Series-B SaaS (pattern case) · 2025 · cost index 4/5
Vibe-coded auth middleware nobody could explain
Sev-1 incident; emergency rewrite; weeks of audit and customer trust repair
What happened
A weekend demo shipped AI-generated auth middleware to production without a thorough diff review. The incident revealed session edge cases and permission holes nobody could attribute to a human author. Slack archaeology replaced code ownership; the prompt history was the closest thing to a design doc.
Failure mode
Generation speed treated as shipping readiness. Review capacity did not scale with PR volume. Tests asserted happy paths the model also invented. Accountability evaporated when the outage page asked who signed off.
Lesson
Copilot is not a committer of record. Size review like on-call, require humans on the hook for security-sensitive paths, and treat vibe-shipped diffs as prototypes until proven otherwise.
Sources
- Industry pattern — AI-generated prod incidents (anonymized)
- OWASP — LLM application security guidance
- Engineering postmortems — ownership of generated code
Related tech
Practice · 2024–now
Vibe coding
Accept AI output on feel, skip the diff, hope tests exist. Fast demos; CVEs and nobody owns the middleware.
$ Ship-to-prod without reading the diff became a flex until incidents revealed nobody knew which prompt wrote the auth middleware. Review debt arrived in one weekend demo.
Practice · 2021–now
AI pair programming
Autocomplete that understands the file — now table stakes. Generation outran review capacity; ownership is the bottleneck.
Practice · 2024–now
AI review bottleneck
Copilot ships PRs faster than teams can review. Generation outran ownership and security review — the real 2026 invoice.
Practice · 2023–now
AI will rewrite the codebase
Big-bang rewrite, now with a chatbot — then with agents. Same failure mode; prettier slides.
$ Exec decks promised autonomous migrations "by next quarter," then rebranded as "agentic modernization." Teams that skipped tests, ownership, and incremental strangler patterns bought expensive demos and fragile diffs.
Practice · 2024–now
AI-generated test theater
Coverage theater with a chat box. Tests that mirror the bug and never catch it.
$ LLMs wrote tests that boosted coverage and asserted nothing. Green CI, false confidence — eval theater's cousin in the test suite.