Vibe-coding is fun until your SQL injection wakes you up at 3 AM

Bob Starr built a website with vibe-coding and it worked. He called it Boomberg, a playful jab at Bloomberg, and it tracked how much US tax money flows to tech companies. He was proud of it. He launched it fast. Then, months later, he found the problem.

A SQL injection vulnerability. Sitting right there in the code. An attacker could have read or altered data they shouldn’t have touched. Starr, a project manager in tech, called it a glaring oversight. He’s not wrong.

“It was a complete blindspot in my state of learning this new technology and understanding it,” he said. “And I’m sure there are others making the same mistake.”

He’s right about that too.

Vibe-coding is the new hotness. You describe what you want to an AI, it spits out code, you deploy it. No need to understand the underlying architecture. No need to think about edge cases. Just vibe.

And that’s exactly the problem.

The AI will happily generate a web app that works on the happy path. But it won’t tell you about the SQL injection in the search bar. It won’t warn you about the missing authentication on the admin panel. It won’t scream at you for storing passwords in plaintext. The AI doesn’t know what it doesn’t know, and neither do you.

Starr’s story isn’t unique. I’ve seen people deploy vibe-coded apps with API keys hardcoded in the frontend. I’ve seen databases exposed to the open internet because nobody thought about access controls. I’ve seen payment integrations that would make a PCI auditor weep.

The thing is, these apps work. They work well enough that you don’t immediately see the problem. You get dopamine from shipping something fast. You get users. You get feedback. And then you get hacked.

This is higher than I expected, honestly. I thought the security issues would be more obvious. But vibe-coding creates a false sense of completeness. The code looks right, so it must be right. Except it isn’t.

I’m not saying don’t use AI for coding. I use it every day. But you need to know what you’re doing. You need to understand the fundamentals. You need to be able to read the output and spot the bullshit.

If you can’t tell me what SQL injection is, you shouldn’t be deploying a web app that talks to a database. Full stop.

Starr’s Boomberg site is still up. He fixed the vulnerability. He learned something. But how many other vibe-coded apps are out there right now, quietly waiting for someone to find the hole?

Probably a lot.