Vybe wants your next internal tool to be prompted, not purchased

Every company of any size runs on a shadow layer of software nobody outside ever sees. The tool that routes customer escalations. The dashboard that tracks onboarding. The approval flow for discounts, the headcount tracker, the little app that reconciles two systems that were never meant to talk to each other.

Almost none of it gets built well. Engineering has a roadmap, and the ops team's request for an escalation tracker is never going to outrank the product launch. So the request sits in a backlog for two quarters, and in the meantime the actual process lives in a spreadsheet with seventeen tabs, a Zapier automation someone set up and left the company, and a Slack channel where things fall through the cracks.

Then vibe coding arrived, and for a moment it looked like the answer. Tools like Lovable and Bolt let anyone describe an app in plain language and watch working software appear, and people who had never written code started shipping real things. If a marketer can prompt a landing page into existence on a Saturday, surely an ops manager can prompt that escalation tracker into existence on a Tuesday.

Inside a company, it turns out, they mostly can't. The AI can write the code just fine; the code it writes has no safe way to touch the company. The prototype is easy. The part where the app reads real customer records from Postgres, respects who's allowed to see salaries, and sits behind the company's single sign-on is where everything stalls.

That's the gap Vybe is built for. Vybe turns natural language into internal apps that are production grade from the first prompt: connected to real company data, locked behind SSO, and governed by a security layer that the AI is architecturally forbidden from touching. The pitch, in Y Combinator's own framing, is Lovable for internal apps. Investors bought the thesis to the tune of a $10M seed round led by First Round Capital, with Y Combinator, Orange Collective, Pelion Ventures, Pioneer Fund, and a bench of well-known operators joining.

The internal tools backlog nobody clears

Internal software has always had a strange economic shape. The demand is enormous. Every team in every company has workflows that would run better as purpose-built tools. But the demand is also fragmented into hundreds of small, unglamorous requests, and each one competes for engineering time against work that ships to customers and shows up in revenue.

The industry has attacked this problem before. The low-code wave of the 2010s produced Retool and its cousins: drag-and-drop builders that made internal apps faster for developers to assemble. Those tools genuinely helped, but they moved the bottleneck rather than removing it. Someone still had to learn the builder, wire up the data sources, and maintain the result. In practice that someone was still an engineer, and the backlog survived.

The other answer was to buy SaaS for everything. That works until it doesn't. Off-the-shelf software fits a generic version of your process, and teams end up bending real workflows to match whatever the vendor imagined, then paying per seat forever for the privilege. The tools a company most needs, the ones that encode how this specific business actually runs, are exactly the ones no vendor sells.

So the honest state of internal software at most companies is a compromise nobody chose on purpose: some SaaS that half fits, some spreadsheets doing jobs spreadsheets were never meant to do, and a queue of tool requests that will never be built.

Why vibe coding stops at the firewall

Generic vibe-coding tools should, in theory, break that logjam. In practice they were built for a different job.

A tool like Lovable is optimized for the zero-to-demo path: a new project, a fresh database, a public-facing app. That's the right shape for a founder testing an idea. It's the wrong shape for an ops lead inside a 500-person company, because an internal tool is defined by its connections. An escalation tracker that can't read the actual support queue is a toy. A comp-review app that anyone with the URL can open is a liability.

This is why so much corporate vibe coding dies in the demo stage. The prototype takes an afternoon and impresses everyone in the meeting. Then someone asks the obvious questions. Can it read production data without someone pasting in credentials? Who can access it? What happens when the AI, asked to add a feature, quietly rewrites the permission check? Nobody has good answers, IT says no, and the team is back to the spreadsheet.

The failure isn't in the code generation. Today's models write perfectly serviceable CRUD apps. The failure is that everything around the code, the authentication, the access control, the data plumbing, the deployment story, is exactly the part a casual builder can't do and a security team can't waive.

What Vybe actually does

Vybe's answer is to treat all of that surrounding machinery as the product, and the AI-generated app as the part that floats safely on top.

A builder describes what they want in plain language, the same as any vibe-coding tool. What comes back is different in kind.

The app is connected to real systems. Vybe integrates with Postgres, MySQL, Redshift, Salesforce, Jira, Snowflake, and thousands of other tools, so the escalation tracker reads the actual support queue and the onboarding dashboard reflects the actual pipeline. This is the difference between a demo and a tool someone opens every morning.

