From Vibe Coding to Production
10 articles in series
Ten essays on maturing AI-generated code for production — the secret-leak rate hiding in AI-assisted commits, why technical debt rose 30-41% after teams adopted AI coding tools, the recurring XSS and log-injection failures, and a vibe-to-production checklist for solo builders and small teams.
A Vibe-to-Production Checklist for Solo Builders and Small Teams
A concrete, synthesis checklist for moving AI-generated code from prototype to production safely — the practical close to this series, not another abstract warning.
Security Review as a Skill, Not a Late-Stage Gate
Treating security review as a checklist bolted on before launch guarantees it gets rushed. The teams doing this well embed it as a running skill alongside generation, not after it.
When Prototyping Speed and Production Safety Actually Conflict
The tradeoff between shipping fast and shipping safe is real, not a strawman — here's an honest look at where the line between 'ship it' and 'review it' should actually sit.
Building a Review Protocol for Code You Didn't Write Line by Line
A concrete, practical review workflow for AI-generated code at a small team — scoped by risk tier, not by pretending every line deserves equal scrutiny.
XSS and Log Injection: The Two Failures AI Code Keeps Making
86% of AI-generated code samples failed to defend against XSS, and 88% were vulnerable to log injection. Both share one root cause: unescaped input treated as safe.
Reading AI-Generated Code for the Vulnerability Patterns That Repeat
Security teams running internal 2026 workshops on AI-generated code aren't teaching new skills — they're teaching engineers to recognize a small, repeating set of failure patterns fast.
The $400M Cleanup Bill: What Unreviewed AI Code Actually Costs
Industry-wide estimates put AI-code cleanup costs between $400M and $4B, with per-team maintenance costs up roughly 300% in 18 months. Here's what that means at your team's scale.
Why Technical Debt Rose 30-41% After Teams Adopted AI Coding Tools
An 8.1-million-pull-request study found technical debt climbing after AI adoption. The cause isn't worse code per line — it's review capacity that never scaled with volume.
The 3.2% Secret-Leak Rate Hiding in AI-Assisted Commits
AI-assisted commits leak credentials at roughly double the baseline GitHub rate. The mechanism isn't a smarter attacker — it's a faster typist with no memory of what it just wrote.
Vibe Coding Was Never the Problem. Skipping Review Was.
Andrej Karpathy's 'vibe coding' term describes a technique, not a defect. The defect is treating AI-generated code as if it doesn't need the review any other code gets.