Vibe Coding a Solo Company: Choose the Stack, Protect the Basics

Decision summary

Vibe Coding is easy to mistake for a new programming language or a complete stack. It is a way of building and organizing work: people define the product boundary, acceptance criteria, and risk limits; AI retrieves context, drafts implementations, runs commands, edits code, and helps test the result. Andrej Karpathy popularized the term in early 2025. GitHub, Microsoft, OpenAI, Anthropic, and other vendors have since added multi-file editing, terminal execution, code review, and agent collaboration to production tools. GitHub’s own guidance still puts testing, security review, and human supervision between generated code and a production system.^{6, 10, 11, 12}

A solo founder benefits from low fixed costs, a support load they can manage, decisions they can audit, and vendors they can replace. AI can draft a back-office system quickly; the founder still has to decide:^{1, 11}

Use these rules when you choose the stack:^{1, 11}

First, start with a managed modular monolith. For most solo companies, TypeScript, Node.js, PostgreSQL, Docker, managed hosting, and managed authentication form a legible, portable baseline. Split high-concurrency services into Go when measurements justify it. Reserve Rust for performance, security, local clients, and system components where its guarantees pay for the extra review cost. Technical novelty is not a reason to make Rust the default language for an uncertain SaaS MVP.^{2, 3, 4, 5}

Second, spend first on controls that reduce irreversible risk. Authentication, database recovery, logs, error tracking, contracts, bookkeeping, and dependency security usually matter more than a second AI editor or a larger token allowance.^{8, 11, 12}

Third, do not buy overlapping collaboration systems. Notion, Feishu, Linear, Jira, Slack, and Teams each cover part of project work. A solo company wastes more money and attention by scattering the same record across four products than by choosing a slightly more expensive primary tool.^{1, 11}

Fourth, keep AI permissions inside the rollback boundary. An agent may create a branch, open a pull request, run tests, and deploy a preview. It should not receive production database write access, domain control, refund authority, or production secrets by default.^{7, 8, 9, 11}

Fifth, choose the legal entity and payment route together. Jurisdiction, company type, budget, and team size are not interchangeable details. In mainland China, a sole proprietorship and a one-person limited liability company carry different liability and governance duties. Current company law also requires shareholders in a limited liability company to pay subscribed capital within the applicable five-year period. A payment tutorial cannot choose that structure for you.^{9, 13, 14}

Excluding wages, taxes, payment fees and large model API usage, this article estimates:⁹

The RMB conversion uses the internal planning assumption 1 USD≈7.2 RMB, which is not a real-time exchange rate; the price snapshot is as of August 2, 2026**, and the actual bill will also be affected by usage, region, taxes, annual payments and vendor price changes.^{1, 11}

Problem and comparison

For a solo company, Vibe Coding can reduce the minimum team needed to ship software. One person can switch between product, design, engineering, testing, and operations, but that person still owns the final decision and the risk.^{1, 11}

Traditional development spends most on people and coordination. With Vibe Coding, watch these constraints instead:^{1, 11}

This guide compares tools by these dimensions:^{1, 11}

Total cost of ownership. Include subscription price, configuration, upgrades, exports, training, compliance, and troubleshooting time.^{1, 11}

Reversibility. Can you export code, databases, logs, clients, and documents; can you change vendors; can you rely on private runtimes.⁸

AI understandability. Is there stable documentation, type definitions, CLI, API, declarative configuration and common community paradigms. The clearer the structure, the less likely agents are to make mistakes in hidden conventions.^{1, 11}

Operating burden. Whether one person can maintain it; whether automatic backups, rollbacks, managed upgrades and security patches are provided.^{8, 11, 12}

Regional and compliance adaptation. Whether company country, customer region, invoicing, data processing agreement and cross-border data requirements are supported.^{13, 14}

Fee predictability. Is it a fixed seat fee, per request, per host, per log, per monthly active user, or based on transaction volume?^{1, 11}

Integration difficulty. “Low”, “medium”, and “high” describe the work from an out-of-the-box connection to a custom sync service. They do not rate product quality.^{1, 11}

Vibe Coding is a development method. Node.js, Deno, Go, and Rust are runtimes or languages. Compare them as the foundation for AI-assisted development, not as competing products..^{2, 3, 4, 5}

