This is probably the most persuasive argument for why NOT to trust people who are vibe coding tools. Perhaps the best analogy for cybersecurity is health and safety in the real world. Let's take an example of a grocery store. My father in law used to be in health and safety and a supermarket chain here in Ireland. He explained to me that a lot of the processes that from the outside seem innocuous are there to legally protect the business. One such example is the signature sheet on the back of the door of a public bathroom at the supermarket. It's not only so the manager can hold people accountable for cleaning the toilets. It's also in case someone slipped and fell in there. There aren't any cameras, so if there is a signature sheet saying Emmet cleaned the toilets at 1:20pm and the person says they fell at 2:15pm, we can reduce our liability somewhat because we can show we weren't totally negligent, we implemented some best practices by having someone regularly putting eyes on the toilets. For data protection a lot of the controls you need to have in place are similar. Sure there are technical controls, like SSL, etc, but there are also organizational controls like training policies (that are enforced), etc. A lot of this is theatre, but a lot of it is practical things that do protect your customers data. @marclou is an entertaining/inspiring creator/indiehacker, but he has shown mild disdain for some of these types of things in the past when queried about Datafast and ShipFast. This is common across pretty much everyone advocating for vibecoding taking over the world. Vibecoding doesn't absolve you of your responsibilities to your customers and their data. I saw a guy on LinkedIn last week announcing his vibecoded project that helps you recover lost revenue from failed payments on Stripe. He literally declared it was vibecoded, and then in the next sentence said that it connects to your Stripe account. Nobody should trust that, it's craziness. Be careful out there!