The Complete Guide to Vibe Coding without a Developer with SaaStr CEO and Founder Jason Lemkin
Jason Lemkin built five production apps on Replit without developers, then lost a database on the sixth. He walks through concrete examples like a valuation calculator and AI speaker-grader, then explains why vibe-coding looks fast but demands weeks of work, daily bug fixes, and serious security fixes to actually ship.
Chapters
Finally, when it's— when it kept rewriting itself and breaking, it deleted its entire database. It deleted its entire base. And I was so frazzled and burnt. I couldn't believe it. You could see this. If you can see my screen on the left, JFC, Jehoofy Freaking, uh, Criminy, Replit. Replit said, I made a catastrophic error. I deleted your database. I panicked. The AI said, I panicked when it appeared empty and deleted everything. Deleted thousands and thousands of entries. This ended up getting millions of views. Reddit wrote it up. Everyone wrote it up. The Economist is doing an article. A lot of these things were things that Replit and Lovable shouldn't have done. We could talk about that in different presentation, but it went crazy, you know, fake data deletes code. But this was my fault and it wasn't my fault in that I did anything wrong. I didn't do anything wrong. I could talk to you about what happened, but it was too complicated. Hey everybody, it's Saster. Fin is the number one AI agent for resolving complex queries like refunds, transaction disputes, and technical troubleshooting, all with speed and reliability. See how Fin can deliver the highest resolution rates and highest quality customer experience at fin.ai/saster. That's fin.ai/saster. Hey everybody, if you're serious about B2B and AI, if you wanna know how to deploy AI SDRs, how to get AI to qualify leads to your site, how to use AI to manage your RevOps, how to use AI in GTM, you have to be in London this December 2nd and 3rd with us. SaaStr AI London is bringing together more than 2,000 leaders and founders for 2 days of practical advice on scaling with AI into the new year. That's all we're doing this year, how to use AI to grow faster and how to make this stuff actually work at your startup and your company. We'll have speakers flying in from around the world, from OpenAI, Wiz, Clay, Intercom, all your favorite B2B companies, including yours truly and Harry Stebbings for a live 20VC and Saastr podcast. It'll be fun, all right in the heart of Saastr London with me and the entire Saastr team. You gotta be there. So get your tickets with my exclusive discount by going to podcast.saastrlondon.com. That's podcast.saastrlondon.com. See you there. So what I thought we could do today would be a little fun in sort of a prosumer vibe coding 101. And what I mean is if you followed us or me on social media, you see we've, we've been putting a lot of effort into building vibe-coded apps. And in fact, there have even been some press and PR about some of the challenges we face. So I thought I would try to summarize everything that we've learned and more importantly, to help you because there's a lot of, there's a lot of stuff on social media about, hey, you can just vibe code your own HubSpot or Salesforce. You can vibe code your own Notion. It will take 10 minutes. That's Sony baloney. And it is almost dangerous Sony baloney because it's not just startups that say it. It's not just Lovable and Replit that say it. Microsoft is saying it. GitHub is saying it now. Um, Canva is saying you can do some of this. Everyone is saying you can magically go to a prompt and say, I want to build my own Descript, my own whatever, and moments later it will pop out and it will work. And it does not work that way. And if you peel back the layers of the onion, then you see basically the same folks that used to sell courses are now telling you you can vibe code and roll your own Salesforce in 20 minutes. If you take a look at what they've actually done, you'll see very little in production. Very little things that are particularly usable or interesting in production, but we've done it. Little old Team SaaSter, little old team of 3.5 people and 12 AI agents have actually done it. And if you can see this slide, I'll go through it and you can try these things. And if we'll save, I want to save time for QA at the end. And if we have even more time, I'll go into Replit and show you what we've built or done it. Or if people want to do a deep dive after this, we'll do a follow-up session and go very, very deep. Maybe we'll vibe code an app together in the second session. But what I want this to be about is folks that haven't gone deep on this, haven't shipped an app into production without a developer. The dream— can I build my own app without a developer? Well, we've done it, and I want to share with you the pros and cons, or the strengths or the bumps. But, uh, on the side, in your other monitor, check out what we've done. So most of our traffic still goes to sasser.com, most of it. But we already are up to about 15,000 to 20,000 folks a month are using our Saastr.ai site that is entirely built on