The build-in-public SaaS that got found
A builder shipped a SaaS with an AI coding editor and shared the journey in a widely-read thread. Within days he reported it plainly himself: API keys maxed out, subscriptions bypassed, rows appearing in the database. The transparency made it the defining incident of the vibe-coding wave — and the clearest case study in what ships without a floor.
The reflex: Per-IP limits on auth and every public POST, server-side auth on every mutation, and keys that never reach the client.