Technology stack, applicable scenarios and organizational structure

Vibe Coding fits best when you can describe the requirements, verify the result automatically, host the infrastructure, and contain the impact of errors, such as internal tools, vertical SaaS, content processing tools, data dashboards, marketing websites, lightweight APIs, browser extensions, desktop assistance tools, and automation products for niche workflows.^{1, 11}

Keep experienced professionals responsible for fund clearing, medical diagnostics, security control systems, core cryptography, complex embedded systems, and legacy systems without testing standards. These areas carry high error costs and hidden constraints; the people who understand the domain must design and verify the system. GitHub’s official description of Vibe Coding also lists testing, security, and human supervision as necessary for production use.^{6, 10, 11, 12}

Technology stack comparison

Node.js is officially defined as an asynchronous, event-driven JavaScript runtime and states that the event loop supports non-blocking I/O; Express is positioned as a minimal, flexible web framework. Deno adopts an explicit permission model by default. Programs cannot access the network, file system or environment variables without authorization. It also has built-in TypeScript, formatting, Lint and testing capabilities. Go's official documentation refers to goroutines and channels as its concurrency foundation. Rust's ownership mechanism enables it to provide memory safety guarantees without the need for a garbage collector, and Cargo is responsible for dependencies, construction, and release.^{2, 3, 4, 5}

The practical test in this guide is simple: For most first-time entrepreneurs, choose technology you can sell, maintain, and hand over. If the founder already knows Go or Rust well, continuing with a familiar language makes sense. Writing the core product in Rust only because AI can generate Rust uses compiler strictness to hide uncertainty about the product.^{4, 5}

Organizational structure suitable for solo companies

A solo company can outsource low-frequency specialist work while keeping decision rights and final accountability in-house.^{1, 11}

Treat “AI is my team” as a planning metaphor, not an operating fact. AI has no legal liability, no SLA, and no way to take over bank accounts, domains, or tax accounts if the founder becomes unavailable. At least one emergency contact should be configured, and documentation for account recovery, key escrow, code attribution, and business continuity should be established.^{13, 14, 11, 12}

Legal, Finance and Tax Pathways

Legal jurisdiction, company type, budget and team size are "unspecified" and the following is not case-by-case legal or tax advice.^{13, 14}

The Chinese government has publicly stated that a one-person limited company has the status of a legal person, and shareholders are in principle liable to the extent of their subscribed capital contributions; a sole proprietorship is an unincorporated organization, and investors bear unlimited liability for debts. The current Company Law will come into effect on July 1, 2024, and stipulates that capital contributions subscribed by shareholders of a limited liability company should generally be paid in full within five years from the company's incorporation date. The registration of market entities also involves matters such as name, domicile, business scope, legal representative, and beneficial owner.^{13, 14}

China's tax incentives for small and low-profit enterprises and value-added tax incentives for small-scale taxpayers have applicable conditions and time limits. For example, official policies provide preferential corporate income tax to small and low-profit enterprises that meet the conditions of taxable income, number of employees, and total assets; some taxable transactions of small-scale taxpayers that are subject to the 3% tax rate from 2026 to 2027 can be taxed at a reduced rate of 1%. The specifics still need to be judged based on the business, invoicing, and tax period.^{13, 14}

The international part cannot be summed up in one sentence: "Chinese company plus Stripe" or "U.S. LLC". Taking the United States as an example, the SBA clarifies that a sole proprietorship is simple to set up, but the operator is generally personally liable; the liability, tax and registration requirements for entities such as LLCs depend on state law. An EIN can be applied for free directly from the IRS, but obtaining an EIN does not automatically solve bank account opening, state tax, sales tax, personal tax residency or overseas filing issues.^{9, 13, 14}

Whatever form it takes, it should be established from day one:^{1, 11}

Software options and how to choose

The prices below are public starting prices or representative packages as of August 2, 2026. Free tiers typically have limits on seats, history, build minutes, storage, traffic, monthly active users, or commercial use.⁷

Code editors and IDEs

Cursor, GitHub Copilot, and JetBrains AI all offer individual or team AI programming options, but their billing, model credits, and team governance will change and should be rechecked before purchasing. VS Code itself is free and open source, and supports multi-file tasks through chat and agent extensions.^{6, 10}

Version control and code hosting

GitHub, GitLab, and Bitbucket all offer free starter plans; GitLab's free tier includes a set number of compute minutes, and Bitbucket's free tier is open to up to five users.^{6, 10}

Instant collaboration and office work

Feishu provides free basic tier and enterprise plans; both Slack Pro and Teams Essentials are charged per seat, and the Microsoft 365 package can also include business email and Office services.^{1, 11}

A solo company usually needs one daily workspace. Chinese teams can choose Feishu, international development teams Slack, and teams already deep in Office Teams. Keep chat, tasks, and formal documents in a clear primary home instead of splitting them across three platforms.^{13, 14}

Project management

The free tiers of Linear, Jira, and Notion are enough to cover most early-stage teams; paying primarily buys access, automation, history, and advanced analytics.^{11, 12}

A solo company does not need to simulate a large enterprise. It is recommended to keep only four categories of status: Inbox → Planned → In Progress → Done. Issues that have not been scheduled for more than two weeks are either removed or returned to customer evidence rather than continuing to pile up.^{1, 11}

Continuous integration and continuous delivery

GitHub Actions is free for public repositories and offers private repository minutes for different plans; the GitLab free tier includes certain computing quotas; the CircleCI free tier provides limited users and build credits.^{6, 10}

For solo companies, the primary goal of CI is not to “automatically deploy everything” but to ensure that AI-generated code cannot be bypassed:⁷

Format → Static Checking → Type Checking → Unit Testing → Integration Testing → Build → Security Scanning → Preview Deployment^{7, 11, 12}

Containerization and deployment platform

Docker is better suited as a portable build boundary than a standalone deployment platform. Docker Personal is free to use; Docker Desktop is generally free for small businesses that meet employee and revenue requirements, but commercial organizations that exceed licensing requirements require a subscription.⁷

Vercel Pro, Cloudflare Workers, and Railway all combine a base subscription with usage or resource fees. Treat a free tier as a test budget, not as a permanent production cost.⁷

Monitoring, error tracking and logging

Sentry, Grafana Cloud, and Datadog all offer free or entry plans, but billing may be for events, logs, metrics, hosts, and functional modules respectively.^{1, 11}

In production, logs must answer four questions: which version failed, who is affected, when the failure started, and how to roll back.^{1, 11}

Databases and ORMs

The public starting price of Supabase Pro is about $25/month; Neon provides free tiers and billing based on computing resources; Prisma provides free and paid data services, and Drizzle ORM is an open source tool.⁸

No matter which one you choose, the database should maintain three boundaries: the business schema uses standard SQL; the migration files enter the code warehouse; backup and export do not rely on a single console button.⁸

Authentication and security

Clerk, Auth0, and Supabase Auth all offer free starting quotas, with payment typically centered around monthly active users, enterprise login, MFA, and advanced organizational features.⁸

Authentication does not start with password hashes and email verification on your own. Even with managed authentication, authorization is still responsible: who the user is and what the user has access to are two different questions.^{1, 11}

Payment and Subscription Billing

Stripe Billing, Paddle, and Lemon Squeezy all post transaction or billing commissions. Stripe's merchant availability is determined by country and region; as of the date of this article, its global list of supported merchant regions should not be misinterpreted as indicating that businesses in mainland China can directly open a full Stripe merchant account.^{9, 13, 14}

For the mainland China market, it should be designed in conjunction with banks, licensed payment service providers, WeChat Pay or Alipay merchant plans, and invoice requirements. Don’t let AI create false registration, address or tax information for a company based on an overseas tutorial.^{9, 13, 14}

Customer support

Crisp, Intercom and Zendesk all provide different levels of customer service solutions. Intercom's AI customer service may be billed based on successful results, while Zendesk prefers traditional work orders and multi-channel support.^{1, 11}

Early stage founders shouldn’t fully automate customer conversations too soon. Customer service is the cheapest channel for product research. AI can be used to categorize, summarize, and draft responses, but refunds, privacy, security, and contract issues require human confirmation.^{11, 12}

Documentation and knowledge base

Docusaurus is an open source static document generator; Notion provides documentation and collaboration on a per-seat basis; GitBook Premium is billed on a site and user combination.^{1, 11}

Keep two document homes: the docs/ repository for architecture, interfaces, and runbooks; the collaboration platform for sales, operations, and meeting notes. Keep production-recovery steps out of chat history.^{1, 11}

Contracts, electronic signatures and invoices

eShanbao publicly displays packages and API billing based on contract shares; Zoho Invoice provides a free plan; PandaDoc adopts a subscription and quota model.^{1, 11}

Electronic signatures for contracts are not the same tool as tax invoices. In China, electronic signatures and data messages used in accordance with legal agreements cannot be denied legal validity simply because they are in electronic form, but "reliable electronic signatures", identity authentication, integrity and retrieval still need to meet legal conditions.^{13, 14}

Costs and recommended setups

Cost model

The following table does not include founder salaries, employee salaries, accounting and legal fees, company registration, trademarks, taxes, payment fees, SMS, emails, large model APIs and large-scale traffic.^{7, 9}

Sense of scale:^{1, 11}

Low budget ¥003,000–¥01,200/month ██
Medium budget ¥01,500 – ¥06,000/month ███████
High budget ¥0.8 million – ¥4.0 million/month ████████████████████

Usage charges are more likely to get out of control than seat subscriptions. Watch these four types:^{1, 11}

Set a budget alert on every platform. Track monthly bills and the cost of each unit of work:^{1, 11}

Infrastructure cost per customer
= Cloud resources of the month + model call + email SMS + payment of variable fees
  ÷ Number of paying customers in the current month

Contribute gross profit
= actual income
  - Payment fee
  - Variable costs of models and cloud resources
  - Direct customer service costs

Recommended combination: Extremely low-budget verification stack

Applicable to: one person, payment requirements have not been verified, users are less than a few hundred, short-term manual operation is allowed.^{1, 11}

The principle of this stack is "don't prepay the future". The free tier is available for validation, but commercial-ready plans, automated backups and support capabilities should be purchased as soon as the product generates steady revenue.⁸

Recommended combination: Balanced business stack

Applicable to: One to three people, with existing income, requiring stable publishing, subscription billing and basic auditing.^{1, 11}

This combination works when each product has a defined place: an issue enters the project system, code passes review, the build reaches preview, errors reach Sentry, customer feedback reaches support, and the next issue is recorded.^{1, 11}

Recommended combination: Extension and compliance stack

Suitable for: three to eight people, B2B customers, multiple environments, higher unit price per customer, or enterprise identity integration is required.^{1, 11}

Automation architecture

flowchart LR
    A[Customer interviews and support requests] --> B[Notion/Linear/Jira]
    B --> C[Description of requirements and acceptance criteria]
    C --> D[AI IDE / Coding Agent]
    D --> E[Short-term branch and Pull Request]
    E --> F[Lint/Typecheck/Tests]
    F --> G[Dependency and key scanning]
    G --> H[preview environment]
    H --> I{manual acceptance}
    I -->|PASS| J[PRODUCTION RELEASE]
    I -->|Return| D
    J --> K[Sentry / Grafana / Datadog]
    K --> L[Error, performance, cost alarm]
    L --> B
    J --> M[Payment, customer service and product analysis]
    M --> A

The correct boundaries for automation are:^{1, 11}

GitHub Secret Scanning can check Git history for hard-coded keys, Dependabot can identify dependencies with known vulnerabilities and create pull requests for security updates; the master branch should require status checks to pass before merging.^{6, 10, 11, 12}

Six-week rollout and operating basics

Six-week implementation timeline

The following takes the launch on August 3, 2026 as an example. The time required for company registration is determined by the specific region and materials. Technical work can be done in parallel with registration, but legal subject information should be used for formal signing, invoicing and payment collection.⁹

gantt
    title Vibe Coding Personal Company Six-Week Implementation Plan
    dateFormat YYYY-MM-DD
    axisFormat %m-%d

    section Company and Operations
    Determine jurisdiction, subjects and responsibility boundaries: a1, 2026-08-03, 7d
    Banking, accounting, contract and invoice process: a2, after a1, 14d
    Privacy Policy, Terms of Service and Vendor List:a3, 2026-08-17, 14d