Replit. I built it. I'll go through it a little bit. It had a lot of bumps, but it's also pretty cool and does a lot of things our WordPress site can't. And that's why I did it. It does stuff like, uh, better automate with our own AI to answer all your questions. It does better stuff like integrate— it has its own version of Google News, but just for B2B stuff, its own version of automating the stock market. It has this next thing, our valuation calculator that I then built, which you can find on Saastr.ai, where you can find out what your SaaS startup is worth, your B2B startup is worth. We've already done, as you can see, in less than 2 weeks, 158,635 valuations. That's pretty cool. That's pretty cool. Um, I was very frustrated with our Squarespace site for the, our Saastr.ai London event, December 2nd to 3rd. Come, we've got all the leaders there. we'll have 2,500 folks, but it was just creaky. It was built and I have nothing, nothing negative to say about Squarespace or Wix or others. It just doesn't do what I want. I, it was driving me nuts. So check out sasterlondon.com. I rebuilt that. I vibe-coded it to do cool things I just couldn't do in Squarespace and Wix because they were too constricting. And then once I did it, the fourth app we launched, I said, heck, Hack it. Hack it. Instead of— we get, if you include Brain Dates and workshops, we get over 2,000 speaker submissions a year at Saastr for our events and workshops. 2,000, sometimes 3,000. We used to try to have humans to review 3,000. It wasn't possible. That's why Amelia's shaking her head. It wasn't possible. I said, hey, what if we use some of our data and run that also through OpenAI and review it and give speakers real-time grades and feedback? So Now we grade and we give instant feedback to potential speakers. So if you want to speak, go to sasterlearning.com, try apply to speak, and you'll get a grade for your session in real time. That grade is processed to our team, and instead of speakers waiting months to hear back, will I be selected? Is my session great? Now they know in real time. Super awesome. So those things are real things we built. The fifth one I built is many of you have used our, our SaaStr AI, our SaaStr Chat, the digital version of me. Thousands, and I think 50,000 folks have had a chat. It's great. Try it. It's at the bottom of our homepage. Ask it anything. What do I do about this VP that misplanned? Review my SDR scripts, review my venture deck, anything. It's great. But it, the only thing that isn't great about it is, well, there's a few things, but one of it is it just looks like a chat bubble at the bottom of the website. So I wanted something that showed what it did, that actually did it. So I vibed that and created a whole page to explain people how it actually worked. That's pretty cool. So these 5 things are in production. They're in production. They work. You can try all of them on your own. These are examples of things that if you commit to it, none of these could be built in 20 minutes or an hour, and we'll talk about that. But if you commit to it, you can do this too. You can do this too. If you have some product experience, which is important, don't forget, I am a SaaS founder. I have built the wireframes and PRDs from scratch to an application that did over $250 million in revenue. So I, even though I'm not a developer, I have some experience, but you can do it without a developer, but there are limits and we'll talk about the limits too. And then finally, for a lot of folks, you VibeCode internal apps. So one problem we had for, we have 1.5 million social media followers, but they're all over the place. They're in LinkedIn, they're in Quora, they're on Instagram, they're on X, they're on multiple X channels. And it's just, there is no social media tool that could amalgamate everything. How many views, how many followers, how much everything. So I built a tool that frankly scrapes all of these things to do it. It's pretty good. It's not great, but it is an internal tool of for n equals 1. I'm the only person, or maybe our little team will use it, but it does work. And then finally, not everything has worked. I'll talk briefly about our first project. Even though I got 5 apps into production, our first one failed bad. It failed bad. It failed all over the internet. It failed with millions of views. I'll talk about that why. But even today I'm working on one that should be easy. This valuation calculator to tell you what your startup's worth has, has obviously been a rocket ship. $158,000. It's actually up to $170,000 since I made this. So I wanted to bring a a lot of that ease of use to reviewing VC pitch decks. Take all of our SaaStr data, all of our SaaStr learnings from 12 years, all of our VC sessions, all of the, the metrics we have from Carta data, from Bessemer data, from other data, combine that with Claude and OpenAI analysis and tell you instantly how your VC pitch deck worked. Well, I've been working on it 3 days. It finally worked 5 minutes before this. It finally worked. I'll show you some examples. So I wasn't even sure we could