Glossary: vibe coding, agentic coding, RLS, edge function, RAG, agent — in plain English

How the app got built

The terms you'll hear about the tool and the process.

Vibe coding

Building software by describing what you want to an AI coding tool and accepting what it produces, iterating by prompt rather than by reading and writing the code yourself. Fast for a first version; the code is real, and so are its gaps. Why it matters: the gaps cluster in exactly the places a preview never exercises.

Agentic coding

A step beyond vibe coding: the AI plans and carries out multi-step changes across many files on its own — creating files, installing packages, running commands — rather than answering one prompt at a time. Why it matters: more gets done per prompt, and more gets changed that you didn't ask for.

Agent mode

The setting in tools like Cursor that turns on agentic coding. Powerful for big changes; risky because it edits files you didn't mention. Why it matters: always review what it changed before it goes live.

Prototype, MVP, production

A prototype shows the idea. An MVP is the smallest version real users can use. Production means it's safe and reliable for strangers with real data and money — which is a checklist, not a feeling. Why it matters: 'it works' usually means prototype.

Where AI-built apps break

The terms behind 'it works in preview but not live'.

Row-level security (RLS)

Rules inside the database that decide which rows each user can see or change. Without it, any logged-in user can typically read everyone's data. Why it matters: it's the single most common gap in AI-built apps, and it's your users' data.

Anon key vs service-role key

Supabase issues two keys. The anon key is safe in the browser because RLS limits what it can do. The service-role key bypasses RLS entirely and must never leave the server. Why it matters: AI tools sometimes use the service-role key in the browser to make a feature work.

Edge function / serverless function

A small piece of server code that runs on demand without you managing a server. Why it matters: it's where privileged work — calling paid APIs, using secret keys — should live, instead of in the browser.

Environment variable

A setting supplied to the app from outside the code — a database URL, an API key — so the same code can run in development, preview and production with different values. Why it matters: it should live in the host's settings, not in a file in the repo.

Secret / API key

A credential that lets code act on your behalf with a service. Anyone who has it can do what you can do and spend what you can spend. Why it matters: if it was ever in git or in the browser, rotate it.

Migration (database)

A versioned file that records a change to the database's structure. Keeping migrations in the repo means every environment can be built to the same structure. Why it matters: changes made only in a dashboard aren't migrations, and they drift.

Schema drift

When the database's real structure no longer matches what's recorded in the repo. Why it matters: works in one environment, fails in another.

Webhook

A message a service sends to your app when something happens — Stripe telling you a payment succeeded. Your app must receive it, verify it's genuine, and act on it. Why it matters: commonly configured in test mode and never in live mode.

Environment (dev / preview / production)

Separate copies of the app with separate settings and often separate databases, so you can test without touching real users. Why it matters: AI-built apps usually have one.

What production means

The terms behind 'safe to give to strangers'.

CI/CD

Automation that checks every change (type-check, tests) and deploys it if the checks pass. Why it matters: it's what makes the next AI-generated change safe to accept.

Rollback

Returning to the previous working version in one step when a deploy goes wrong. Why it matters: if you can't roll back, every deploy is a bet.

Lockfile

A file that pins the exact versions of every package, so installs are identical everywhere. Why it matters: without it, 'it worked yesterday' is a recurring conversation.

Error boundary

Code that catches a failure in one part of the screen and shows a sensible message instead of a blank page. Why it matters: AI-built apps often have none.

SSR vs SPA

A single-page app (SPA) sends an empty page and builds it in the browser; server-side rendering (SSR) sends the finished page. Why it matters: search engines and AI crawlers read the empty page as empty, and most AI tools ship SPAs.

Monorepo

One repository containing several related packages or apps. Why it matters: AI agents often lose track across packages, leaving refactors half-done.

The AI features and their risks

The terms behind the features themselves.

Large language model (LLM)

The kind of AI model behind ChatGPT, Claude and the coding tools. It predicts text. Why it matters: that's why it can write plausible code that calls functions that don't exist.

Retrieval-augmented generation (RAG)

Giving a model relevant documents from your own data at the moment it answers, so the answer is grounded in your content. Why it matters: it's the standard way to build 'ask questions about our documents', and it needs the same access rules as the documents.

AI agent

A model set up to take actions — call tools, send messages, update records — across several steps. Why it matters: it needs strict limits on what it can touch and a human check before anything irreversible.

Prompt injection

User input that persuades a model to ignore its instructions. Why it matters: it's the one AI-specific risk every founder should understand; the defence is treating the model's output as untrusted and limiting what tools can do.

Rate limiting

Capping how often something can be called. Why it matters: a script can't run up your model bill or brute-force accounts.

Who you might hire

Two terms for the people.

Fractional CTO

A senior technical leader who works with a company for a defined number of days a month, making the architecture, vendor, security and hiring decisions. Why it matters: it's the option between 'no one decides' and a full-time executive.

AI implementation partner

A firm that takes responsibility for an AI system working in production — design, build, integration, deployment and usually operation — as opposed to advising (consultant) or building to a spec (agency). Why it matters: it's the one that's accountable at 2 a.m.

What AI Cubed does about this

We're the implementation partner in that last definition. If the terms above describe your situation — an app built by a tool, breaking in the places a preview never checks — see vibe-coding rescue.