A vibe-coded product isn't done at the first deploy

The vibe coder’s mistake is believing that once the product is “done”, you’re set…

…except that…

In the last few weeks alone

• PHP: 2 critical vulnerabilities, already exploited (in code more than 10 years old)
• Next.js (which AI loves): 2 critical RCEs in mid-October (after others in September, in August…)
• Microsoft: 1,094 (yes, you read that right) vulnerabilities fixed in a single patch this week. Including an Outlook flaw already being exploited.
• Node.js (another AI favourite): one security release after another since early 2026
• Cloudflare: no vulnerability, but outages (February 2026, November 2025)… that hit a big part of the web

And it’s speeding up!

The numbers

We’re talking about more than 95,000 CVEs published since early 2026. That’s about 2.3 times the same period last year.

The cost of a data breach? $4.99M on average.

The CNIL, France’s data protection authority?

• €42M for Free in January
• €500k for a private hospital in September

It doesn’t only hit the giants (we saw it with the CVE on Lovable apps).

A project starts at the first deploy

AI is an incredible tool for a prototype, or in the hands of a professional who knows the trade.

But a project doesn’t stop at the first deploy… it’s only just starting:

• dependency updates
• patches to apply (every week…)
• monitoring

And one vulnerability can be enough to sink your company: lost customer trust, fines…

In short, get support from professionals.

Especially since, today, you no longer need someone full-time on it.