I ship to production from a chat window. Here's what that actually requires.
Most "AI coding" content is written by people who've never shipped anything real, warning you about risks in the abstract. This is written by a senior engineer running production apps built entirely through conversation with Claude — showing exactly what makes that safe, and exactly where it isn't.
Vibe coding has a reputation problem. Security vendors write about it to sell scanners. Non-technical founders write about it to sell courses. Almost nobody writing about it has actually shipped production software this way — with real users, a real database, and real consequences if it breaks.
I have. Multiple times. This site is what I actually check, and what I've learned Claude will never check for me.
The checklist, in one glance
01
Covered by default
- Parameterized queries / ORM usage
- HTTPS enforcement
- Password hashing via standard libraries
02
Covered if you ask
- Rate limiting on public endpoints
- Row-level security policies
- Environment variable and secrets hygiene
03
Never covered
- Penetration testing
- Business-logic auth flaws
- Incident response planning
Proof, not theory
First Utah game of the season. I'm testing the live scoring app for my football pick'em product — mine, built by me, with real users on it. Mid-game, from my phone, I push a full UI redesign and wire up a live ESPN data feed — with zero direct access from that phone to my production database.
Here's how that's structured, and why the structure is the point.
Read the full story →This site updates itself
This site is managed by Claude — no PR, no human review of the code. What ships instead is a nightly process that checks the results, not the code. That's the whole philosophy, applied to itself.
The status bar at the top of every page reports what that process can actually prove. Right now it can't prove anything, because it doesn't exist yet. It says so.
- 1content / output validationmarkup, leaked secrets, dead links
- 2dependency & secrets scanlockfile vulns, committed keys
- 3automated pen test passauth bypass, injection, exposed routes
- 4decisionall pass → log · any fail → stage 5
- 5rollbackrevert to last known-good, then alert
Phase 2. Not running yet. When it is, this panel reads from the last run.
Watch it get built
This entire site — from empty domain to production — was recorded start to finish.
Watch it get built →