Vibe coding your studio’s booking system? Read this first

Source: Drazen Zigic on Magnific

We've noticed something at Rezerv lately.

More studio owners are coming to us after building their own booking websites with AI. What started as a way to save money and get things running quickly has ended up causing problems they didn't expect.

We're talking about member complaints, technical issues that are difficult to fix, and even concerns about customer data security. And when you don't really understand the code behind your website, figuring out what's gone wrong can be a headache of its own.

We get why vibe coding is tempting, though. You tell AI what you want, it writes the code, and suddenly you've got a booking website that looks pretty decent. Why pay for booking software every month when you can build your own?

The problem is, once real customers start using it, there's a lot more at stake. Your members are booking classes, purchasing packages, making payments, and trusting you with their personal information. If something goes wrong, you're the one who has to deal with it.

So, if you've been thinking about vibe coding your studio's booking system, we want to share a few things we've learnt from the studio owners who've come to us for help. It might make you reconsider how much you're actually saving by building everything yourself.

I. What is vibe coding, and why are fitness business owners interested in it?

Vibe coding means building software by describing what you want to an AI tool in plain language and letting the tool write the code.

AI researcher Andrej Karpathy coined the term in February 2025 to describe a way of building where you stop paying attention to the code itself. Collins Dictionary went on to name it Word of the Year for 2025 and it has since become a popular approach to software development, especially among people with little or no programming experience.

For a studio owner, the process looks like this:

You type something like "Build a booking website for my Pilates studio where customers can view available classes, reserve spots, purchase packages, and manage their bookings."

The tool generates a working site in minutes. You ask for changes, check the result in your browser and repeat until it looks right. At no point do you need to read or understand the code behind it.

It's easy to see why this has caught the attention of business owners. Tasks that previously required programming knowledge or professional developers have become much more accessible.

And for a small studio with only a handful of classes and customers, a basic AI-generated booking system might initially seem sufficient.

But the application you see on your screen is only one part of the system. Behind every successful booking, there are processes that need to work correctly, from checking class availability to tracking membership credits and confirming payments.

That's where building your own fitness booking software starts becoming more complicated than it first appears.

II. Fitness booking software is more complex than it looks

At first glance, a fitness booking system seems pretty straightforward. Customers open your website, choose a class, pick an available time, and confirm their booking. Simple enough, right?

But there's a lot happening behind that process that customers never see.

Let's say you run a Pilates studio with 12 reformer beds. Your 6 PM class is almost full, with only one spot remaining. Two customers open your booking page at the same time and both try to reserve that last spot.

Your system needs to make sure only one booking goes through. Otherwise, you could end up with 13 customers showing up for a class that only has room for 12.

And that's just one scenario. Now imagine one of those customers has a 10-class package.

Before confirming their booking, your system needs to check if their package is still active, verify that they have enough credits, and deduct the correct amount once the booking is confirmed.

What happens if they cancel? Should the credit be returned automatically? Does it depend on how close the cancellation is to the class? If someone is on the waitlist, should they be offered the newly available spot?

These are all things your booking software needs to handle correctly.

1. Memberships and class packages

A customer purchases a 10-class package that's valid for 30 days. They book three classes, cancel one, and try to reserve another class after their package expires.

Your system needs to track their remaining credits, apply the correct cancellation policy, and check their package validity before allowing another booking.

2. Real-time booking availability

Your Pilates studio has 12 reformer beds, and two customers try to book the last available spot at exactly the same time.

Your system needs to confirm one booking and prevent the other from going through without accidentally exceeding the class capacity.

3. Recurring billing

A member’s card fails at renewal. Your system has to retry the payment, notify the member and pause their access if the payment still fails.

Recurring billing also covers prorated charges when someone upgrades mid-month, membership freezes for holidays or injuries, and class packages that expire on a set date.

Each of these rules has to be coded, tested against real cards and kept working every time your payment provider updates its system.

4. Booking rules

Someone cancels 30 minutes before a full class. The first person on the waitlist should be moved in automatically, notified and charged. Meanwhile, the member who cancelled late gets whatever penalty your policy sets.

Class caps, credit deductions and no-show fees all have to apply in the right order, often within seconds of each other during peak booking times.

5. Multi-location and staff

A coach calls in sick at 6am. Someone has to assign a substitute, update the timetable and message every booked member before the 7am class.

If you run more than one outlet, your system also needs a separate schedule for each location, plus staff roles that control who can edit classes, issue refunds or view member details.

6. Member apps

Apple changes an App Store requirement, and your studio app can no longer release updates until someone fixes it. Members expect to book from their phones, which means native iOS and Android apps with push notifications.

Apple and Google both update their store rules every year, so keeping an app live is ongoing work.

7. Smart door lock integrations

Your gym offers 24/7 access using smart door locks. A customer with an active membership should be able to enter during their permitted access hours.

But what happens when their membership expires, their payment fails, or their class booking gets cancelled? Your system needs to check their eligibility and ensure access permissions are updated correctly so unauthorised customers cannot enter.

8. Third-party booking integrations

A member books the last available spot in your spin class through your website at the exact same moment a ClassPass user books it through the ClassPass app. Without real-time synchronisation between the two platforms, you end up with two riders and only one bike.

Your booking system needs to keep availability, reservations, and cancellations in sync across platforms like ClassPass and 1Fit to prevent double bookings.

9. Customer notifications

You need to move tomorrow's Pilates class from 6 PM to 7 PM. Everyone who has booked that class should receive the correct update, while customers booked into other sessions shouldn't be affected.

The notification also needs to reflect the latest schedule, especially if further changes occur.

10. Check-ins and attendance tracking

A customer arrives for their class, but their name isn't on the attendance list because their booking was cancelled earlier. Your staff needs to see their current booking status and verify their eligibility before letting them join.

The system also needs to distinguish customers who attended, cancelled, or didn't show up.

–

And these are only a few examples. The real challenge is making sure all these functions work together.

A single class cancellation, for instance, could affect the customer's remaining credits, class availability, waitlist, attendance records, automated notifications, and even their access to your facility.

AI can help you generate the code for these features.

But getting everything to work correctly across hundreds of customers, different membership types, multiple locations, and third-party integrations requires careful development, testing, and ongoing maintenance.

III. Hidden dangers of vibe coding your fitness booking software

The previous section covered everything your booking system has to do. This section covers what you take on once the system is live and your members depend on it.

Risk 1: your member data may be open to anyone

AI tools write code that works, and they often write code that is unsafe. Veracode’s 2026 GenAI Code Security Report has tracked more than 100 AI models and found an average security pass rate of 56%, almost unchanged from the year before.

The best model still failed nearly one in three security tasks, and models built specifically for coding scored no better than general ones.

That gap has already exposed real people’s data:

• About 5,000 apps left open. In May 2026, security firm RedAccess found roughly 5,000 vibe-coded apps with misconfigured or default public settings. The exposed data included medical records, financial data and customer chat logs

Around 40% of those, built on Lovable, Base44, Replit or Netlify, had virtually no authentication. Some could be opened by anyone with the URL.

• One app, 18,000 users. In February 2026, a researcher found 16 vulnerabilities in a single Lovable-hosted app, six of them critical. Its login check was written backwards: it blocked signed-in users and let strangers through. Attackers could have read user records, sent bulk emails and deleted accounts.
• 170 apps with an open database. A 2025 vulnerability, logged as CVE-2025-48757, let unauthenticated visitors read or write database tables in Lovable-generated sites that lacked row-level security.

A Stanford study found that developers using AI assistants were more likely to introduce security flaws, and also more confident that their code was secure

Now think about what a studio’s booking system holds: names, phone numbers, email addresses, birthdays, emergency contacts, injury notes from waivers, payment history and check-in times.

Check-in times tell a stranger when a member is at your studio. A common flaw in AI-built apps lets a logged-in member change one number in a web address and load someone else’s profile.

You will not spot any of this by using your own site. The timetable loads, bookings go through and everything looks fine from the front desk. Security holes stay invisible until someone outside your studio finds them.

Risk 2: payments that fail quietly

Taking a first payment through a checkout page is straightforward. Most payment problems start on day 31, when a monthly membership needs to renew. Here is what a booking system has to handle without anyone watching:

• A declined card at renewal. Someone has to retry the charge, tell the member and pause their booking access. If your system skips any of these steps, the member keeps booking classes they have not paid for.
• A payment confirmed twice. Payment providers sometimes send the same confirmation more than once. Code that does not check for duplicates can give a member double credits or charge them twice, which leads to refund requests and chargeback fees.
• Refunds and returned credits. When you cancel a class, every booked member needs their credit or money back, and the amounts need to match your records.
• Freezes, upgrades and expiry dates. A member who freezes for two weeks, upgrades halfway through the month or lets a package expire changes what they owe.
• Month-end reconciliation. Your payment provider’s report, your bank statement and your booking records all need to agree.

Each of these gaps ends up as a phone call from a confused member or a number that does not add up at month-end. Take a studio with 300 monthly memberships at S$150 each. If 5% of renewals fail and nobody follows up, that is S$2,250 missed in one month.

Card security adds another layer. If the AI builds a checkout that stores card numbers in your own database, you take on obligations under PCI DSS, the security standard card networks require from businesses that handle card data.

A safer setup lets the payment provider hold the card details, but you need to know enough to ask for it.

Risk 3: booking rules that break under real use

A booking flow that works when you test it alone can fall apart when 40 members open the app at once. These are the situations that catch vibe-coded systems out:

• Two members, one spot. Two people tap “book” on the last reformer at the same second. Unless the code locks that spot, both bookings go through and 21 people turn up for 20 machines.
• A waitlist that never moves. A member cancels late from a full class. The system needs to offer the spot to the next person, notify them and apply your late cancellation fee to the first member.
• Classes you cancel. When an instructor calls in sick, every booked member needs a notification and their credit back, and the substitute needs the right roster.
• Mixed booking rules. Class packs, unlimited memberships, intro offers and drop-ins each follow different rules on what they can book and when.
• The weekly booking rush. If you release next week’s timetable every Sunday at 8pm, your busiest five minutes are also the moment your system is most likely to slow down or crash.

When any of these go wrong, members hold your studio responsible, at the front desk, in your Google reviews and in your community group chat.

Risk 4: one wrong command can wipe your records

AI coding tools can now change your live system directly, and they do not always follow instructions.

In July 2025, SaaStr founder Jason Lemkin was nine days into a 12-day experiment with Replit’s AI agent. Despite a code freeze he had put in place, the agent ran commands that deleted his live database, which held records on 1,206 executives and about 1,196 companies.

The agent then told him the deletion was permanent and that a rollback would not work. Lemkin recovered the data himself anyway. At the time, Replit used the same database for testing and for the live app, and it has since separated the two.

Lemkin was running a test project. A studio’s database holds every member’s credit balance, membership end date, attendance history and payment record. If that disappears on a Tuesday night, you open on Wednesday with no idea who has paid for what.

Before you trust a vibe-coded system with this data, you need clear answers to three questions:

1. Where are the backups kept, and how often are they taken?
2. Has anyone tested restoring from one?
3. Can the AI tool touch your live data, or only a test copy?

Risk 5: nobody can fix what nobody understands

This is the pattern we see most often at Rezerv. The studio owner built the system by describing features to an AI tool, and nobody at the studio can read the code it produced. Everything works until something breaks.

Then it plays out like this. It is 6am, the first class starts at 7 and members cannot log in. You paste the error message into the AI tool. It suggests a fix, you apply it, and logins work again.

Two days later you find out the same fix stopped the waitlist from moving. Each new prompt adds code that nobody has reviewed, and each repair carries a chance of breaking something you have not checked.

There is also no support team to call. If the system goes down during your Sunday booking release, you find out when members start messaging you on Instagram, and the fix waits until you or your builder can work out what went wrong.

Four more problems build up over time:

• The knowledge leaves with one person. If a freelancer or a tech-savvy member helped you build it, they hold the only real understanding of how it works. When they move on, so does your ability to change it. If you built it yourself, six months later you will be maintaining code you prompted into existence and never read.
• Every new feature is your project. Members ask for a referral programme, Apple Pay or a family class pass. Each request means another round of prompting, testing and fixing, and each change can break billing or booking rules that worked the day before.
• Growth means a rebuild. A second location, staff with different access levels, instructor payroll or a mobile app each touch the core of the system. Code that was written prompt by prompt rarely stretches to fit.
• You become the developer. Hours that should go into coaching, marketing and member relationships go into debugging. That time costs your studio money even though it never shows up on an invoice.

Researchers studying vibe coding in practice describe a trade-off where fast code generation builds up technical debt through inconsistent structure, security gaps and growing maintenance work.

Vibe coding is useful for prototypes and internal tools. The risks above apply once your revenue, member data and daily operations depend on code your team cannot read, test or repair.

Risk 6: the legal responsibility stays with your studio

When member data leaks, regulators look at the business that collected it. Who wrote the code makes no difference. Vibe coding platforms say the same thing: after the February 2026 incident above, Lovable’s position was that users are responsible for acting on security issues before they publish.

In Singapore, the Personal Data Protection Act (PDPA) requires organisations to protect the personal data they hold.

Since 1 October 2022, the maximum financial penalty for a breach has been S$1 million, or 10% of annual Singapore turnover for organisations earning more than S$10 million.

If a breach affects 500 or more people or is likely to cause significant harm, you also have to notify the PDPC within three calendar days. Malaysia, Australia, South Africa, the UK and the EU each have their own data protection laws with similar duties.

Fitness studios also hold more sensitive data than most small businesses. Waivers and health questionnaires record injuries, medical conditions and pregnancies.

If that information leaks, the cost goes beyond a fine: members who trusted you with their health details may not book again.

IV. Why Rezerv is a smarter alternative to building your own fitness booking software

Rezerv is fitness booking software that already handles the billing, booking rules, member data and support covered above. More than 1,300 live businesses run on it, and studios have processed over 6 million bookings and USD100 million in sales through the platform.

Here’s how it covers each risk.

1. Payments that run without you watching

Rezerv takes card, e-wallet, QR code and bank transfer payments. Card fees are under 2.5%, and Direct QR Pay has 0% transaction fees.

Packages, memberships and credits sit in the same system as your bookings, so a member’s balance updates the moment they book, cancel or get a refund.

You can also set up automations that send a promo code by email, SMS or WhatsApp when a member’s credits run low or their package is about to expire.

2. Booking rules that hold up on a full class

Waitlists, class caps and spot booking are built in, so the last reformer can only go to one person. When you cancel a class, the booked members get their credits or payments back and a notification, without you messaging each one. Late cancellations, no-shows and mixed package rules follow the policies you set.

3. Multi-location and franchise support

Run every outlet from one account, with its own timetable, staff and schedule. If you run a franchise where each outlet has its own account, you can link the outlets so members can use their package at any participating location.

Every cross-outlet booking is tracked, so at month-end you can see where each package was sold and where it was used, and split the revenue between outlets from one report.

4. Member data looked after by a full-time team

Your member records, payment history and signed waivers sit on a platform maintained by a dedicated engineering team, with servers in Singapore.

When a security issue comes up, the fix goes out to every studio on the platform, without anyone at your studio having to spot the problem first. Rezerv also supports member data requests under PDPA and GDPR.

5. Messaging and integrations

Email, SMS and WhatsApp automations handle reminders, confirmations and win-back messages. SMS and WhatsApp run through your connected Twilio account. Rezerv integrates with ClassPass and Igloohome smart door locks.

You can also add your Meta Pixel, Google Analytics 4, Google Tag Manager and TikTok Pixel IDs to track which ads bring in bookings.

6. Support from real people, and new features every month

When something goes wrong, you can reach Rezerv’s team by live chat or video call, with no AI bot in between. New features are released every month, and recent ones include Organisation, Bulk Delete Schedule and AI Business Insights.

AI Business Insights flags revenue lost to no-shows, underperforming classes and members at risk of leaving. The development cost is shared across every business on the platform, so you never pay a developer to build these features for your studio alone.

7. Love building? Build on Rezerv

Still want to build your own website with AI? Go for it! You don't have to give up the freedom to create something yourself just because you're using booking software.

Booking widgets and embeds

With Rezerv's Embed Widget, you can keep your own website, including one you've built with AI, and add Rezerv's booking functionality directly to it.

That means your customers can view live class schedules, book appointments, and explore packages and memberships from your existing website. Meanwhile, Rezerv handles the booking system behind those interactions.

Connect your own tools with Rezerv's API

If you want to take customisation further, Rezerv also offers API access.

For example, you could build your own dashboard that pulls class schedules, staff lists, locations, and transaction data directly from Rezerv. You can also use the API to update class schedules in bulk from an external system.

This gives developers more flexibility to create custom workflows while keeping Rezerv as the underlying business management platform.

Use AI to manage your studio with Rezerv's MCP Server

AI Connect is Rezerv’s MCP server. MCP (Model Context Protocol) is an open standard that lets AI assistants connect to other software.

With Rezerv's MCP Server, you can connect compatible AI assistants to your business data and use them to help manage your studio.

Want to know how many classes you sold last week? Ask your AI assistant. Need to check upcoming bookings or identify your top members? You can do that too.

You can even use AI to carry out supported tasks in Rezerv, such as booking clients into classes, managing schedules, sending reminders, and cancelling bookings.

So if you love experimenting with AI, there's still plenty you can do with it.

You can build your own website, develop custom integrations, and use AI to manage daily operations, all while keeping Rezerv as the foundation of your booking system.

Your time is better spent growing your fitness business

We're not saying you shouldn't use AI to build things. In fact, we think it's great that AI is making technology more accessible to business owners.

But if there's one thing we've learnt from speaking with studio owners who've tried building their own booking systems, it's that getting a website live is often the easiest part.

Once your members start relying on it to book classes, purchase memberships, and make payments, every technical issue becomes a business problem.

And if you don't have the knowledge or resources to maintain the system properly, those problems can quickly take up more time and money than you expected.

That's why we encourage studio owners to think carefully before building their entire booking system from scratch.

But if you’re still keen to build, ask yourself these things

1. Who fixes the system if it breaks at 6am on a weekday?
2. What happens when a member’s card fails at renewal?
3. Who has checked the code for security gaps, and when?
4. Where are your backups, and has anyone restored from one?
5. If the person who built it left tomorrow, could anyone else change it?

If the honest answers are “probably me” and “I’d rather not find out,” it might be worth handing that part to someone else.

That’s the job Rezerv does for more than 1,300 businesses. We look after the billing, bookings and member data, so your hours go into your classes and your members. If you enjoy building, you can still design your own site and run Rezerv behind it.

The hours you’d spend maintaining your own system could go into coaching, filling classes and keeping members coming back.

Already running a self-built system that’s starting to show these problems?

Data migration is free and included in onboarding, so you can move your members, packages and booking history across without starting over.

Book a 15-minute demo to see how Rezerv would run your studio, or start with a 1-month free trial.