Claude Code vs vibe coding — why structured AI development wins

There's a lot of buzz around vibe coding — the idea that you write a single prompt and get an entire app back. No manual decisions, no file structure to think about. The AI handles everything. It sounds like a dream, and for simple prototypes it can work. But when you're building something that needs to live in production, be secure, and remain maintainable, the model falls apart.

At itrab, we work with Claude Code — Anthropic's CLI tool for AI-assisted development. But we don't prompt entire apps into existence at once. Instead, we guide the process with clear architecture, deliberate technology choices, and step-by-step instructions. The difference in results is enormous.

What is vibe coding?

The term was coined by Andrej Karpathy (formerly OpenAI/Tesla) in February 2025, describing a workflow where you give an AI model a single overarching prompt — for example "Build a SaaS app for invoice management with user login, dashboard, and Stripe payments" — and let the model generate the entire codebase.

The appeal is obvious: you don't need to know how to code. You "vibe" with the AI, accept the code it returns, and deploy. But there's a fundamental problem: you don't understand the code you're running. You don't know what decisions the AI made, what dependencies it pulled in, or what security holes are hiding beneath the surface.

The problem with a single prompt

No thoughtful file structure

When an AI model gets free rein to generate an entire project, it often creates a structure that looks reasonable at first glance — but lacks consistency. Files end up in the wrong places, logic gets mixed with presentation, and there's no clear separation of concerns. The result is spaghetti code that becomes increasingly difficult to modify the longer the project lives. You accumulate technical debt that sooner or later must be paid — with interest.

Wrong technology choices

Ask an AI to build a web app and you'll almost certainly get a project based on React, Next.js, or similar JavaScript frameworks — with hundreds of npm dependencies. For a simple business website or blog, that's like taking a semi-truck to the grocery store. You get a project that's hard to understand, heavy to maintain, and impossible to move without bringing the entire ecosystem along.

Technology choices should be driven by needs, not by what's most popular in the AI's training data.

Hidden code from search engines

JavaScript-heavy frameworks render content on the client side. This means Googlebot — which indexes your site — sees an empty <div id="root"></div> instead of your actual content. Yes, there are solutions like SSR (server-side rendering), but they add additional complexity. With pure server-rendered HTML, content is delivered directly — no extra steps, no hydration issues, no delays.

Security and quality

Vibe-coded output rarely considers security. SQL injection, XSS (cross-site scripting), and lack of CSRF protection are common in AI-generated code that hasn't been given explicit instructions. It's not that the AI can't write secure code — it can — but it doesn't do it automatically unless you ask.

How we use Claude Code — with structure and rules

Our method isn't about avoiding AI — it's about directing the AI. Claude Code lets us define rules, structure, and constraints before we write a single line of code. Here's what the process looks like:

Step 1 — Define file structure and architecture

Before we start coding, we create a CLAUDE.md file in the project root. This file acts as the AI's "rulebook" and is automatically read at every session. Here we define directory structure, naming conventions, and how the project should be organized. The AI follows these rules throughout the entire development process.

Step 2 — Specify platform and language

We choose our tech stack deliberately. For most web projects, that means pure PHP without frameworks, minimal JavaScript, and server-rendered HTML. No React, no Node.js, no hundreds of dependencies. Just code that does what it should — fast, simple, and portable.

Step 3 — Instructions in CLAUDE.md

In the rules file, we specify concrete requirements:

• Prepared statements for all database queries — no SQL injections
• CSRF tokens on all forms
• Content Security Policy headers
• Semantic HTML — the right element for the right purpose
• No external dependencies unless there's a clear reason
• Comments and clear code structure

Claude Code follows these rules consistently throughout the project, producing a codebase that looks like the same developer wrote every line.

Step 4 — Iterative development

Instead of generating everything at once, we build feature by feature. We review each step, test, adjust, and move forward. Claude Code has context from the entire project and builds on previous decisions — but we retain control.

The result — code that actually works

With structured AI development, you get:

• Secure code from the start — prepared statements, escaping, CSRF protection
• Lightning-fast load times — server-rendered HTML without heavy frameworks
• Best practices — semantic HTML, accessibility, SEO optimization
• Zero dependencies — no npm, no packages that can become vulnerable
• Full ownership — you own the code and can move it wherever you want

This isn't theory. The site you're reading right now — itrab.com — is built exactly this way. Pure PHP, no framework overhead, fast and secure.

Vibe coding vs structured AI — a comparison

When does vibe coding make sense?

Fairness demands we acknowledge: vibe coding has its place. It can work well for:

• Quick prototypes — when you want to test an idea without investing time in architecture
• One-off scripts — tools you run once and then discard
• Learning — seeing how AI structures code can provide insights, as long as you don't deploy the result as-is

But for anything that needs to live in production — your business website, your customer portal, your e-commerce platform — you need structure. The AI is the tool, but you must be the architect.