Okba Allaoua

Got three outreach messages this week that all mentioned something specific about my product, referenced a post I made, sounded like someone had actually looked at what I do. Replied to one with a simple question. Took them over a day to answer something a real person would've typed back in a minute.

That's the weird part now. A bad cold email used to be easy to spot, generic greeting, no personalization, obviously copy pasted. Now the personalization itself is automated, so the one thing that used to signal someone actually cared doesn't mean anything anymore.

I wonder how people are handling this from both sides. If you send outreach, are you leaning into AI personalization or avoiding it because you think people can smell it now. And if you're on the receiving end, has anything actually worked to tell real interest apart from a well disguised template before you waste time replying.

Most of the vibe coding conversation is about speed and quality, how fast you can build and how good it turns out. Nobody really talks about the exit question. If you build inside a platform that hosts everything for you, how easy is it to actually leave.

Some tools give you a clean codebase you can download and run anywhere. Others keep the important parts, database structure, auth, backend logic, wired into their own infrastructure in a way that's hard to fully untangle. You don't notice this while things are going well. You notice it the moment you want to switch tools, bring in an actual engineer, or move to your own hosting and suddenly realize how much of your app doesn't travel with you.

Has anyone hit this wall for real. Did you end up rebuilding from scratch somewhere else, or did you manage to get everything out cleanly. And if you checked this before you started building, what did you actually look for.

Been thinking about this after seeing a few posts here about vibe-coded apps breaking in production. Auth bugs, webhook failures, that kind of thing.

What worries me more is the stuff that doesn't break loudly. No error, no crash, it just quietly leaks data or accepts requests it shouldn't. Things like exposed API keys sitting in the frontend bundle, missing rate limits, or database rules that let any logged in user read rows that aren't theirs. None of that throws an error. It just sits there until someone finds it.

For the non-engineers building real products with this stuff, what does your actual security check look like before you launch. Are you running anything to scan for this, paying someone to review it once, asking the AI itself to audit its own code, or just shipping and hoping nothing bad happens.

Curious if there is an actual workflow people are settled on, or if this is still the part everyone quietly skips.