Build ideas
From idea to native app. We take a concept and ship it as real, owned software, with agents doing the heavy lifting and engineers owning every call.
An IT Licious company
Agentic code,
Agentic code,
only good vibes.
We build custom software with agentic coding, on our trusted IT Licious technology stack. Every line an agent writes is audited, hardened and tested before it touches your codebase.
100%
Audited output
0
Lock-in, ever
Native
Custom code you own
Secure · Trusted · Transparent
Auditable output
Secure by default
Native custom code
Built on the IT Licious stack
what we believe
We believe technology should give you peace of mind and control, not take them away.
the problem
Building something fast is not the problem. Getting it safely into production is.
AI builds a working prototype in an evening. The step to software your business actually runs on is where it stalls. Sound familiar?
You don't dare ship it
The prototype works in a demo, but nobody knows if it is safe and reliable under real users and real data.
Nobody understands how it works
The code grows, tangles and turns into a black box. Every change feels like a gamble, and maintenance keeps getting more expensive.
You don't own your own software
Your app, your data and your logins run on someone else's platform. Migrating away is costly, and you are stuck with their pricing and their leaks.
That is exactly where we come in: we turn fast, AI-built software into something secure, maintainable and truly yours.
what we do
Five ways we put agents to work.
Whether you're starting from nothing, sitting on ageing code, or holding a promising prototype, we turn AI speed into software that's safe to run in production.
Upgrade old stuff
Modernise what's holding you back. We refactor and re-platform tired systems into maintainable, documented code your team can keep building on.
Professionalise vibecoded apps
Make the prototype production-ready. Bring us your AI-built app and we harden it: security, tests, structure and a clean handover.
Automate development
Put delivery on autopilot. We wire up agentic pipelines, reviews and checks so shipping stays fast without ever losing control.
Advise on agentic coding
Get more from agents. Practical advisory on where they fit your team, stack and risk appetite. No hype, just what actually works.
Not sure where to start?
Tell us the idea, the system, or the prototype. We'll tell you exactly how agents can help.
Book a call →
why only good vibes
Vibes are the start.
Vibes are the start.
Engineering is the standard.
Native & custom
Real code, not a black box. You own every line, with no vendor lock-in.
Secure by default
Every agent output is audited and hardened before it ever ships.
Maintainable
Documented, tested and handed over clean. Software built to be kept.
On the IT Licious stack
Backed by IT Licious' tech, security and delivery foundations.
vibe check passed
Secrets & credentials✓ clean
Maven & pub CVEs✓ clean
Container image scan✓ clean
Test coverage✓ 92%
IaC & ECS policy✓ clean
License compliance✓ clean
$ ci verify → pipeline green
always on
Security that never sleeps.
New vulnerabilities surface every day, long after your code ships. So we keep watching. We continuously monitor your dependencies and infrastructure for fresh security leaks, then let an agent prepare the upgrade, run it through the pipeline, and only ship once every check is green.
1
Monitor
We track CVE feeds, pub.dev and Maven advisories, container base images and AWS findings around the clock.
2
Detect
The moment a dependency or image is flagged, we pinpoint exactly which service it affects.
3
Auto-upgrade
An agent opens the upgrade, bumps the version and adapts the code wherever the change needs it.
4
Verify & ship
The same GitLab pipeline runs build, tests and security scans. Green merges on its own; red gets a human.
dependency monitor · live
spring-boot 3.3.1 → 3.3.5merged
flutter 3.24 → 3.27merged
aws-sdk-java 2.27 → 2.31in CI
CVE-2025-48795 · jackson-databindpatched
Detected, upgraded and verified automatically.
did you know?
The numbers behind the vibes.
Independent research and documented incidents around AI-generated code, from the companies and institutions that measure it. Every fact links to its source.
56%
AI models write smarter code every year. Their security score hasn't moved.
Veracode · 2026
Veracode tested more than 100 large language models on standardised coding tasks, without any security-specific prompting. On average the generated code passed only 56% of the security checks, barely up from 55% in the first report a year earlier. The best model in the set, GPT-5.5, still failed almost one in three security tasks.
Veracode · 2026 GenAI Code Security Report · 28 July 2026
15%
Only 15% of AI-generated code defends against cross-site scripting.
Veracode · 2026
In Veracode's 2026 benchmark, models handled SQL injection well (83% pass rate) but collapsed on other classics: 15% for cross-site scripting and 12% for log injection. Models marketed specifically for coding scored 51%, no better than general-purpose models at 52%.
Veracode · 2026 GenAI Code Security Report · 28 July 2026
3%
84% of developers use AI tools. Only 3% highly trust what they produce.
Stack Overflow · 2025
In the 2025 Stack Overflow Developer Survey, 84% of respondents use or plan to use AI tools, and 51% of professional developers use them daily. Yet 46% actively distrust the accuracy of the output, against 33% who trust it, and only 3% report high trust. The most cited frustration, by 66%: AI solutions that are almost right, but not quite.