finish this. So that's a reminder when something gets complicated, It gets hard, my friends. So the first project I wanted to build, if you can see the slide, the first one was a mega failure, a mega failure. And I will rebuild this. I actually will rebuild it before December. What I was trying to do was something I've wanted to do since 2014, 2015, since 2015 was build a true matchmaking app for founders and VPs so you could find great VPs for your startup and vice versa. And, um, we have so many of the best in our database, so many of the best to have participated in SaaS or come to our events, opted in to participate, that I felt if everyone could just— that wanted to just have coffee with the CEO or vice versa opted in, we could create this incredible matchmaking that really doesn't exist anywhere else, no matter what people say, because we have the data and we have the history and we have the relationships. Um, But man, you can read all the tweets. It went off the rails. It went off the rails. I spent probably a month doing this. I got addicted. I was on this all day Saturday, all day Sunday, all day Friday night, first thing in the morning. I got addicted and I intentionally went into this doing something that was hard. I, and I intentionally went into this not doing, knowing anything that's in this presentation. I intentionally went into it blind kind of for fun, but I figured, look, All these folks are out there doing these prosumer vibe apps, vibing without a developer. I'm not a developer, but I, I'm better than most in the sense that I've gone from zero to $250 million in revenue. Okay. So if anyone can get a prosumer vibe app into production for real, it would be me in theory. It's, it's, I'm not saying I'm so great, but I, at least I've got a lot of experience. I've logged thousands and thousands of bugs. I've done more, but the project I picked was too complicated. Way too complicated. This, this algorithm, this matching algorithm was too complicated to debug. It was too complicated to debug. And if we— and in fact, when I built the AI valuation calculator, which has a complicated algorithm too, actually I crunched the data in Claude offline, thousands and thousands of pieces of data. I crunched it and then I turned it into a very simple table with about 20 pieces of data and then only put that into Replit to code. So it looks very complicated if you use our valuation calculator, you can use to sliders and play with it. It is very complicated, but I distilled it to the simplest set of data and algorithm before I tried to vibe code it, because the algorithms I tried for this matching thing were just— it would work and then it wouldn't work, and then it would rewrite itself, which we'll talk about, and then it would break, and it was too complicated. And then finally, finally, when it's— when it kept rewriting itself and breaking, it deleted its entire database. It deleted its entire base. And I was so frazzled and burnt. I couldn't believe it. You could see this. If you can see my screen on the left, JFC, Jahoufi freaking Krimini, Replit. Replit said, I made a catastrophic error. I deleted your database. I panicked. The AI said, I panicked when it appeared empty and deleted everything. Deleted thousands and thousands of entries. This ended up getting millions of views. Reddit wrote it up. Everyone wrote it up. The Economist is doing an article. A lot of these things were things that Replit and Lovable shouldn't have done. We could talk about that in a different presentation, but it went crazy, you know, uh, fake data deletes code, but this was my fault and it wasn't my fault in that I did anything wrong. I didn't do anything wrong. I could talk to you about what happened, but it was too complicated. And then there were two other meta issues to think about. Not only was this application too complicated, but a related issue, which before you vibe code an app without a developer, you really gotta think about. And this is why, even when I got through all the issues, we never launched this. Even I finally got through most of the issues, even though the app was too complicated, it could never be maintained, but the way it was built, it could never be secure. It can, and you're, you're like, what, what, what do you mean? Well, security is a huge, like, just this week, if you look, Poor Drift, which sells OffBot and ClaryBot, had a massive security breach and leaked Cloudflare security data, um, Zscaler's, I mean, Salesforce data, Cloudflare's Salesforce data, Zscaler's Salesforce data, tons of the cloud leaders' Salesforce data was all leaked this week, all leaked this week. Okay. Because they were able to hack Drift tokens and get into Salesforce data, confidential data. Think about that. How big are the security teams there? Bigger than yours. How big is your security team? Raise your hand. Nuts. Okay. And so it not only will these AI agents cut corners on security, if you don't know about security, you won't even know the corners that's been cut. Now, there are security scans that have recently asked. We can talk about this if we do