Contents
Part I. Getting started
Part II. Building
Part III. What actually breaks
Part IV. Shipping
Reference
The Vibe Coder’s Field Manual
A working manual for building real software with AI: the how-to, plus the parts nobody warns you about.
Most guides stop at “and now you have an app.” That is the easy half. This one keeps going, into the failures that only show up once a stranger arrives. Those are the failures we spend all day finding in real, shipped, AI-built apps.
Who this is for
You have built something with Cursor, Claude Code, Copilot, Lovable, Replit, v0, or a chat window and a lot of patience. It works. You are somewhere between “this is incredible” and “I have no idea what I just shipped.”
That gap is the honest condition of vibe coding, and it is not a character flaw. It is the direct, predictable consequence of how these models are trained. A model is rewarded for producing code that runs. Nothing in that objective rewards it for telling you that the database rules it scaffolded will let any stranger on the internet read every row in your users table. It will not warn you. It is not being careless; it is answering the question you asked.
So this manual is organised around a single idea: the model is excellent at making things work and indifferent to making them safe. Everything below follows from that.
The manual
Ten chapters, in reading order. Or jump to whichever one is currently ruining your week.
Part I. Getting started
What vibe coding actually is, the loop that works, and how to pick a stack the model is good at.
Start here
9 minThe honest definition, the four-step loop that keeps a project moving, and the three habits that separate people who ship from people who restart.
Choosing a stack
11 minWhy the model is fluent in some stacks and hallucinates in others, what to pick for a first app, and the tempting choices that trap you six weeks in.
Part II. Building
How to describe what you want, and what to do when the model stops being able to fix it.
Prompting & specs
12 minThe difference between a prompt and a spec, why context beats cleverness, and how to scope work so the model finishes instead of flailing.
The doom loop
10 minYou paste the error, it apologises, it makes things worse. The anatomy of the doom loop, and how to break it instead of burning another twenty prompts.
Part III. What actually breaks
The failures we find over and over in real vibe-coded apps, and why the model never warned you.
Where apps break
16 minThe flagship chapter. Ten specific ways real AI-built apps fail in production, why the model never warns you, and what each one looks like from the outside.
Secrets & keys
12 minWhat actually counts as a secret, why a .env file is not a safe place by itself, and how to check in ninety seconds whether you have already leaked one.
Auth & database rules
15 minThe number one killer. Why being logged in to your UI means nothing to your database, what row-level security really does, and how to lock it down.
Part IV. Shipping
Closing the gap between a demo that impresses and a product that survives real users.
Demo to production
13 minHardcoded data, stubbed flows, buttons that go nowhere, and features your landing page promises but your app never implemented.
Pre-launch checklist
14 minThe last thing you read before you post the link. Every check is written so you can actually perform it, not just nod at it.
Common questions
- What is vibe coding?
- Vibe coding is building software by describing what you want to an AI model in natural language and iterating on what it produces, rather than writing most of the code by hand. The term was popularised by Andrej Karpathy in 2025. It is real engineering with the typing removed: the model handles syntax, but the judgment about what to build, what to trust, and what to verify is still entirely yours.
- Is vibe coding safe for production apps?
- It can be, but not by default. AI models optimise for code that runs, not code that is safe, because a working demo is what you asked for. The most common production failures in AI-built apps are private API keys shipped in the browser bundle, database rules left wide open, and admin or permission checks enforced only in the UI. None of these break your demo, which is exactly why they survive to launch.
- Do I need to know how to code to vibe code?
- No, but you need to know what to check. You can build and ship a real product without writing much code yourself. What you cannot skip is understanding what your app exposes to the internet: who can read your database, what secrets are in your bundle, and whether your permission checks run on the server. This manual is written to teach exactly that, without assuming a computer science background.
- How do I know if my AI-built app is ready to ship?
- Run the pre-launch checklist in this manual, then verify it from the outside. The failures that matter are invisible from your own browser, where you are logged in and clicking in the expected order. PeakStack drives your live app as a real user, tests what your landing page promises against what the app actually does, and probes your database for unauthenticated reads.
When you’re ready to ship
Get an invite to PeakStack.
This manual teaches you what to look for. Finding it in your own app is the harder half, because the failures that matter are invisible from your browser, where you're already logged in and clicking in the order you expect. PeakStack drives your live app in a real browser, checks what your landing page promises against what the app actually does, and runs the security pass this chapter describes: exposed keys, open database rules, client-side admin gates. You get a letter grade, ranked fixes, and an honest list of what we couldn’t check.
Private beta. Join the waitlist for an invite.