions
What is a vibe coding developer?
A vibe coding developer builds apps mainly by directing AI tools such as app builders, AI code editors and coding agents, then refining, testing and deploying what the AI produces. The best ones combine the speed of vibe coding with careful review of logins, data access and security.
How do I hire a vibe coding developer?
Write a one-page brief, shortlist two or three freelancers or agencies with live apps you can click, ask how they test AI-written code and where secrets and data will live, start with a small paid milestone, and sign a written agreement covering scope, IP assignment, account ownership and handover.
Should I hire a freelancer or an agency?
A freelancer often suits a small, well-defined app such as a booking tool or internal dashboard. An agency or small team suits larger apps with several user types, payments or integrations. For apps handling money, health or personal data, look for someone with real engineering and security experience either way.
What questions should I ask a vibe coder before hiring?
Ask to see live apps, which AI tools they'll use and why, how they check AI-written code, where secret keys will be stored, how users are kept from seeing each other's data, whose accounts everything lives in, what handover includes and what happens when something breaks after launch.
Who owns the code a vibe coding developer builds for me?
Don't assume you do. Under US Copyright Office guidance, software by an independent contractor generally isn't a "work made for hire" by default, so contracts usually include a written assignment of rights. Purely AI-generated material may not be copyrightable at all. Get ownership of code and accounts in writing and ask a lawyer about specifics.
Is it safe to hire someone who builds mostly with AI?
It can be, if they review and test the AI's work. Veracode's 2025 research found security flaws in 45% of AI-generated code samples it tested, so ask exactly how the developer checks secrets, permissions and data access, and ask them to complete a security checklist before launch.
Can I hire someone to fix my vibe-coded app?
Yes. Fixing vibe-coded apps has become a recognized niche; 404 Media reported on freelancers and firms offering cleanup services in September 2025. Freeze changes, document the problems, share access through your own accounts and ask for an assessment before agreeing to a full fix or rebuild.
How much does it cost to hire a vibe coding developer?
It varies widely by experience, location and project size, and AI tool costs change often, so we don't quote prices. Compare proposals on scope, testing, security and handover rather than hourly rate alone, and list every ongoing service the app needs so you know the running costs.
What should a handover include?
The code repository, hosting, database, domain and any app builder project in your own accounts; a list of every secret key and service; a short README on running and updating the app; a walkthrough call; and admin access inside the app. Rotate any keys the developer had once the project ends.
Is a vibe coding developer the same as a software engineer?
Not necessarily. Some are experienced engineers who now work mostly through AI agents; others are self-taught builders who learned through AI tools. Neither is automatically better. What matters is whether they can explain, test and secure what they build for your specific project.
Keep reading
Browse every guide on the vibe coding blog.
Sources
- U.S. Copyright Office, Circular 30, "Works Made for Hire": copyright.gov
- Skadden, "Copyright Office Publishes Report on Copyrightability of AI-Generated Materials" (summary of the Office's January 29, 2025 Part 2 report), February 2025: skadden.com
- Slashdot, "The Software Engineers Paid To Fix Vibe Coded Messes" (summarizing 404 Media's reporting), September 13, 2025: slashdot.org
- Boing Boing, "Humans fixing bad vibe code for good money", September 11, 2025: boingboing.net
- SelfEmployed.com, "Upwork: Demand for AI Freelance Skills More Than Doubles, Led by Video and Integration Work" (Upwork In-Demand Skills 2026), February 2026: selfemployed.com
- GitHub Docs, "Transferring a repository": docs.github.com
- Veracode, 2025 GenAI Code Security Report press release, July 30, 2025: veracode.com
- Simon Willison, "Not all AI-assisted programming is vibe coding (but vibe coding rocks)", March 19, 2025: simonwillison.net
- The New Stack, on Andrej Karpathy's "agentic engineering", February 10, 2026: thenewstack.io
- Andrej Karpathy's original "vibe coding" post on X, February 2, 2025: x.com
VibeCodingMeaning.com is an independent educational site and isn't affiliated with any tool, marketplace or platform mentioned. We also offer a vibe coding build service, linked above. This article is general information, not legal advice. Tool features, plans and terms change often; check each provider's current documentation and pricing.