Christian

I'm a veteran and solo founder with no formal coding background. Spent the last few weeks directing Replit's AI agent (with Claude as a strategic/QA partner) to build a real production app, entirely from my phone.

The part that surprised me: the "vibe" is the easy 20%. The other 80% was the same discipline any build needs catching bugs by hand (missing auto-capitalization, a timezone off-by-one, a file upload limit rejecting real phone photos), refusing to accept "it's fixed" without proof, running full walkthroughs section by section, chasing root causes instead of patching symptoms.

That's made me rethink what "vibe coding" even means. It's not skipping the engineering discipline it's relocating it. Instead of writing code, you're writing precise instructions, reviewing output critically, and doing QA like a hawk. If anything it demands more discipline, not less, because you can't rely on catching mistakes by reading your own code you have to actually test everything.

For others who've directed an AI agent instead of hand-coding: has your experience matched that, or did you find a different bottleneck? What ended up being the hardest part for you the instructing, the reviewing, or something else entirely?

Hey PH community I'm Chris, a veteran and solo founder. I built Actually Done because I got tired of losing track of bills, subscriptions, documents, and appointments scattered across a dozen apps and notebooks.

It's a life-admin app that brings all of it into one place bills, password vault, family records, expiring documents, reminders built entirely on Replit.

Launching July 21 and would genuinely love feedback from this community before then. What's the one piece of "life admin" you wish an app actually solved for you?

Been thinking about this after seeing a few posts here about vibe-coded apps breaking in production. Auth bugs, webhook failures, that kind of thing.

What worries me more is the stuff that doesn't break loudly. No error, no crash, it just quietly leaks data or accepts requests it shouldn't. Things like exposed API keys sitting in the frontend bundle, missing rate limits, or database rules that let any logged in user read rows that aren't theirs. None of that throws an error. It just sits there until someone finds it.

For the non-engineers building real products with this stuff, what does your actual security check look like before you launch. Are you running anything to scan for this, paying someone to review it once, asking the AI itself to audit its own code, or just shipping and hoping nothing bad happens.

Curious if there is an actual workflow people are settled on, or if this is still the part everyone quietly skips.