Field notes from rescuing AI-built apps
What actually breaks when you open up a vibe-coded codebase, written so you can check your own app against it. Real prompts, real checklists, no fluff, and no invented case studies.
Environment variables undefined after deploy?
Your local .env file does not travel to Vercel. Here is exactly where to add your variables and how to make them visible to your deployed code.
Is your secret key exposed in your front end?
Three checks against your live site, the key prefixes that matter, and the rotation order that does not take your app down.
The Supabase RLS default that leaks your entire user table
One curl request tells you whether an anonymous visitor can read your users table. Then the SQL that actually closes it, and what correct policies still miss.
Your app worked perfectly, then every user's data vanished on redeploy
The ephemeral SQLite trap: why the file disappears, whether you can get it back, and the real migration to managed Postgres, step by step.
IDOR: a logged-in user is not an authorized user
Change the ID in the URL and you get someone else's invoice. The vulnerable handler, the fixed one, and why auth middleware does nothing about it.
A real engineer versus a vibe coder: what actually separates them
Same feature, two ways: a signup and payment flow built the vibe-coded way and the engineered way, with the actual code for both.
Can vibe coders become real engineers?
Yes, and faster than the traditional path. A five-stage roadmap with exercises and exact AI prompts for the fundamentals AI tools hide.
10 things that take a vibe-coded app from disaster to production
Ten specific fixes, each with the problem, why AI causes it, and a copy-pasteable prompt or snippet, in priority order.
The prompts we use to clean up AI-generated code
The exact prompts that turn sprawling, inconsistent AI output into a codebase a second engineer could actually maintain.
The vibe-coding security checklist
A complete, run-it-yourself checklist for finding the security gaps AI coding tools leave behind before someone else finds them.
How to scale a vibe-coded app before it breaks
What actually buckles first when real traffic arrives, and the specific architecture changes that hold under it.
The rescue playbook
Real prompts, security rules, and teardowns of broken AI-built apps. Free, no course, no pitch.
One email when there's something worth reading. Unsubscribe anytime.