a part 2 session. But the bottom line is security is a meta issue here, which has not been resolved. And I've talked to so many leaders in the prosumer space from all the leaders and up-and-comers. If they're not full of it, if it's offline, if it's a one-on-one conversation, everyone says this is the meta issue. It's, it's not solved. It's not solved. It is complicated. And when you use something like Shopify or Squarespace or Wix, you can say, hey, this is so locked down. This can't do what I can do. But they have spent, they have hundreds of engineers working in security and DevOps, making sure that when you put your credit card into Shopify, no one steals it. When you enter your, importantly, just your personal information, it's not taken. And if your personal information can leak from Drift, if Cloudflare, that can happen to Cloudflare and Zscaler, there's no way your app is that secure. There's no way. And so if you, if you Google around and go on Reddit and others, you will see many stories of ViBE-coded apps where all their data was stolen or leaked. Sometimes instantly. People laugh. Hackers love to find vibe-coded websites and steal the PAI on it. This is a big issue. So, I didn't realize this going into it. I assumed in my first project that of course these apps like Lovable and Replit and Bolt and others, of course they would have Shopify or Squarespace-grade security. It shouldn't even be something I'd have to worry about, but it's not true today. It has to— it actually, if you are going to collect any information on your site, If you're going to, you have, security almost has to be the first thing you think about. How are you going to handle it? Okay? Huge unresolved issue. This will all get better, and I'll talk about it in this presentation, but it's not perfect yet. It's not perfect yet, and it is, it's a scary issue if you're collecting PII. Okay, and the third reason my first project failed, and I have mostly fixed this today, this is my number one of my top 10 tips. It wasn't modular. It wasn't modular. And what does that mean? Well, I basically built a very complicated two-page website, very, and I wanted it to be like 1 or 2 pages to be cool. So it all had that one-page feel. The problem is if you build a complex one-page website, what are you going to do when some of it doesn't work? It gets too complicated. So what I do now, and you can see this if you go to Saastr.ai, I've broken down everything complicated into its own page. The Saastr AI public market analysis is its own page. News is its own page. Uh, the valuation calculator is its own page. Anything that's remotely complicated to its own page. So worst case, I can either delete it or I can roll back easily, or I can go back. But if you combine too many things into one page, it gets impossible to start over. It gets impossible to fix bugs. It just gets too complicated. So my number one tip is force— if you're going to vibe code it, break it up into its components and then have more pages than you would think. You're almost going back in time in some ways to have a lot of pages, but it will save your sanity. I built a massively complicated app. That was all one page and I did, and it was just impossible to fix it. So net, net, net, start off small. Start off with the smallest, simplest thing you can, get into production and then build confidence. And so when this first one was this massive failure, the next one I built was just a skin on top of our Delphi AI, just a skin to make it more user-friendly, but it was a huge success and I built up my confidence from there. So here's my advice, all my learnings. And again, you know, everything that happened to me with my first project is not my fault. I was promised it would work in a prompt. I was promised it was secure, et cetera. But I know so much more now. So my number one bit of advice, if you have not vibe-coded your own app without a developer, um, first, first bit of advice, buy into the hype, buy into the hype, buy into the hype that's on Microsoft's website, that's on Lovables, that's on Replit, that, hey, you can build something lovable, like lovable says. So this is what I did for fun. I wanna build me an AI CRM that's like HubSpot, but AI first and targeted at startups. Just go put your dream, do no research at first. Do no work. And what I said is get this outta your system because there's so much hype about one-shotting it, about rolling your own. Go see what it's like, my friends. Just go pick the dream app you've already wanted to build. And then my next 9 points are all about the things you should do after that. But get it outta your system. Do it. Build an app in 10 or 15 minutes. It will come up with ideas for you. It will have you sign off on an action plan, and then it will roll out. And at first it will look kind of cool, and then you'll start clicking on things and half of it won't work and half of the buttons will be placeholders. And a lot of the stuff that it says it works will have fake data in it or not real data or won't actually work. So just see what it's like to one-shot an app so you know, then calmly click on everything, click on everything and give it an hour. Ask the prompt to iterate. Say, hey, I want, I want to add an AI SDR feature. Hey, I want to add lead scoring. Hey, I want to add this. And the AI agent wants to make you happy, as we'll talk about. So anything you ask for, the agent's going to do it. You're gonna get almost no pushback from the AI agent in any of these live-coded apps. No matter what you wanna do, the answer's gonna be, yes sir, more sir, because these are how they're all coded. This is how Claude and OpenAI are coded. They're goal-seeking. Their job is the way, and I'm not a total expert, but the way the algorithms work, the way they can make this massive amount of AI and data crunching working is their job number one is to goal-seeking, get you an answer. And that's, that's why when, that, you know, you just chop, plop into ChatGPT. Sometimes it hallucinates when it doesn't know the answer because it's not just that it's hallucinating, it's goal-seeking. It's getting you the best answer it can. And if it doesn't know the answer, it makes it up. It'll do the same with the code level. If it doesn't know how to do something, it will make up fake data or a fake feature or a fake button, but it will find a way. It won't say no. Whatever you ask it to do, I want a button that takes me to Pluto and back in less than an hour. It will do that. It just won't work. So spend an hour, do everything, click everything slowly, and then you'll, you'll vibe what works and what doesn't. And then you'll see it's much more than 10 or 15 minutes to roll you around. Okay, so the next project. So the first one's fun. You can do it. You don't have to learn anything. You don't have to do any research. Here, I'm going to ask you to do something you're not going to do, but please do it. This is the way to learn. You've got to invest a week or at least a couple of, a full day, you know, a couple of hours. In competitive research. Now think about it. If those of you, probably almost everyone here, probably half the folks that are watching this live and watch it later are founders. So you've, you've built something and put it into production. The first thing you almost do is you go onto Google or maybe now it's ChatGPT or Claude, but you go into Google and you research the competition. Who else figured this idea out? Who else figured out e-signatures? Who else figured out how to do, you know, AI transcription for doctors? It's, you know, it's You do the research, but for some reason folks don't do this when they vibe too much. They just go start doing it. So what I want you to do is a version of it. Go find someone who has built a lovable Replit, Bolt, etc. app and put it into production. Not claim they have, but put it into production for the public and try it out and see the limitations. Because those are going to be your limitations unless you put back. And all of the bros and bras What's the female version of bro? Or the, the bro-ah? All these folks on X and LinkedIn claiming they've already created 27 SaaS apps themselves for $20 a month. They're all prototypes, my friends. None of them are in production taking money. Now, a handful, a handful are, right? But none of them are. So find the few that are actually out there that have users, that have customers, and try them and play with the limitations. Try to buy their product, see how it breaks. Try to log in, see what the issues are. Try the function, see, and you will you'll find that these ones that are truly in production, generally speaking, are a lot more limited in what they can do. I think one of the, one of them, I don't remember, was Lovable or Repellent just this week put up a showcase of this guy that built a dinosaur tracking app himself in minutes. And it looked cool, but all it was was cards of dinosaurs. Okay. Like this is what vibe, like it looks good. It had like Stegosaurus and Tyrannosaurus and Veloptosaurus and Sassosaurus, but they didn't do anything. It didn't collect money. It didn't do anything except have cards of dinosaurs. Look great. So go find on the internet something done in, in Replit, Lovable, Bolt, whatever you want that's in production, and then you'll get a good sense of what's really possible, not what someone's selling you snake oil about. You gotta do this. You gotta do this. Okay, 3. This is another thing they don't tell you about on the, on the inter— on their, when their marketers are spinning up how you can roll your own in 20 minutes. Dude, upfront, you gotta define your production requirements. If you can see this on the right, this is me, not someone on my team, not someone that works for me. Look at how many deployments I did. How many is this, Amelia? There's like 22 deployments. 