Some kinds of app come out of AI tools almost fully formed. Others eat a week and never work properly. The difference isn’t complexity in the way people assume — it’s how conventional the thing is.
AI tools are exceptional at patterns that appear thousands of times in open source, and unreliable at anything genuinely unusual. A dashboard with charts and filters is a solved problem repeated endlessly. A real-time collaborative editor with conflict resolution is not.
Here’s the honest map of what works.
Works Extremely Well
Landing pages and marketing sites
The best-case scenario for these tools. Structure is conventional, the output is entirely visual so you can verify it by looking, and there’s no data model to get wrong. Under an hour, and the result usually looks better than a first attempt by hand.
CRUD apps
Create, read, update, delete. Task managers, inventory trackers, contact lists, note apps. The single most repeated pattern in software, and AI tools reproduce it reliably.
The catch is authorization. Getting the four operations working is easy; making sure user A can’t edit user B’s records is the part that gets skipped. That’s the whole job on these.
Dashboards and internal tools
Read data, show it in tables and charts, filter it. Because internal tools have a small trusted audience, the security surface is smaller too, which makes them a genuinely good early project.
→ Vibe code a SaaS dashboard · Vibe code an admin panel
Form-driven apps
Waitlists, surveys, applications, booking requests. Simple data in, stored, maybe emailed. Small surface, quick to verify.
Content sites
Blogs, documentation, portfolios. Static generation from markdown is well-trodden and the output is easy to check.
Works With Care
SaaS products with payments
Entirely achievable, and the piece that needs real attention is narrow: Stripe integration and the webhook that grants access. Get the webhook wrong and people pay without receiving anything, or receive without paying.
Build the app by vibing. Read the payment code properly.
→ Vibe code Stripe checkout · Vibe code a SaaS MVP
Apps with user accounts
The moment strangers have accounts, you own their data. AI tools reliably implement login and reliably under-implement per-record access control.
→ Vibe code user authentication
APIs
Straightforward to generate, easy to leave open. Validation and rate limiting are the gaps.
Scheduling and booking
Deceptively hard, and the difficulty is entirely timezones. AI tools produce booking apps that work perfectly until someone in a different timezone uses one, or until daylight saving shifts.
Doesn’t Work Well
Real-time collaboration. Multiple people editing simultaneously requires conflict resolution that’s genuinely hard and rarely correct on the first try — or the tenth.
Anything with novel algorithms. If the core of your product is a technique that doesn’t already exist in public code, AI will produce something that looks plausible and isn’t.
High-concurrency systems. Race conditions are exactly the class of bug that passes every test and fails in production under load.
Regulated software. Health, finance, anything with an audit obligation. Not because the code can’t be right, but because “an AI wrote it and it seemed to work” is not a defensible position.
Performance-critical work. AI-generated code is idiomatic, not fast. Usually that’s fine. When it isn’t, it’s very much not.
The Pattern Underneath
Look at what’s on each list. The things that work are the things where you can verify correctness by using the app. A landing page either looks right or it doesn’t. A CRUD app either saves the record or it doesn’t.
The things that don’t work are the things where the app can look completely correct and be wrong — race conditions, timezone bugs, authorization holes, subtle numerical errors.
That’s the real dividing line, and it’s a useful test for any project you’re considering. Ask: if this were broken, would I be able to tell by using it? If yes, vibe away. If no, you need to read the code regardless of who wrote it.
Where to Start
If you’ve never done this, build a landing page. It takes an hour, you can verify it entirely by looking, and it teaches you how the tool responds without any risk.
Then a CRUD app with authentication — that’s where the real lessons are, because it’s the first time you’ll meet the authorization problem that every subsequent project has.
Then decide whether to keep going or read the code properly.
Related reading: