Field notes
Production-readiness, security, and the bugs that hide behind green checkmarks.
-
Before you charge your first customer: the 5 checks that matter
The moment money and customer data enter the picture, your vibe-coded app stops being a hobby and starts being a liability. Here are the five things to verify before you take your first real payment.
Read → -
Your AI agent has more access than your most senior employee
The fastest way to build an AI feature is to hand the agent broad access to your database, APIs and tools. It's also how one cleverly-worded input turns a chatbot into a breach. Least privilege isn't just for humans.
Read → -
The cookie banner that doesn't actually block cookies
A consent banner that looks compliant while the tracking fires anyway is the single most common privacy failure in 2026 — and the one regulators now check for directly. Here's how to tell if yours is real or just decorative.
Read → -
What technical due diligence will find in your vibe-coded app
The day you raise money or sell, someone opens the hood. Technical due diligence is where unreviewed vibe-coded apps quietly lose value — or kill the deal. Here's what the reviewer looks for, so none of it is a surprise.
Read → -
Prompt injection is the new SQL injection
If your app has an AI feature — a chatbot, an assistant, an agent — it has a new front door. Prompt injection is to LLM apps what SQL injection was to the early web, and most vibe-coded AI features ship wide open to it.
Read → -
Your vibe-coded app is probably breaking GDPR — and the fine is real
However your app was built, you are the data controller. Vibe-coded apps quietly collect more data than their founders realise, with consent flows that look compliant but aren't. Here's what trips them up — and how to check.
Read → -
Vibe coding is dead. 'Agentic engineering' still needs a human read.
Andrej Karpathy — who coined 'vibe coding' — has already called it passé and proposed 'agentic engineering': AI agents that plan, write, test and ship under structured human oversight. The catch is in those last three words.
Read → -
'Vibe-coded' shouldn't be an insult
The phrase became a slur because of the leaks and breaches that made headlines. But the method isn't the problem — shipping unreviewed is. Here's how to build with AI and ship software people actually respect.
Read → -
You built it but you can't change it: the vibe-coding maintainability trap
Security gets the headlines, but the slower danger in AI-built apps is maintainability — you own a codebase you don't understand, and the AI that wrote it can't reliably fix it. Here's how the trap forms and how to get out.
Read → -
What Moltbook teaches every non-technical founder
An AI-built social network exposed 1.5 million credentials within days of launch. The lesson isn't 'don't build with AI' — it's that no one read the code before real data went behind it.
Read → -
7 ways your vibe-coded app is leaking data right now
Most data leaks in AI-built apps come from the same short list of mistakes — and every one of them looks completely fine from the dashboard. Here are the seven to check, and how to spot each one yourself.
Read → -
It runs. But is it secure? The gap the green checkmarks hide
Independent studies keep finding the same thing: AI-generated code works far more often than it's safe. Here's the data on the gap between 'it runs' and 'it's secure' — and why closing it takes a human read.
Read → -
You prototyped in Lovable or Bolt. Here's what changes before real users.
The most common vibe-coding workflow is to build fast in Lovable or Bolt, then 'go to production'. But prototyping and production are two different jobs — here's what actually changes the moment real people and real data show up.
Read → -
One bad migration from losing everything
Most vibe-coded apps have no backups, share a database between dev and prod, and run destructive migrations by hand. How to not lose your users' data on a Tuesday.
Read → -
The file-upload feature that lets anyone store anything on your dime
Upload features are a classic vibe-coding blind spot: no type or size limits, public buckets, executable files, and storage that scales with abuse. What to lock down before you ship one.
Read → -
When your app breaks, can you even tell?
Vibe-coded apps tend to swallow errors silently, leak stack traces to users, and log nothing. Why that's dangerous, and the minimum observability to have before launch.
Read → -
Fast in the demo, dead at 1,000 users: the queries that don't scale
Your app is snappy with ten rows and falls over at ten thousand. The query patterns AI builders generate that work in the demo and collapse under real data — and how to spot them early.
Read → -
How a vibe-coded app runs up a $4,000 bill overnight
No rate limits plus an endpoint that costs money equals a bill that scales with abuse, not usage. Where runaway cost hides in AI-built apps, and how to cap it before it caps you.
Read → -
The payment bugs that let users pay you less — or nothing
Vibe-coded checkout flows leak money in predictable ways: prices set in the browser, webhooks nobody verifies, test keys in production. What to check before you take real payments.
Read → -
The 10 most common things that go wrong with vibe-coded apps
Across every AI-built app we review, the same ten failures show up — secrets in the client, an open database, code that can't scale. The complete list, what each one costs you, and how to check yours before launch.
Read → -
How to find the API keys your vibe-coded app is leaking
Exposed secrets are the most common — and most expensive — thing AI-built apps ship with. How keys end up in your frontend, how to check yours in two minutes, and what to do the moment you find one.
Read → -
5 production-readiness bugs vibe-coded apps ship with
The build passes, the tests are green, it's deployed — and it's still not safe to launch. Here are the five issues we find in almost every vibe-coded app, in plain English, and how to catch them yourself.
Read → -
The pre-launch checklist for vibe-coded apps
Before you put real users and real data behind an AI-built app, walk this list. The boring, invisible things that take down launches — and how to check each one yourself.
Read → -
Why the AI that built your app shouldn't be the one to check it
Asking the model that wrote your code to also review it sounds efficient. It's the one review that's almost guaranteed to miss the things that matter — here's why.
Read → -
Your /admin page is protected in the UI. That's not protection.
Hiding a button or redirecting on the client doesn't stop anyone. Why UI-only auth is one of the most common vibe-coding bugs, and where the check actually has to live.
Read → -
The bug that lets one customer read another's data
Trusting an id the browser sent is how multi-tenant apps leak customer data to each other. What IDOR is in plain terms, why AI builders generate it, and how to close it.
Read → -
Supabase RLS: the setting that quietly leaves your database open
Row-level security is the single most common — and most dangerous — thing missing from vibe-coded Supabase apps. What it is, why it ships off, how to check it, and how to fix it.
Read → -
Firebase in test mode: your database is public and you won't notice
Firebase's default test-mode rules let anyone read and write your whole database — and the 30-day warning is easy to miss. How to check your rules and lock them down.
Read → -
How to give a code reviewer read-only access (without handing over the keys)
Handing over your code is the scary part. Here's how to give a reviewer exactly the access they need — read-only, revocable, no write or admin — on GitHub and GitLab.
Read →