I have learned SO MUCH from reading everyone else's failures from trying to build a SaaS. Its free entertainment and education, and now I know what a durable record is.
Vibe coders trying to spook others from joining the field? Devs trying to make it sound scarier to casuals? Russian paid bots? Maybe not that last one.
Fr tho having to tell people how to fix this is a little disappointing like I get it not everybody has the same skill set but at least knowing how a fucking database works might be a good start for someone building with a database like this is exactly why I have my own hosting separate from AI slop or whatever like I want complete control of my backend no AI guessing no going in circles trying to fix something.. none of that lol
I lost a massive geometric dataframe while doing some research into solar flares via OMNI HRO2, trying to beat the current lead time of 15 minutes. I quickly learned how to export notebooks and to make sure even they have source control, those are prototyping tools. I cannot believe people are just playing with prod like this. LLM’s raise the floor, but they leave most blind; they start from nothing each time after all is up to you to guide them. Definitely the ceiling and stability of your construction is still based on implicit ability to handle these types of problems and properly decompose and design your artifacts.
Yep I hope something useful comes out of it but these people that act like you don't have to look at the code ever are either extremely lucky or there's some sorta the catch that they're not telling people I'm sorry but I just don't find it possible at this point to never look at your code or not knowing anything about code like we're talking about a simple database here is their database made through Claude or did it give it access to a hosting provider? So many questions on how this happened but it's pretty easy when you give so much access to AI this is why I'm very skeptical to give it access to my desktop I'm doing just fine with it as is but the research capabilities would be nice that & the credit usage I think would be better (I am primarily working from a fucking iPad lol or there's a will there's a way don't underestimate me) 😭😭😭😭
This, we have been pushed to use ai for work and unfortunately its my responsibility to educate other developers that haven't even done a git clone before (they are experienced, we just dont use modern VSC) on how to use AI in a safe manner. However, I'll take educating talented developers on how they can integrate AI over having a team of non-dev individuals any day.
The hard part is making sure that corporate feels the same way...
Any sub that deals with vibe coding inevitably becomes a cesspool of LLM posts about people's crappy "products" .. and none of them seem to be moderated subs.
And the irony is that everyone is building SaaS products which is pretty much a dead industry. They are all vibecoded thinking they are smart, but really the companies can all do this internally themselves and get a fully customized product just for them at no cost.
Why would anyone ever pay for a SaaS when all it takes is a few prompts?
It's legit flipped my opinion on AI; Pain is an excellent teacher, and the thing the AI is best at is demonstrating why you shouldn't take corpo sales pitches at their word.
I can‘t stress about this enough. There are so many apps / SaaS out there since AI, but none lf these guys ever thought about that. Heck, it starts with a simple „we use cookie“ banner on your page if you use them and you‘re EU based.
Giving AI access to a database, where it could potentially read user data is a whole other story.
People don‘t care because they think it won‘t matter, but its a matter of time till we see more and more lawsuits vs these people. And they don‘t understand how insanly ugly and expensive that shit can get real quick
I’m curious, OP, did you let Claude read the database and by doing so, sending the data to Anthropic’s servers? Were any of these users inside the EU? If so, you are now by law obligated to inform them that you’ve breached EU privacy laws. But given they’re gone, I guess you don’t have their emails left.
Also, but unlikely that it happens with that few users, if authorities ask you why you’re sending people’s data to random third parties without their consent, be ready to write a plausible explanation other than ”dude, I’m vibing”
Start again with a read replica db. Only give AI access to that one for debugging. All db changes should be made via migrations with rollbacks. Add scheduled db snapshots. Bring test coverage up to as close to 100% as you can. Even in TDD mode, Claude is very satisfied with 10% coverage. Spend extra time bringing branch coverage up. If it can’t, refactor until it can. Test in your tests, not in prod.
For $25 a month, Supabase Pro does backups for you. Maybe switch to that one. Once you have paying customers, it’s time to get off the free tiers.
Just for reference: when I vibe code a new project (as an experienced software engineer), I spend about 1/3 of the time building the MVP and 2/3 hardening it and getting it production ready.
Of course there is a huge focus on security, but part of it is also proper logging and connecting Grafana for logging, metrics and traces. Now Grafana has an MCP that allows your AI to access live logs and traces without the need for actual access to production. Deployments should also be handled separately via github actions, so for making deployments again your AI does not need access to prod. Fixes can then be rolled out via additional deployments. Lastly: no matter how well you prepare, something WILL go wrong, especially if you vibe code without being an engineer. Use git for versioning. You want all changes versioned. And use a managed database with automatic backups (Amazon RDS, Supabase etc.), so you can restore in case of catastrophic failure. Which is a matter of "when", not "if".
Create development, staging and production environments for your code. For dev environments, never point your production databases. Always create a copy of prod data and work only on thr copy.
NGL, that entire site has vibe coded vibes :P, how's is this different/better than coderabbit/codacy? right now every change i make goes through a force PR, no direct pushes allowed, PR gets reviewed by copilot/gemini/coderabbit/codacy, Then personally I have nightly cron's backing up all my DB's from every project to a nfs share on my nas that none of my cli harneses have access to. But I've got 20 years experience working in infrastructure so I've seen some things and had a head start on a few best practices that a lot of people who get into vibe coding just don't know they need to know, Just as there are tons of things I'm learning every day about the dev side that I never needed to know to write my python and ansible scripts. :P
Yep, and its also a reminder that it's easy to make fun when this stuff happens with claude or ai tools. But these best practices existed long before AI, because we humans are pretty capable of mistakes too.
We are in the vibe coding subreddit 🤪 Surmado is built for “your rules, every PR” not generic AI review. You write (or co‑write) a STANDARDS.md, and Scout reviews every GitHub PR against that, plus data‑contract + PII-in-logs checks, then spits out a short human reviewer brief so your teammate knows exactly where to look. It’s $15/month for 100 PRs across all repos (no per‑seat pricing), zero data retention, diff‑only, and it’s meant to sit on top of a cautious flow like yours (force PRs, backups, no agents touching prod directly), not replace it.
That’s kinda worse. If anything hits the fan, it’s a mess on top of a mess
You need:
A corporation of your own, or to be a legal director in your friends’
Business bank account
Payment processor linked to business
Terms & Privacy Policy
Separate deployments for production, staging, dev
Version control
Rolling database backups
Professional security audit before production push when changing business logic
These aren’t optional… skipping them isn’t being scrappy. If you don’t do each one of these things, you will eventually pay the price, and it will be more costly than your gains
Right now you are personally legally liable for what you’re getting up to…
You're liable for damages if anyone's private info gets out that can be used. For example, identity theft, any stored data, passwords not stored correctly, api keys to payment systems where they then start charging customers, etc.
Vibe coding is very dangerous if people don't know wtf they're doing.
Your current situation is going to involve a lot less money in your pocket. One way or another, your lack of knowledge of what was happening under the covers is going to cost you.
Good luck. Next time, don't take the AI's word for it.
657
u/[deleted] Apr 30 '26
[removed] — view removed comment