AI writes code. It doesn't build software.

Every few weeks someone tells me software developers are finished. AI can build an app from a single prompt now, so why would anyone pay a person to do it?

I understand why people think that. I use AI every day in my own work. It writes boilerplate in seconds, explains unfamiliar code, suggests tests I hadn't thought of and saves me hours every week. It's the best tool to arrive in this trade in a long time.

But it's a tool. And I keep seeing what happens when people treat it as the builder instead.

What vibe coding gets right

"Vibe coding" means describing what you want, accepting whatever the AI produces and moving on without really reading it. To be fair, it's impressive. You can go from an idea to something clickable in an afternoon. For a prototype, a personal tool or learning how something works, that's genuinely useful.

The trouble starts when that prototype gets real users, real data and a real domain name.

What I keep finding

I've lost count of the vibe-coded projects I've seen with the same problems:

• API keys in plain sight. The .env file holding the secret keys gets pushed to a public repository, or the keys end up in the code that ships to the browser, where anyone can read them. Whoever finds them can now use your paid services on your account.
• Other people's files, one URL away. Change the number at the end of a link and you're looking at another customer's invoice, upload or profile. The app checks that you're logged in, but never checks that what you asked for is actually yours.
• No 404 pages, no error handling. A mistyped link shows a blank screen or, worse, a full error message with file paths and database details. That's a map for anyone looking for a way in.
• No limits on anything. No rate limiting on logins or forms and no checks on what users send, so a single script can flood the system or slip in data it should never accept.
• Built for one user. It works perfectly on the developer's laptop. Put a hundred people on it and the pages crawl, the hosting bill jumps and nobody knows why, because nobody knows how it works.

None of these are clever attacks. They're the basics. And that's the point.

Why AI doesn't catch this

AI answers the question you asked. Ask for "a page where users can see their files" and you'll get exactly that, working. Whether every user can see every file is a question you didn't ask, so it often goes unanswered.

Security makes this worse, because insecure code still runs. Nothing turns red. The app looks finished, and the problem only shows up when someone goes looking for it. Someone always does.

If you understand the fundamentals, you spot these gaps while reading the code. If you don't, you can't review what the AI gave you, and you're shipping code you can't vouch for. In South Africa, if that code leaks your customers' personal information, it's a POPIA problem, not just an embarrassing one.

When the credits run out

There's a quieter problem too. I've watched people come to a complete stop because they hit their AI usage limit for the day or the month. They couldn't fix a bug, add a button or even explain what their own code did until the tool came back.

That isn't using a tool. That's dependence. If the service goes down, the price goes up or the model starts behaving differently, your project stops with it. A developer who knows the fundamentals slows down without AI. Someone who relies on it completely just stops.

How I use it instead

The rule I work by is simple: AI works with me, not instead of me.

• I make the design decisions. Structure, data, who can access what. AI helps me build it faster.
• I read every line before it ships. If I don't understand something, I ask the AI to explain it, or I look it up, until I do.
• Security is a checklist, not a vibe. Secrets stay on the server. Every request checks who's asking and whether it's theirs. Errors are handled and nothing internal leaks out.
• I can still do the work without it. AI makes me faster. It doesn't make me capable. That part has to come from me.

A power tool, not the craftsman

Power tools didn't replace carpenters. They made good carpenters faster, and they let people without the training do damage faster.

AI is the same. Learn the fundamentals, learn how things fail and why, and AI becomes the most valuable tool you own. Skip them, and what you've built only holds until the first real visitor puts weight on it.

If you've had an app built quickly with AI and you're not sure it's ready for real users, I'm happy to take a look before you launch. You can also see how I approach web apps and AI work.