Vibe-coding: the quick way to build apps that blow up in your face

Vibe-coding has become the new mantra for people who want to get things done fast. Forget testing, forget documentation — turn on your brain, feel the rhythm of the code, and you're done. Bob Starr tried it with "Boomberg," a site that shows how public money ends up in tech companies' pockets. Slick, useful, launched online the day after creation. Problem: nobody had actually checked what was going on inside.

Months after going public, Starr discovered the site was vulnerable to a classic SQL injection attack. It's not some rare or fancy bug — it's the kind of hole that any beginner should look for before putting something online that handles data. The thing is, when you code "by feel" you skip the security checks that, tedious as they are, need to happen.

Vibe-coding works great if you're prototyping in your garage and nobody's watching. But the moment you plug your app into the internet and fill it with data, the game changes completely. You're no longer playing — you're carrying responsibility. And "but I built it fast" doesn't cut it when someone walks into your database.

The lesson isn't that vibe-coding sucks. The lesson is knowing when to use it. Prototype as fast as you want, feel the vibe all day long. But before you hit "publish," stop for a second and ask yourself: did I actually check the security stuff? If the answer is "I didn't have time," then you didn't have time to launch it either.

And that's where the uncomfortable truth sits: a lot of modern developers think "fast" means "skip the boring details." But the boring details — input validation, credential handling, least-privilege access — are exactly what keeps your app standing when someone tries to break it. They're not optional. They're the foundation.