The Vibe Quality Model
From ad-hoc to professional vibe coding.
The Vibe Quality Model (VibeQM) helps teams and individual developers produce professional software with AI agents, of a quality their employers and customers can trust. Developers keep working much as they do now. The model instructs the AI to follow professional practice, and to keep the records that show it did.
Code is prompted, accepted and shipped when it runs.
Requirements, tests, review, security scans and records on every change.
One way of working across projects, enforced and audited.
Defects, security and delivery tracked against limits.
Every escaped defect becomes a rule the system enforces.
§1 · The problem
Vibe coding is fast.
It is not yet professional.
AI agents let a developer build in an afternoon what used to take weeks. The research so far shows the same gap each time: the code arrives faster than the evidence that it is correct, secure and maintainable.
44%
Share of AI code-generation tasks that introduced a security vulnerability in Veracode's 2026 tests, barely changed from 45% in 2025.[2]
−7.2%
Delivery stability for each 25% increase in AI adoption, in DORA's 2024 research. Its 2025 report finds AI speeds teams up but is still linked to less stable delivery.[1]
84% / 46%
Developers who use or plan to use AI tools, and developers who do not trust the accuracy of their output, in Stack Overflow's 2025 survey.[3]
~40 points
Gap between how fast experienced developers felt with AI tools (20% faster) and what was measured (19% slower) in a 2025 controlled study, which its authors now mark as out of date for current tools.[4]
Reported incidents show where the gap leads. An agent deleted an application's production database during a declared code freeze, then said a rollback was impossible; the rollback worked.[5] A scan of 1,645 applications built with one AI app builder found 170 whose data anyone could read, a finding the vendor disputes.[6] In each case the code may have looked finished. What was missing was the practice around it that a professional team takes for granted.
§2 · How it works
The developer keeps working. The model handles the details.
Professional practice usually costs time: writing requirements, testing, reviewing, scanning, documenting. With AI agents, most of that work can be done by the agent itself, if it is told to and if something confirms that it did. VibeQM supplies both.
Work as you do now
Describe what you need, let the agent build it, look at the result. The everyday rhythm of vibe coding stays the same.
The model instructs the agent
Its rules files, templates and prompts tell the agent to work professionally: start from a requirement, ask before guessing, keep changes small, write tests that can fail, scan for secrets and vulnerabilities, and record what it did.
The system enforces what matters
The rules that must never fail are not left to the agent's good behavior. Hooks, checks and permissions refuse a change that breaks them, before it reaches anyone else.
The records build themselves
Requirements, decisions, reviews and the model that wrote each change are kept as part of the work, not written afterwards for an audit.
An assessment shows the result
A self-assessment reads those records, states the level the evidence supports, and lists what is missing, with a prompt the agent can follow to close each gap.
§3 · What it fixes
Common problems of vibe coding, and what the model does about each
| The problem | What the model does |
|---|---|
| Generated code with security flaws or leaked secrets | A security review, secret scanning and a dependency scan before every push |
| Code that runs, but nobody asked for it that way | A written requirement with acceptance criteria first, and questions with options when a request is unclear |
| Tests written by the same agent, agreeing with its own mistakes | Acceptance tests from the requirement, and checks that have been seen to fail |
| Large changes approved after a glance | Small changes, and a peer review of every push or pull request by a person or by a model from another company |
| An agent with access to everything | Limited permissions, no production credentials, and a person for anything that cannot be undone |
| No record of what the AI did, or which model did it | A named human owner, a decision log and a provenance record for every change |
| Each project working a different way | One standard across projects, enforced by the system and audited |
| The same mistake made again and again | Each escaped defect becomes a rule or check that makes it impossible |
§4 · What it gives
Quality that employers and customers can trust, and see
For employers and customers
A level supported by evidence they can open: reviews, checks, decisions and the record of which model wrote what. Trust rests on records, not on assurances.
For teams
One professional way of working across projects and people, with an explicit list of what to improve next and a common vocabulary for it.
For individual developers
Work that meets the standard of a professional team, done with AI, and a way to show it. Level 2 is within reach in an afternoon.
Autonomy follows quality. As a team proves its quality, the model also states how much the AI may do on its own, from drafting under supervision to merging routine changes within measured limits. This is a consequence of the evidence, not the purpose of the model. Anything that cannot be undone always needs a person.
Where to start
See where your repository stands today.
A coding agent runs the assessment in your repository, against the published procedure, and lists what to do next. The book covers each level in depth.
References
Sources
- Google Cloud and DORA, 2024 Accelerate State of DevOps Report, October 2024; 2025 State of AI-assisted Software Development, September 2025. ↩
- Veracode, 2025 GenAI Code Security Report, July 2025 (more than 100 models, 80 tasks, four languages); 2026 GenAI Code Security Report, July 28, 2026. ↩
- Stack Overflow, 2025 Developer Survey, July 2025. ↩
- METR, "Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity", July 2025 (16 developers, 246 tasks). METR's February 2026 update states that the result no longer reflects current tools. ↩
- Jason Lemkin, posts on X, July 17–19, 2025; Amjad Masad (Replit), post on X, July 20, 2025. The data was restored by rollback. ↩
- CVE-2025-48757, published May 2025; Semafor, report on Lovable's security, May 29, 2025. Lovable disputes the CVE. ↩