The “prosumer developer” wave is here, it’s cool, and it’s a big deal. SaaStr itself is all over it. We’ve launched:
- A FREE start-up valuation calculator here
- A FREE VC pitch deck review here. It’s awesome.
- An entirely new SaaStr website at SaaStr.ai
- And more
We couldn’t have really done any of these without vibe coding. Not really.
And vibe coding platforms and no-code tools are getting better every week. And not just to help devs — Replit, Lovable and more have raced to $500m+ in new ARR just the first months of the year alone, in larger part focused on ‘prosumers’ and non-developers trying to put B2B apps into production.
And because of it, everyone thinks they can build the next Notion or HubSpot from their laptop in just an hour or so. Many claim they even have.
And the vibe is electric.
You really can just type in a prompt what app you want to build, and a prototype will come out in minutes that looks mighty cool. On the surface at least.
But here’s what almost nobody’s talking about in all those tweets: Security is the blocker in the end for many “vibed” B2B apps becoming production grade. Especially if you want to collect secure information, store it, etc.
The Issues I’ve Already Seen. And They Are Real Ones.
I’m about 150+ hours into vibe coding several apps, including the new SaaStr homepage at SaaStr.ai.
Here are the security issues I’ve already seen.
These are just the ones I’ve seen, and it’s a partial list:
- User Enumeration: Se quential user IDs that let you iterate through every user in the system. User 1, User 2, User 3… it’s a basic security issue. If someone gained access to your system, they could access user by user by typing in user/123 user/124 user /125 etc. No one builds this way anymore, but Claude does, so the ‘prosumer’ vibe platforms do.
- Email Leakage: Group emails showing up in the To: line, exposing who else is using the platform. The issues I’ve seen have been limited in scope, but they could have been much larger in full production.
- Broken Access Controls: The ability of one user to see another user’s data due to faulty access controls and log-in logic. This is a big issue. And one I’ve seen more than once. That should give anyone pause.
- Dev/Prod Database Co-mingled: Development and production sharing the same database. Test users mixed with real customers. These are real issues and not one any real commercial app would have. Some progress has been made here by leading vendors, but the default is still to combine data in one database.
- Plain Text Storage of Private Keys: API keys, database credentials, third-party secrets stored in plain text. In the app. The leaders have added security scans that can pick much of this up, but it remains a big and real issue. An app I just build again the other day once again stored secret keys in plain text. Yes, the scanner caught it. But it shouldn’t have happened — again.
- Session Management Flaws: Password protection that you can bypass by navigating directly to a protected page. Or clearing cookies. Or opening an incognito window.
- Limited Database Encryption: The ‘prosumer’ apps do encrypt data at rest, which is good, but that’s not enough for everything. There is no default protection at column level or otherwise. In the end, customer data, PII, etc. is sitting in plain text in the database. This may be deemed ‘OK’ for many apps by developers, but it’s still an issue.
- SSO Integration Failures: Use the default SSO the vibe coding apps offer, because when I’ve tried to implement third party SSO from Google to LinekdIn — it often doesn’t actually authenticate. Or validates against the wrong tenant (yikes!). Or both.
- AI Agent Rewriting Code. This is perhaps the biggest ‘meta’ issue. Every time you log into the AI agent, it can and might rewrite code you thought was ‘secure’. Even for seemingly small matters or fixes.
This isn’t just “a few bad apples” or minor issues. Not is it as one very senior exec at a leading vibe coding app called it “just security stuff, it happens.”
This are systemic, material security issue when using Claude to write code quickly. And to some extent, this is what happens when you optimize for speed and skip the security fundamentals. And it’s still happening to me. Even with lots of improvements from the leading vendors.
And it’s true at every ‘prosumer’ vibe coding platform. It’s not unique to any one of them.
The Ongoing Security Evolution
Leading prosumer platforms are making rapid, real progress.
They get more and more secure every week, and I’m confident many of these issues will be resolved in coming months. Lovable has just hired a cracked security team, Replit has added built in tools to enhance security.
But not all of the issues for a truly safe B2B production have been resolved. Not if in the end of the day, they are mostly just using Claude to write whatever code … Claude wants to write. And whatever corners Claude wants to cut. The platforms will work around the corner cutting, add more and more guardrails, and add more security. But Claude alone cannot be trusted. The underlying platforms (Claude + OpenAI agents) cannot be trusted to build secure software. That is in their goal seeking natures.
And importantly for folks building a commercial-grade B2B app without a developer” security is never finished. And it’s always stressful. Every new feature introduces new attack vectors. Every integration creates new vulnerabilities. Hackers don’t take breaks while you’re shipping features.
The major B2B and SaaS platforms understand this. They have dedicated security teams working full-time on threats that don’t even exist yet. They’re not just patching known vulnerabilities — they’re anticipating unknown ones.