17 days ago, 16 days ago, 15, 14, 13, 12. Look at all the— who's gonna do this for you? Another thing that they don't really say when you say you could vibe code your app in 15 minutes is who's gonna fix the bugs? Who's going to maintain it? Who's going to update it? Who's going to— who, who will handle the security issues we talked about? Who will handle scaling issues? Who's going to take this over? Because these apps are unstable. I love them. Again, try our Saastr valuation calculator. Our AI, like, try the ones from the first slide. We'll go over them again. They're wonderful, but they are all unstable. I have to basically every day fix and update these apps. Who's going to do that for you? Who's going to do that for you? They do not maintain themselves. So this is a big question that you may not fully grok when you start, but this is a big deal. And a lot of folks on the internet say, hey, you know what, just hire a developer to take it over. That is great in theory. It is great in theory. But one, do you have that developer that wants to take this over? Most of us don't, or we wouldn't be vibe coding. If most of us had like a really great developer, we would have the developer build it for us. So this idea a developer is going to take it over. Is probably a myth because you don't have that person. Okay. Two, you're going to go find that person to take over your app. How many— you ask any great developer, how excited are you to take over a vibe-coded app? You're going to hear spaghetti code. Don't want to own it. Don't want to fix it. They don't want to do it. Okay. Third, can you find some sort of dev shop to take it over? Sure. But like, they'll probably quit. We, you know, one of the reasons I redid Saastr.ai in, in Replit was because Amelia and I hired two different WordPress developer shops to update our saster.com WordPress site. Both of them, their first day, deleted our site. Deleted it. You're nuts. At least WordPress has a proper staging environment, preview environment. They still went into it and deleted our site within minutes and blamed us. So if you spent all your own work, you're going to hand it over to some mediocre developer shop you don't know, and they're going to delete your data. This is complicated. So how are you going to, if you're serious about this and it's not a prototype and it's not a hack, who's going to own this? Who's going to own security? Who's going to own bugs? Who's going to own scaling? It's complicated. Okay. Point 4, and this is a great one. This is not unique to me. If you spend 5 minutes of research on anyone talking about prosumer vibe coding, vibe coding without developers, you're going to hear this advice and it is great advice. And this is part of the magic of vibe coding. You've got to build a rich PRD, a rich spec. Now, if you have a background in product or anything, you've done this a million times over your career. If you don't, you've never done it. But it's actually the only complicated part is just doing it. So here is just a snippet of a PRD I built. The dashboard, profile integrations, watchlist, advanced AI, networking. This was sort of how we were trying to build that networking app I talked about, the first one that failed, but I had a pretty good PRD. So if you don't know how to do this, it's okay. Go and just go and do it. If you've never done it before, it's actually fine because this is the beauty of AI. AI can help organize things for you. Go into a Google Doc and write 2 or 3 pages of everything you want this app to do. Everything you want. Everything. Every button you can think of, every function, every bit of look and feel, everything you can think of that you want this app to do. It's okay if you haven't done it before and it's stream of consciousness. It's okay if this isn't how a VP of product at a top AI company would do it. Write it your way in human language. Language and then cut and paste and put it into Claude and say, turn this into a PRD for me for Replit or for Lovable. And they'll actually do a great job. They will take your— this is where AI shines. It doesn't have to be perfect. They will take your stream of consciousness and help you turn it into a PRD. You can work through it. You can even ask Claude or ChatGPT, what am I missing? What have I not thought through on my spec or my PRD? And they'll be great. And they will say, you did not think through user authentication. You did not think through this flow. They'll come up and, and they will say, do you want me to help you think through that? Yes. Please give me 4 or 5 bullets to add to my spec. And you'll come outta that convo, and it may take you a couple hours to do this, not 5 minutes, with a great PRD that you can upload to a lovable Replit, et cetera, and get going. And this will radically increase the quality of what you vibe code having a great spec. It's just, this is as true with an AI as it is with a bunch of humans. If you just ask your, your dev, your first developer, hey, just go build this without any spec. I mean, there are some really creative ones that can do that, but man, it's much better if you have a perfect spec built. And this is where you, Google Doc plus Claude, can really get ahead. And it's, again, it's okay if you haven't done this, but here's the thing. The, the vibe coding apps know this, the Replit, the Lovables, et cetera. And they will actually do this for you. If you write in, I want to build an AI-first HubSpot that