Where it quietly fails

Vibe coding is genuinely powerful. It also fails in specific, repeatable ways, and a course that only sells you the good half is worth nothing.

Here are the five that actually cost people money. Each has a tell.

1. Hallucinated APIs

The agent calls a function that does not exist. Not a typo — a function invented because it should exist. The name fits the library’s naming style perfectly. It reads like documentation.

Error: db.findUserByEmail is not a function

There is no such method. There is a find that takes a filter, and the agent generated the friendlier-sounding thing.

The tell: an error saying something “is not a function”, “is not defined”, “has no attribute”, or a package name that fails to install. This failure is loud, which makes it the nicest one on the list — you find out immediately.

2. Plausible but wrong

The code runs. It produces output. The output is wrong.

You ask for a discount calculation. You get this:

final = price - (price * discount)

Correct — if discount is 0.2. If your form collects 20 for twenty percent, every item is suddenly free or negative. Nothing crashes. The tests you did not write do not fail. You find out from a customer.

The tell: there is none, from the outside. This is why you run the thing with real-ish values and check the numbers by hand once. One deliberate check with a known answer catches most of these.

That exact discount bug, with three ways to meet it. One of them ends at the customer.

3. Security blind spots

The agent optimises for a thing that works. Security is a constraint you did not mention, so it is not in the target.

Common results, all of which run beautifully:

• Your API key written directly into a file that ends up published.
• An upload feature that accepts any file, of any size, from anyone.
• A page that shows you your own data, and also anyone else’s if you change a number in the URL.
• User input dropped straight into a database query — the oldest hole there is.

The tell: ask yourself who else can reach this. If the answer is “anyone with the link”, it needs a human read before it goes live. Level 3 gives you a checklist for exactly this.

4. Cost blind spots

Some code is correct and still ruinous.

An image is resized on every single page load instead of once. A paid AI call sits inside a loop over every row. A background job polls a service every second forever because nobody said how often.

The agent has no idea what your budget is, what a request costs, or how many users you expect. You never said. So it picked whatever was simplest to write.

The tell: ask “what happens if a thousand people use this at once?” and “does this call anything I pay for?” Those two questions take ten seconds and catch nearly all of it.

5. Silent scope creep

You asked for one button. You got the button, plus a refactor of three unrelated files, plus a new dependency, plus a renamed folder.

Every individual change may be defensible. Together they mean you can no longer tell what you approved, and the next thing that breaks has five possible causes instead of one.

The tell: look at the list of changed files. If files you did not expect are in it, ask why before you accept anything.

The pattern behind all five

An agent is rewarded for producing something that looks finished. It is not rewarded for saying “I am not sure”, “this will be expensive”, or “you have not told me who is allowed to see this”.

So it fills gaps. Always. Confidently.

Which gives you the only rule you need for the rest of this course: anything touching secrets, money, deletion, or other people’s data gets read by a human before it ships. Everything else you can learn by breaking.