    section engineering basics
    Warehouse, permissions, branch protection: b1, 2026-08-03, 5d
    CI, test, key scan: b2, after b1, 7d
    Preview, test and production environments: b3, after b2, 7d

    section products
    Customer interviews and scope freeze: c1, 2026-08-03, 7d
    Core MVP:c2, 2026-08-10, 14d
    Authentication, Payment and Customer Support :c3, 2026-08-24, 10d

    section online
    Backup and recovery drill:d1, 2026-08-31, 3d
    Safety and Compliance Inspection:d2, 2026-09-01, 4d
    Small-scale paid release: d3, 2026-09-05, 3d
    Review and next stage roadmap: d4, after d3, 3d

Turn prompts into project contracts

The quality of Vibe Coding depends on the stability of the context. Instead of temporarily telling AI to "write professionally" every time, it is better to place AGENTS.md, CLAUDE.md or similar rule files in the root directory of the warehouse:^{1, 11}

# Product and engineering contract

## Product boundary
- This is a multi-tenant B2B SaaS.
- Every business row must include `tenant_id`.
- A user must never read or mutate another tenant's data.
- Billing status is authoritative only from verified payment webhooks.

## Change protocol
1. Explain the proposed change before editing.
2. List affected files, migrations, APIs, permissions and rollback steps.
3. Do not add a dependency until checking whether the standard library
   or an existing package already solves the problem.
4. Never read `.env`, production logs or customer exports.
5. Do not weaken tests, TypeScript strictness or authorization checks
   merely to make CI pass.

## Definition of done
- Formatting, lint, typecheck and tests pass.
- New behavior has at least one automated test.
- Database changes are backward compatible during deployment.
- User-facing changes update documentation.
- Security-sensitive changes require human review.

An effective task prompt should contain five parts:^{1, 11}

Background:
Customers cannot download historical invoices from the canceled subscription page.

Goal:
Allow accounts that have been canceled but are still within the data retention period to view and download existing invoices.

Constraints:
Subscriptions must not be restored; new invoices must not be created; tenant_id must be verified;
Invoice addresses or tax numbers must not be output in the log.

Acceptance criteria:
Four types of tests are given: normal, ultra vires, expired account and payment provider timeout.

Non-target:
This task does not modify the refund logic, prices, or reconstruct the entire Billing module.

Dockerfile example

# syntax=docker/dockerfile:1

FROM node:24-alpine AS dependencies
WORKDIR /app
RUN corepack enable
COPY package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile

FROM node:24-alpine AS builder
WORKDIR /app
RUN corepack enable
COPY --from=dependencies /app/node_modules ./node_modules
COPY . .
RUN pnpm run lint \
    && pnpm run typecheck \
    && pnpm run test \
    && pnpm run build

FROM node:24-alpine AS runtime
WORKDIR /app
ENV NODE_ENV=production

RUN addgroup -S app && adduser -S app -G app

COPY --from=builder --chown=app:app /app/dist ./dist
COPY --from=builder --chown=app:app /app/package.json ./
COPY --from=builder --chown=app:app /app/node_modules ./node_modules

USER app
EXPOSE 3000
CMD ["node", "dist/server.js"]

This example isolates the development process through a multi-stage build and runs as a non-root user. Real projects should also pin base image digests, generate SBOMs, scan images, and remove unnecessary production dependencies. SLSA organizes construction sources, product integrity, and supply chain controls into a framework for step-by-step improvement; NIST SSDF recommends integrating security development practices directly into the software life cycle, rather than doing a single inspection before going online.^{11, 12}

GitHub Actions Example

name: ci

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm

      - name: Enable pnpm
        run: corepack enable

      - name: Install locked dependencies
        run: pnpm install --frozen-lockfile

      - name: Format check
        run: pnpm run format:check

      - name: Lint
        run: pnpm run lint

      - name: Typecheck
        run: pnpm run typecheck

      - name: Test
        run: pnpm run test:ci

      - name: Build
        run: pnpm run build

      - name: Build container
        run: docker build --tag app:${{ github.sha }} .

