Originally published at malaymehta.com
It Starts with an Idea
Let me walk you through a story that's playing out thousands of times right now.
It starts with an idea. A real one. Something that cracks a genuine problem. In the past, turning that idea into software required a developer squad, a QA team, and a bit of DevOps to get an MVP out the door.
But things changed fast. Now someone with an idea and no technical background can build it themselves. We call it vibe coding. Hand the idea to an AI agent, iterate on the output, verify the end state, and ship it. If you mastered AI looping and prompt chaining, hats off. That part is genuinely impressive.
The demo works. Early users sign up. You feel like you cracked it.
The Wall
Then comes the next logical thought: let me verify code quality. So you put another AI agent on it. The agent reviews the code, says it looks good, maybe suggests some minor refactors. Feels reassuring.
Until you realize what just happened: AI wrote the code, and AI reviewed the code.
Nobody with actual engineering judgment ever looked at it. Nobody walked through the code themselves. Nobody asked whether the architecture makes sense for what comes next.
And I haven't even gotten to code security and vulnerabilities yet.
What I Actually See in These Codebases
I review AI-generated and vibe coded repos regularly. Here is what shows up every single time:
Users can see each other's data by changing an ID in the URL.
This is the most common and most dangerous pattern. The app works perfectly in testing because you only ever test with one account. The moment two real users are on the system, one can access the other's data just by modifying a request parameter. Data isolation was never designed because the AI never thought about it, and nobody asked.
Authentication and token management full of holes.
Modified tokens are accepted. Privilege escalation is possible. The auth layer looks correct on the surface but has no real validation depth. An experienced attacker would walk through it in minutes.
Secrets floating in the code like public property.
API keys, database credentials, third-party tokens hardcoded in source files. Open invitations for anyone who gets access to the repo. AI generates these inline because it doesn't understand the difference between making something work locally and making something safe for production.
Messy business logic with unnecessary abstractions everywhere.
AI loves abstracting things. Layers upon layers of patterns that add complexity without value. When something breaks, nobody knows where to start looking because the logic is spread across files that reference each other in ways that don't map to anything in the business domain.
Nobody can do root cause analysis because nobody walked the code.
This is the fundamental problem. When a production issue hits, the team stares at code they didn't write, don't understand, and can't trace. Debugging becomes guesswork. Fixes introduce new bugs. The codebase fights you at every turn.
Your App Works with 100 Users. It Won't Work with 10,000.
The app that worked fine in development starts showing cracks under real load. Here is what actually happens:
Your database isn't functioning properly under heavy load because nobody thought about connection pooling, proper indexing, or slow query monitoring. API latency P99 and P95 are spiking, giving you sleepless nights. Is it a microservices mess, a debugging hell, or everything together?
Do you have the right observability in place to even know what's happening? Are you following OWASP security principles? For most vibe coded apps, the answer is no.
The Numbers Back This Up
This is not just my observation. 81% of enterprise tech leaders report increased production issues from AI-generated code. 43% of AI code changes need manual debugging in production even after passing QA. AI-generated code introduces 1.7x more issues than human-written code across production systems.
A Ship Without a Sailor
If all of this sounds like afterthoughts, then it's the right time to think. You may have gained moderate to good technical knowledge along the way, but is it enough to choose the right things now? To prioritize what to fix first? To know which shortcuts will cost you and which are fine?
Without guidance, it's like a ship without a sailor. It goes wherever the wind takes it. In your case, the wind is a hallucinating AI agent that's only as good as the direction you give it.
Does it seem too late? It can feel that way. You already have users growing and production burning with issues. But this is exactly the point where the right guidance makes the biggest difference.
What to Look for Before It's Too Late
If you're running a vibe coded app in production right now, check these in order:
Data isolation - can one user access another's data by modifying request parameters? Test with two accounts. If yes, stop everything and fix this first.
Auth and tokens - try modifying a JWT token. Does your API still accept it? Can you escalate privileges?
Secrets in code - search your repo for API keys, database passwords, and tokens. Move them to environment variables.
Database under load - check connection pooling, add indexes to your most queried columns, set up slow query logging.
Observability - if you can't see what's happening in production without reading logs manually, you don't have observability. Set up structured logging, metrics, and alerting.
Walk the code yourself - the single most important thing. Read through the critical paths. Understand how a request flows from the user to the database and back. If you can't trace it, neither can anyone you hire to fix it.
The Right Guidance Changes Everything
This is the vibe coded production mess. And it's fixable. An experienced mentor who has seen these patterns before can help you steer production, rescue catastrophic issues, and fix things in a way that actually stays fixed.
The goal is not to throw away what you built. The goal is to save the momentum you have and build a real foundation under it.
AI will keep getting better at generating code. But right now, the gap between code that works on a demo and code that works in production is where the real engineering happens.
The typing was never the hard part. The thinking is.
I'm Malay Mehta, a Software Architect and Engineering Mentor with 726+ mentoring sessions and a 5.0 rating. I help teams fix AI-generated software and mentor engineers on building the judgment AI can't replace. Read more on my blog or get in touch.