Stack Overflow · 2025 Developer Survey · July 2025
1 in 8
Only about one in eight professional developers says vibe coding is part of their job.
Stack Overflow · 2025
Stack Overflow asked more than 26,000 developers whether vibe coding, generating software from prompts, is part of their professional work. Just 12% said yes; 77% said no. AI assistance is everywhere, but building without reading the code is still the exception among professionals.
Stack Overflow · 2025 Developer Survey · July 2025
19%
Experienced developers were 19% slower with AI, yet believed they were 20% faster.
METR · 2025
METR ran a randomised controlled trial with 16 experienced open-source developers on 246 real tasks in their own repositories. With AI tools allowed, tasks took 19% longer. Before the study the developers expected a 24% speed-up; afterwards they still estimated AI had made them 20% faster.
METR · Measuring the impact of early-2025 AI on experienced open-source developer productivity · 10 July 2025
30–50%
METR could not repeat its study: developers refused to work without AI.
METR · 2026
When METR tried to rerun its productivity experiment in late 2025, 30 to 50% of developers said they were skipping tasks because they did not want to do them without AI. The new cohort measured a statistically insignificant 4% slowdown. METR concluded the sample is now too biased to measure the true effect, and is redesigning the study.
METR · We are changing our developer productivity experiment design · 24 February 2026
−70%
Refactoring is down 70% since 2023. Duplicated code is up 81%.
GitClear · 2026
GitClear analysed 623 million code changes from 2023 to 2026. Moved or refactored code fell from 21% of changes in 2022 to under 4%, while duplicated blocks rose 81% to the highest level on record. Developers are now about five times more likely to copy and paste than to refactor, and error-masking constructs such as empty catch blocks rose 47%.
GitClear · The Maintainability Gap: 2026 AI Code Quality Research · 2026
90%
AI doesn't fix a team. It amplifies what's already there.
Google DORA · 2025
Google's 2025 DORA report, based on nearly 5,000 technology professionals, found that 90% now use AI at work and that adoption is linked to higher delivery throughput. It is also linked to lower delivery stability. Without strong automated testing, mature version control and fast feedback loops, more change simply means more instability.
Google Cloud · 2025 DORA Report: State of AI-assisted Software Development · 23 September 2025
35
35 CVEs traced to AI-written code in a single month.
Georgia Tech · 2026
Georgia Tech's Vibe Security Radar scanned more than 43,000 security advisories and traced each fix back through Git history to find vulnerabilities introduced by AI coding tools. It confirmed 74 cases: 6 in January 2026, 15 in February and 35 in March. The researchers estimate the real number is five to ten times higher. Their warning: millions of developers using the same models means the same bugs showing up across different projects.
Georgia Tech · Bad Vibes: AI-generated code is vulnerable, researchers warn · 13 April 2026
1.5M
A vibe-coded social network exposed 1.5 million API keys within days of launch.
Wiz · 2026
Moltbook, a social network for AI agents whose founder built it without writing code, shipped with a Supabase key in its client-side JavaScript and no row-level security. Wiz researchers found full read and write access to the entire database: 1.5 million API keys, 35,000 email addresses and private messages. The fix took about three hours once reported.
Wiz · Hacking Moltbook: exposed database reveals 1.5M API keys · February 2026
11 weeks
For eleven weeks, any Lovable user could read the source code and AI chats of public projects.
Lovable · 2026
Lovable's own postmortem describes a backend regression that, from 3 February to 20 April 2026, let any logged-in user with a project link access the source code and chat history of public projects. The fix shipped within two hours of the public report, and all public projects were switched to private. Prototypes built on a platform inherit that platform's incidents.
Lovable · Our response to the April 2026 incident · 22 April 2026
2025
'Vibe coding' was Collins Dictionary's Word of the Year 2025.
Collins Dictionary · 2025
Andrej Karpathy coined the term in February 2025. Nine months later Collins named it Word of the Year, defined as using AI prompted by natural language to write computer code. Few tech terms have gone from a tweet to the dictionary that fast.
Collins Dictionary · Word of the Year 2025 · 6 November 2025
80–90%
The first cyber-espionage campaign run mostly by an AI agent.
Anthropic · 2025
In September 2025 Anthropic detected a state-sponsored group using Claude Code to attack around thirty organisations, including large tech companies, banks and government agencies. The AI performed an estimated 80 to 90% of the campaign on its own, with humans stepping in at only a handful of decision points. A few intrusions succeeded. The same agentic tools that build software now also attack it.
Anthropic · Disrupting the first reported AI-orchestrated cyber espionage campaign · 13 November 2025
2,349
The first malware that asked your own AI coding agents to steal your secrets.