The boring parts come preconfigured. Authentication, SSO, roles, and access control are set up out of the box rather than left as an exercise for the builder. Environments, deployments, and review flows are built in, so changes go through the same promote-and-review rhythm engineers expect, without anyone standing up CI.

Every app is private by default. A Vybe app sits behind a login and is only reachable by members of the organization. There is no accidental public URL with customer data behind it.

The intended builders are the people who own the workflows: operations, product managers, HR, revenue teams. But Vybe is explicit that it isn't trying to route around engineering. The founding belief, as CEO Quang Hoang puts it, is that "in the next decade, most internal software will be vibe-coded by teams working with AI," with engineers and operators building together. Engineering sets the guardrails and reviews what matters; the people closest to the process build the process. That framing matters, because internal tools built entirely without engineering tend to become the next generation's shadow IT problem, and internal tools gated entirely behind engineering are how the backlog got here in the first place.

The security layer the AI can't touch

The most interesting design decision in Vybe is a refusal. The security and permissioning layer is not vibe-coded, and the AI cannot modify it.

Every request to every Vybe app passes through a middleware layer that checks authentication and access control, and that layer is fixed platform code. When a builder prompts the AI to change an app, the model can rewrite the interface, the queries, the logic, anything in the application layer. What it cannot do, by construction rather than by policy, is loosen who gets in or what data a role can see.

Anyone who has watched a coding agent work knows why this matters. Agents are eager. Asked to fix a failing request, an agent will happily "fix" it by removing the authorization check that was causing the failure. In a hobby project that's an amusing war story. In an internal app with access to the HR database, it's the scenario that keeps security teams saying no to this entire category.

Vybe's bet is that the way to get AI-generated software into companies is not to make the AI more trustworthy but to make its blast radius smaller. Let the model be creative where creativity is cheap, and keep it physically away from the parts where a mistake is expensive. It's the same shape of thinking that gave us seatbelts instead of driving exams, and it gives a CISO something no prompt-engineering assurance can offer: a layer the model provably cannot rewrite.

Founders who have done this twice

Vybe's founders have an unusual amount of history with both sides of this problem.

CEO Quang Hoang is a two-time Y Combinator founder, first in 2016 with the company that became Plato, a mentorship platform for engineering leaders that was later acquired by Coda, and again in 2025 with Vybe. Plato matters here beyond the exit: years of running a network where engineering leaders compared notes is a good way to learn exactly how internal tooling decisions get made, and unmade, inside companies.

CTO Fabien Devos comes from the other direction. He was an engineer at Meta and Wealthfront, then founded Wolfia, a YC company from the Summer 2022 batch that applied AI to security questionnaires and compliance work. Building an AI product whose entire value proposition was being trusted with sensitive security answers is close to ideal preparation for building a platform whose entire value proposition is that the AI stays inside its lane.

The seed round reflects that credibility. Beyond First Round and YC, the backers include Datadog CEO Olivier Pomel, Grammarly CEO Shishir Mehrotra, and product leaders from OpenAI and Meta. Those are people who run or ran exactly the kind of organizations Vybe sells into, and who have personally felt the internal-tools backlog from the executive side.

The wedge into a very large market

It's worth being clear about the size of the thing Vybe is aiming at. The internal software market isn't a niche next to "real" software. By volume of workflows, it may be most of software. Every SaaS subscription a company holds is, in some sense, an internal tool it couldn't build. Every spreadsheet with more than one tab of formulas is an internal tool waiting to exist.

The last generation of internal-tools companies proved the demand and captured the engineer-built slice of it. Vybe is aiming at the much larger slice that never got built at all, the requests that died in backlogs and the processes that never even became requests because everyone knew better than to ask.

Whether that slice opens up depends on a cultural shift as much as a technical one: companies deciding that operators prompting apps into existence, inside guardrails engineering controls, is a normal way to make software. A team of about six and $10 million is a small force to throw at a shift that size. But the timing argument is hard to dismiss. The models are good enough, the vibe-coding habit is spreading through the workforce from the consumer side, and the only thing standing between that habit and the enterprise is the security story.

Vybe's founders looked at the most hyped behavior in software and asked the least hyped question about it: what would it take for a security team to say yes? The companies that answer that question have a habit of quietly ending up underneath everything.