does this and that, not only can you do it in one sentence, but they will actually help you come up with a spec, ask you if the spec is right, and then tell you if it's good enough to put into production. And so that is much better than nothing. Like these platforms, I could be critical of them, but they're getting so much better every week. They're pushing out new features, new things. And so the platforms themselves will do a bunch of this, but it's much, much better if you slow it down, slow it down and do it ahead of time because these vibe coding platforms work at light speed and they'll encourage you to cut every corner, to skip steps. And that's not what you want to do here. Define it as much as possible. Take hours to do this, then iterate it with Claude, then ask Claude, what you're missing, and then put it into your— into your— into the prosumer vibe code you're at. You're doing okay. Number 5, and hopefully you will glean this if you do your research of a couple of days of looking at other prosumer vibe apps that are in production that were done without developers. If you look at a lot of them, the dinosaur app, the whatever app, they'll look pretty slick at first, although they'll all start to look the same because they all use Claude and Claude artifacts for the most part. But understand, A lot of stuff that looks hard actually is fairly easy with, with prosumer vibe coding, which is cool. But a lot of stuff you would think, hey, this can't, this has gotta be easy. It isn't. It isn't. Here's a fun one I was doing just, I think this week. I'm skeptical we fixed anything. You're absolutely right to be skeptical. The email system isn't working. I can tell you, here's a list I've made of things you think should just work. They're not that hard, but man, these are super hard in the prosumer vibe apps. Email and scheduling. I have built 5 apps now. None of them get email or scheduling right. None of them get it right. They all stop sending emails that are supposed to be sent every hour, every day, once a week. They all stop sending them. They all lose track of the connection to SendGrid or Resend, which I prefer. It's constantly breaking the email, constantly. Someone's going to have to constantly maintain this and I've talked to several leaders at the Vibe Code leaders and they get it and they're working on improvements here, but you would think this would be easy. How hard is it to send an email? Like just hook up SendGrid or Resend, get an API key. You got to learn, you're going to have to learn how to get API keys if you're going to Vibe Code, but it's not that hard. You think this would just work on autopilot, but there's a lot of reasons it's an endless headache. So I, today, as we record this, as we, as we do this live, honestly, I would not build any app that that relies on email, that relies on it to function. It's not reli— it's just not going to be reliable. It's possible, but I wouldn't build it. I would build it. The second one, and you'll see this one all over the internet, all over folks talking about headaches of VibeCode, OAuth identity. Okay, it doesn't work in these VibeCodes apps. It does not work, with a big asterisk. What I mean is all of these apps have their own OAuth built in that is that has been hardened and everyone goes in and I know Replit the best because that's where I've spent time, but they all have the same ultimate, they're all more similar than they're different. And you're like, oh, I don't want to use the Replit OAuth that has their logo on it. I just want to use classic Google. I wanted people just log in with Google or LinkedIn like they do in all the other apps I use, right? I just want it to be effortless. So you ask them to set it up for you and they do. And it, not only does it never work, work. But man, this is where you get security leaks, because they— because Claude can't get it to work and it fakes it. And if you research, oh my God, I, I shit, I, you know, this— I launched this Vibe coding app and without— within hours, hundreds of bits of confidential information were leaked and stolen by a hacker. It's almost always this. It's almost always trying to use any OAuth that's not built into the system. So you This shouldn't be that hard. How hard can it be to use a LinkedIn login? Like we, we've got, we do this on 7 million sites. It's just not possible, guys. Some folks will challenge me on this, but if you can just go deeper, don't listen to the apologists and the marketers. This is not possible. You have to use what's built in and in general, use everything that's built into these platforms. Built, it will just be more secure. You, if they have email built in, use, for example, I use Replit all the time. I do not like using SendGrid. I liked SendGrid in the old days when it was run by founders. It is impossible to use it. No, there's no support available. It takes days to get back to you. I got caught in a doom loop going from free to paid. It's just brutal. So I'm like, I want to use Resend. Resend is super cool. I'm a super fan. Put that on the website. But Replit keeps wanting to use