The safe workflow
Vibe coding is most useful when it compresses implementation work without removing ownership or verification. The workflow below treats the AI tool as a production participant, not as the owner of scope, evidence, or release approval.
1. Define the job
Write the audience, primary task, required pages, content owner, non-goals, and measurable acceptance criteria before prompting a builder.
2. Preserve ownership
Start from a repository you control. Record dependencies, generated assets, environment variables, external services, and what cannot be exported.
3. Build one vertical slice
Complete one real path from navigation to content or data before multiplying pages. This exposes design, state, and deployment assumptions early.
4. Review the diff
Inspect every changed file, unexpected dependency, permission, network call, generated claim, and hidden platform coupling.
5. Run acceptance checks
Test functionality, keyboard use, responsive layouts, metadata, crawl controls, security basics, build output, and failure states.
6. Deploy from source
Use the Git-connected production pipeline. Match the deployed build to the exact repository commit instead of treating a push as proof of release.
7. Attach the domain
Verify DNS, certificate issuance, canonical host behavior, robots.txt, sitemap URLs, social metadata, and every critical route on the custom domain.
8. Keep a recovery path
Retain the prior production version, rollback instructions, backups, ownership records, and the evidence needed to reproduce the release.
Minimum release gate
Behavior
Primary tasks pass on the production build, including empty, error, loading, and recovery states.
Access
Keyboard order, labels, focus, contrast, zoom, mobile layouts, and reduced motion are checked.
Ownership
Repository, domain, accounts, data, secrets, analytics, billing, and rollback owners are named.
Discovery
Canonical host, title, description, social image, robots, sitemap, redirects, and 404 behavior are verified.
Security
Sensitive data, permissions, authentication, authorization, dependencies, headers, and public files are reviewed.
Evidence
Commit SHA, build ID, active deployment, checked URLs, failures, and unresolved unknowns are recorded.
What “done” means
A polished preview is an intermediate artifact. The website is ready only when another operator can find the source, reproduce the build, verify the live behavior, understand the unknowns, and recover from the next failed change.