The production environment should further:^{1, 11}

Deployment and operation baseline

OWASP Top 10:2025 regards web application security risks as a basic cognitive framework for developers, and lists software supply chain failure as an important risk category. For Vibe Coding, this is especially important because AI tends to quickly add dependencies, copy sample configurations, and call third-party services.^{11, 12}

Migration and expansion strategies

Don’t build Kubernetes at the zero-user stage because “there may be a million users in the future”. A more reasonable expansion path is as follows:^{1, 11}

Three questions must be answered for every migration:^{1, 11}

Cases, risks, and next steps

Case: One Person China B2B Reporting Tool

This is a case of reasonable assumptions.^{1, 11}

The founder has a background in data engineering and sells automation industry reports to small and medium-sized enterprises in China. The product requires uploading tables, generating charts and exporting PDFs, and initially had less than fifty monthly customers.^{13, 14}

If the first version adopts Cursor, Next.js, Supabase, Vercel, Stripe and Intercom, it looks technically complete, but there are two problems: Stripe merchant registration location may not necessarily be suitable for mainland Chinese entities, and Vercel and domestic access, filing and data deployment requirements also need to be verified based on actual business. A more reasonable combination is:^{7, 8, 9, 13}

Organizationally, the founder is responsible for product, development and sales, accounting and tax reporting are outsourced to local professional institutions, and contract templates are designed once by lawyers and reviewed regularly.^{1, 11}

In the first month, this company should spend on company setup and contracts, database backups, permission isolation, reliable PDF generation, and customer-data protection before buying Jira, Datadog, Zendesk, or Kubernetes.^{8, 11, 12}

If an application provides generative artificial intelligence services to the public in China, it also needs to determine whether the "Interim Measures for the Management of Generative Artificial Intelligence Services", model filing or application registration, and generated synthetic content identification requirements are applicable. This measure is mainly aimed at providing content-generating services to the public in China; situations that are only developed or applied within the organization and not provided to the public do not fall within the same scope of application. The Identification Method for Generating Synthetic Content published in 2025 also specifies explicit and implicit identification requirements for applicable services.^{13, 14, 15}

Case: Four People International Micro SaaS

This is the second reasonable hypothetical case.^{1, 11}

The team consists of a founder, a product engineer, a design and growth person, and a part-time customer success person selling workflow software to North America and Europe.¹⁶

Recommended combination:^{1, 11}

The first phase remains a modular monolith. The service will be split only when any of the following conditions are met:^{1, 11}

If processing EU personal data, teams should identify themselves as data controllers or processors and establish appropriate data processing agreements with infrastructure, customer service, analytics and AI vendors. When personal data is transferred out of the European Economic Area, cross-border mechanisms such as adequacy decisions and standard contractual clauses will also be assessed.¹⁶

Key risks and controls

When personal information is processed in China, the Personal Information Protection Law applies to domestic personal information processing activities, and under certain circumstances has extraterritorial application to overseas activities processing natural person information in China. Businesses need to clarify the purposes of processing, lawful basis, sensitive personal information, individual rights, cross-border provision and processor obligations. The Personal Information Protection Compliance Audit Management Measures, which will take effect in 2025, further stipulate compliance audit requirements.^{13, 14}

Providing Internet information services in China also requires ICP filing or value-added telecommunications business licensing requirements based on server deployment, service nature and business model; the Ministry of Industry and Information Technology provides an official filing and licensing system.^{7, 13, 14}

What to do next

Vibe Coding gives one person much of the implementation capacity of a small engineering team. It does not remove the work of running a company. Faster prototyping can also move bad code, weak contracts, the wrong tax structure, and unsafe data flows into production faster.^{7, 13, 14}

Choose software that creates one continuous, inspectable production chain. Do not maximize ratings in every category; protect the controls the business cannot replace.^{1, 11}

customer evidence
→ Clarify needs
→ AI-assisted implementation
→ Automated testing and safety checks
→ Manual acceptance
→ Release can be rolled back
→ Monitoring and Support
→ Financial, Contractual and Compliance Records
→ Next round of product decisions

A solo company has a short decision chain. That speed also removes the colleague who would normally challenge an assumption. Tests, ledgers, contracts, monitoring, and recovery drills must provide that resistance.^{1, 11}

Five actions to start