Developer Portfolio

Vibe coding is a term you hear more and more. It describes a way of building where speed, flow, and momentum matter more than structure or completeness. You have an idea, you put something together, it works, and that’s enough to keep going. Often this happens with the help of an AI agent that generates, edits, and extends code while you stay in the flow.

It feels productive. It feels creative. And in the early stages, it often is. But that same smooth experience can create a false sense of control.

The moment it goes online, everything changes

An application running locally is an experiment. An application running online is a service. The moment you expose it to the internet, it becomes part of a much larger system that includes scanners, bots, automated attacks, and users who will never behave the way you expect.

Many vibe-coded applications are not built with that reality in mind. They rely on assumptions: that input will be reasonable, that endpoints will be used as intended, that configuration is “good enough.” Those assumptions hold locally. Online, they collapse immediately.

Vibe code is built on assumptions

What’s often missing in vibe coding isn’t functionality, but boundaries. Things work, but they aren’t clearly limited. There’s no strong separation between internal and public behavior, between experimental code and production-ready code.

This shows up in small but dangerous ways. Open endpoints without authentication. Debug output exposed to users. Configuration that feels safe locally but leaks information once deployed. These aren’t careless mistakes — they’re unanswered questions.

The quiet problem: you don’t know what to ask

This is a critical part that often gets overlooked. Vibe coding relies heavily on AI agents, and for good reason: they’re fast, capable, and often impressively accurate. But an AI can only respond to what you ask, plus whatever assumptions it fills in on your behalf.

If you lack the underlying knowledge, you also lack awareness of:

what risks exist
which security layers are expected
what should be reviewed before something goes live

So the questions you ask are incomplete. You ask “Can you deploy this?” instead of “What attack surfaces does this application expose?”
You ask “Can you add auth?” instead of “Which endpoints should be public, and why?”

As a result, you end up trusting the first output by default. Not because you’re careless, but because you don’t yet have the framework to recognize what’s missing.

AI output looks finished, but rarely is

AI-generated code often looks complete. There are checks, error handling, sometimes even something that resembles security logic. But without context, these measures are usually shallow. Rate limiting is generic. Validation is minimal. Secrets are mentioned, but not truly protected.

For a vibe coder, this feels like a finish line: it works, it looks clean, so it must be ready. In reality, it’s usually just the starting point. The foundation exists, but the layers required for a public-facing system are still absent.

That’s why vibe-coded applications are almost never live-ready, even when they appear to be.

Deployment is not a technical step, it’s a mental shift

One of the biggest misconceptions is that deployment is mainly a technical action. In practice, it’s a context switch. You move from building something for yourself to exposing something to an unpredictable outside world.

That transition requires slowing down. Stepping out of the flow. Asking questions that don’t naturally arise while you’re building at speed. And this is where vibe coding clashes with security: vibe coding rewards momentum, while security demands pause.

This isn’t an argument against vibe coding. It’s a powerful way to build and learn. But it does require an extra layer of awareness once something becomes public.

That might mean:

learning basic security concepts
understanding which questions to ask an AI agent
accepting that “it works” is not the same as “it’s safe”

Without that shift, the vibe stays in control, and the AI agent quietly becomes an authority instead of a tool.

Final thoughts

Vibe coding is momentum. Security is friction. And that friction is essential the moment something goes online. Not to kill creativity, but to prevent an experiment from turning into an unintended risk.

Build on feeling. Use AI. Move fast.
But pause before you publish — because the internet will always respond, whether you’re ready or not.