You might think Squarespace or Shopify are seemingly simply platforms. They aren’t under the hood. And one thing they have huge, huge teams working on is security. So you don’t have to worry.
When you vibe it on your own? All of a sudden those security concerns are on your back.
Most prosumer developers are still in reactive mode. Build first, secure later. That approach works for weekend projects, but not for business-critical applications.
The big question in many ways is — whose fault is it? Can we expect the ‘prosumer’ vibe leaders to be as secure as Shopify and Squarespace? I say Yes, since their marketing claims as much. They all claim you can vibe code an app in minutes. From one prompt. Shouldn’t enterprise-grade, or least Shopify-grade, security be part of that?
Why “Junior Devs Would Make The Same Mistake” Isn’t Good Enough
Could a junior developer make these same mistakes? Absolutely. Probably every developer has made most of the mistakes on the list above.
But junior developers don’t usually ship to production without oversight. They have senior developers reviewing their code. They have security teams running audits. They have established processes and frameworks that catch these issues.
Prosumer ‘developers’? They’re flying solo. No code review. No security audit. No established patterns. Just ship fast and figure it out later. Most don’t even know what a security audit is, or what the most common issues are. Let alone to look for them. Let alone that they even have to, or should.
The Real Competition Isn’t Other Prosumer Tools
Everyone’s comparing their tool to other no-code platforms. Replit vs. Lovable vs. Bolt is fun to watch.
But that’s the wrong comparison.
The real competition is Shopify and Squarespace to build. And HubSpot and Notion to buy.
These companies employ hundreds of security engineers. They spend millions on penetration testing. They have dedicated compliance teams for SOC2, GDPR, HIPAA. They have bug bounty programs where researchers hunt for vulnerabilities full-time.
When a customer chooses your prosumer app over HubSpot, they’re not just choosing features. They’re choosing to trust you with their business data instead of a company that’s invested decades and hundreds of millions in security infrastructure.
That’s a massive responsibility. And one most ‘prosumers’ aren’t equipped to take on.
All The Marketing is Ahead of Reality, Especially in Security
The prosumer coding dream is intoxicating:
- “Build exactly what you need”
- “No vendor lock-in”
- “Ship in days, not months”
- “Total control over your data”
Even Microsoft and Google make this claim. Not just start-ups.
Even GitHub says you can now dream it in a single click. That’s … aggressive at best. I honestly can’t believe Microsoft lawyers would ever really allow it. They probably had to under pressure. Because Lovable, Replit, etc. plus Cursor and Claude Code for devs are growing at an insane pace.
The security reality is sobering:
- You’re responsible for protecting customer PII
- One breach can destroy your business (and possibly your customers’)
- Security isn’t a feature you add later
- Security isn’t something most ‘prosumers’ even understand, but compliance isn’t optional for commercial B2B software
Why “Roll Your Own” Isn’t Ready Yet For Paid Commercial Apps. At Least, Not In Many Cases.
To be clear: I love vibe coding. The tooling is impressive. The velocity is real. The customization possibilities are endless.
But we’re still in the very early innings.
Security-first frameworks don’t fully exist yet. There’s no “Rails but for prosumer apps” that bakes in authentication, authorization, encryption, and compliance by default. At least, not enough of it. Not Shopify-grade.
The current prosumer stack optimizes for building fast, not building securely. And until that changes, most prosumer apps are ticking time bombs.
The Path Forward
What would make prosumer development actually viable for commercial business applications?
- Security-First Frameworks: No-code/low-code platforms that make the secure choice the default choice. Where you have to actively opt out of encryption, proper session management, and access controls.
- Built-in Compliance: Platforms that handle SOC2, GDPR, HIPAA compliance automatically. Where data handling, retention, and deletion policies are configuration, not custom code.
- Security Auditing Tools: Automated scanning that catches the common vulnerabilities before they hit production. Some of the platforms do have this now, which is great. They have to keep going further.
- Education and Standards: Security training specifically for prosumer developers. Common patterns and anti-patterns. A culture that values security as much as shipping speed.
‘Prosumer’ Vibe Coding is Huge. It Will Get Better. But It’s Not Secure Enough — Yet.
The prosumer development wave is real and it’s not going away. The tools will keep getting better. The barrier to building software will keep dropping.
But until security becomes a first-class citizen in the prosumer stack, most “roll your own” projects remain limited as commercial, paid apps.
Your customers trust you with their data. Security isn’t a one-time implementation — it’s an ongoing discipline. The threat landscape evolves daily. What was secure yesterday might be vulnerable tomorrow.
The prosumer dream is exciting. But excitement doesn’t protect customer data.
Continuous, disciplined security practices do.
And a deep dive on this and more on the top 10 things to think about before you start vibe coding your own B2B app here:
