# Where it quietly fails Course: Vibe Coding 101 — https://zero2vibecode.com/learn/vibe-coding-101 Canonical URL: https://zero2vibecode.com/learn/vibe-coding-101/0-3-where-it-fails The five failure modes that cost people real money — hallucinated APIs, plausible-but-wrong logic, security blind spots, runaway cost, and silent scope creep — and the tell for each one. Vibe coding is genuinely powerful. It also fails in specific, repeatable ways, and a course that only sells you the good half is worth nothing. Here are the five that actually cost people money. Each has a tell. ## 1. Hallucinated APIs The agent calls a function that does not exist. Not a typo — a function invented because it *should* exist. The name fits the library's naming style perfectly. It reads like documentation. ```text Error: db.findUserByEmail is not a function ``` There is no such method. There is a `find` that takes a filter, and the agent generated the friendlier-sounding thing. **The tell:** an error saying something "is not a function", "is not defined", "has no attribute", or a package name that fails to install. This failure is loud, which makes it the *nicest* one on the list — you find out immediately. This gets worse the more obscure the library. Popular tools appeared thousands of times in training; a niche package appeared twice, so the details get smoothed into whatever is most common. ## 2. Plausible but wrong The code runs. It produces output. The output is wrong. You ask for a discount calculation. You get this: ```text final = price - (price * discount) ``` Correct — if `discount` is `0.2`. If your form collects `20` for twenty percent, every item is suddenly free or negative. Nothing crashes. The tests you did not write do not fail. You find out from a customer. **The tell:** there is none, from the outside. This is why you run the thing with real-ish values and check the numbers by hand once. One deliberate check with a known answer catches most of these. That exact discount bug, with three ways to meet it. One of them ends at the customer. ## 3. Security blind spots The agent optimises for a thing that works. Security is a constraint you did not mention, so it is not in the target. Common results, all of which run beautifully: - Your API key written directly into a file that ends up published. - An upload feature that accepts any file, of any size, from anyone. - A page that shows you your own data, and also anyone else's if you change a number in the URL. - User input dropped straight into a database query — the oldest hole there is. **The tell:** ask yourself who else can reach this. If the answer is "anyone with the link", it needs a human read before it goes live. Level 3 gives you a checklist for exactly this. Never paste an API key or password into a chat, a prompt, or a source file "just for now". Just-for-now is how keys end up in public repositories. Level 4 covers where they actually go. ## 4. Cost blind spots Some code is correct and still ruinous. An image is resized on every single page load instead of once. A paid AI call sits inside a loop over every row. A background job polls a service every second forever because nobody said how often. The agent has no idea what your budget is, what a request costs, or how many users you expect. You never said. So it picked whatever was simplest to write. **The tell:** ask "what happens if a thousand people use this at once?" and "does this call anything I pay for?" Those two questions take ten seconds and catch nearly all of it. ## 5. Silent scope creep You asked for one button. You got the button, plus a refactor of three unrelated files, plus a new dependency, plus a renamed folder. Every individual change may be defensible. Together they mean you can no longer tell what you approved, and the next thing that breaks has five possible causes instead of one. **The tell:** look at the list of changed files. If files you did not expect are in it, ask why before you accept anything. ## The pattern behind all five An agent is rewarded for producing something that looks finished. It is not rewarded for saying "I am not sure", "this will be expensive", or "you have not told me who is allowed to see this". So it fills gaps. Always. Confidently. Which gives you the only rule you need for the rest of this course: **anything touching secrets, money, deletion, or other people's data gets read by a human before it ships.** Everything else you can learn by breaking. None of this means "do not vibe code". It means you now know the five places to look, which takes about a minute per feature. That minute is the whole difference between a good story and an expensive one.