GitGuardian · 2025
On 26 August 2025 malicious versions of the Nx build tool were published to npm. The payload looked for Claude Code, Gemini CLI and Amazon Q on the machine and prompted them to hunt for credentials. GitGuardian counted 2,349 distinct secrets from 1,079 repositories dumped to public GitHub, more than 1,100 still valid. Notably, many AI agents refused the request.
GitGuardian · The Nx “s1ngularity” attack: inside the credential leak · September 2025
10×
AI-assisted developers ship 3 to 4 times more code, and 10 times more security findings.
Apiiro · 2025
Apiiro analysed tens of thousands of repositories at Fortune 50 enterprises. Between December 2024 and June 2025, developers using AI assistants committed code three to four times faster, while monthly security findings rose from about 1,000 to more than 10,000. Syntax errors dropped 76%, but privilege-escalation paths rose 322% and architectural flaws 153%.
Apiiro · 4x Velocity, 10x Vulnerabilities: AI Coding Assistants Are Shipping More Risks · September 2025
1,200+
An AI agent deleted a production database during a code freeze.
Fortune · 2025
In July 2025 Replit's coding agent wiped the live database of a SaaStr project, despite explicit instructions not to make changes, destroying records of more than 1,200 executives and nearly 1,200 companies. It then wrongly claimed a rollback was impossible. Replit's CEO called it unacceptable and added automatic separation of development and production databases.
Fortune · AI-powered coding tool wiped out a software company's database in 'catastrophic failure' · 23 July 2025
25%
A quarter of Y Combinator's winter 2025 startups had codebases that were 95% AI-generated.
TechCrunch · 2025
YC managing partner Jared Friedman said that for 25% of the Winter 2025 batch, 95% or more of the codebase was written by AI, not counting library imports. These were highly technical founders who could have built everything themselves a year earlier. Speed is no longer the differentiator; what you do after the prototype is.
TechCrunch · A quarter of startups in YC's current cohort have codebases that are almost entirely AI-generated · 6 March 2025
380,000
380,000 vibe-coded apps sat publicly on the web. About 5,000 leaked sensitive data.
Axios · 2026
Security firm RedAccess found roughly 380,000 publicly reachable apps built with tools such as Lovable, Base44, Replit and Netlify, many indexed by Google. About 5,000 exposed corporate or personal data, from medical records and clinical-trial status to a bank's internal financials. Axios verified several of them. Some platforms made apps public by default unless the builder changed the setting.
Axios · Thousands of AI-built apps exposed sensitive corporate and personal data, researchers found · 7 May 2026
Three of 18 facts, picked at random on every visit.
how we work
Agent speed. Human judgement. Clean handover.
01
Map
We learn your idea or system and find where agents actually earn their keep.
02
Build
Agents write, engineers review. Every change is intentional and traceable.
03
Harden
Security, tests and docs. The checks that have to pass, pass. Every time.
04
Hand over
You get clean, owned code and the keys. No lock-in, no black boxes.
Thinking about agentic coding for your team?
Start with a readiness session. We'll map where agents fit your stack, your risk and your roadmap.
cases
Built with agents. Shipped by engineers.
Three recent projects the IT Licious team built with agentic coding: agents wrote the code, our engineers reviewed, hardened and shipped it.
Mobile app · Flutter · iOS & Android
Koukki app
Event planners and festival leaders carry the full crew planning onto the site: events, positions on the map, staff and documents. Built on the existing Java backend of the Koukki platform, with one Flutter codebase for iOS and Android.
Extends an existing platform
Map-based planning
One codebase, two stores
Web app · Flutter · NL/FR
BASF Schemapatat
A web application that checks potato spray schedules against the FRAC rules automatically: green or red at a glance, with the correction spelled out. Expert knowledge turned into logic that is right every time, bilingual and usable in the field.
Expertise as software
Rules engine, zero interpretation
Web, desktop & mobile
Web app · mobile & desktop · HR
Medway
Medway, the rail freight division of MSC, needed its train drivers to log their hours without friction and HR to follow up faster. We built a custom time-registration system: drivers start a registration or add one manually, on their phone or desktop; HR gets monthly reports with night, weekend and holiday hours, leave and rest days, ready to export.
Custom time registration
Night, weekend & holiday hours
Monthly reports for HR
who we are
A spin-off of IT Licious.
Only Good Vibes is the agentic development studio inside IT Licious, based in Sint-Truiden in Limburg, Belgium, and working for clients across Flanders and beyond. Same engineers, same security standards, same stack. Now building at agent speed.
We pair the optimism of AI-assisted development with the discipline that makes software safe to run in production. Vibecoding gets you to a demo fast; we get you to something you can trust.
Agentic dev · security
Secure · Trusted · Transparent
Let's build something you can trust.
Tell us your idea, your legacy system, or your prototype that needs to grow up. We'll come back with a plan, and good vibes.
Prefer to talk? Call +32 11 360 950