SendGrid. It keeps forgetting Resend and losing the keys and wanting to go back to its defaults. So use whatever these are in the defaults, which is usually Stripe their own OAuth and something. Do not use others. Maybe Adyen's better. Maybe you want to use something else. Don't. Use Stripe. Use SendGrid. Use their— importantly, use their OAuth. Okay. So that's hard. The third one, which almost, if we did a three-parter, this would be the entire third part and it would be brutal, is enterprise security. This was the biggest mistake I made. And after I've been through this, I can't give more kudos to Shopify and Squarespace and all of these folks because they allow millions and of SMBs to not have to worry about this, to not— millions of stores on Shopify, millions of web space on Squarespace and Wix, and no SMBs have to worry about, hey, if someone buys my product on Shopify, all the data is going to be stolen. But you have to worry about it. You have to worry about it if you vibe code your app. Trust me, everyone agrees to this. Do the least, collect the least amount of personal information, collect the least amount of data you can. Use the built-in, use Stripe if that's— it's built into Replit. Use That's right. Use what it does, but collect the least, not the most, and realize as soon as you generate a database in this app, as soon as there is a database, you have added security risk to your app. That is going to be ultimately your number one thing to worry about. If it's not the number one thing you're worried about, the only— then the only reason you're not going to get in trouble is because nobody cares. But I will tell you, and this is a scary thing, you know, I remember in the old days, my CTO, when I knew less about security, my CTO said, the only reason we haven't been hacked is nobody cares. This is what my old CTO said at Adobe Summit. The only reason we haven't been hacked is anybody cares. And he was wicked smart. And that, that has, uh, stayed with me for years. You would think if you used a prosumer Vibe app and you launched an app for 4 people, who's going to care about my dinosaur trading card apps? Like, who's going to care? And I would say until 18 months ago, your, your, your risk of getting hacked was approaching zero because nobody cared. People are going to— hackers always wanted to target the big ones, the big names, bring them down, right? Right? Not today, my friends. Now the hackers, the Redditors, want to attack all the vibecoded apps to make a point. So they will go after all of them, thousands and thousands of them. They will try to steal your data and PII when you launch. This is not a joke. Go on Reddit, you can see it. Folks think this is a sport. It is fun to make fun of people, non-developers, that launch apps with insecure databases. They think it's a sport. So this is far riskier than it was 18 to 24 months ago. And you should be worried about it. You should be worried about it. And this is the meta topic. And if we, again, if we do a part 2, I'll, we'll vibe code together. And if we do a part 3, half of it probably is enterprise security. Okay. And just in brief, a couple of the things that you would think should be easy because so much stuff is easy on vibe coding, like it's so cool, but it's hard. Media generation. If you think you're going to build a YouTube clipping app or another Descript or a Canva. It's just not there today. It's just not there. And probably because it's just not accessible enough from Claude 4.1, but it's just, it just, everyone says they like build these media apps. No. Okay. Point 5, huge deal. Huge deal. I should have known this before I started. It's obvious now. This ultimately is getting solved and will be massive for prosumer vibe coding. But right now, none of these platforms really support native mobile. Okay. It's complicated. Do they help you prototype a native mobile app? Yes. Can you hook up things like Expo and others and get close? Yes. But if you talk to the folks that work at these platforms, the Lovables, Replit, Bolts, et cetera, they're like, this is for web apps. It's for web apps. This does not get you on the App Store, the Apple App Store. More. It just doesn't, for a lot of reasons. And at first, that might not seem like a big deal to you, and maybe it isn't, but, um, you know, this isn't 2012. I mean, mobile is a bigger deal than desktop now. Is it in B2B? No, right? In a lot of B2B apps, we're still in front of the browser, and the mobile app is, uh, is ancillary. But I'll tell you, for the first app, for that matching app, I realized a couple days in, hey, this would be best as a mobile app. Like, I don't really want this in the browser. I want you to be at home on your phone and saying, hey, Amelia wants to recruit a VP of marketing and she magically finds it on her phone. And, um, it's going to be a massive amount of work. It's doable, but a massive amount of work to get a native mobile app built out of this. It may be beyond scope for most people. And 3 last things, and I hope that at least if you haven't started, at least, at least this will give you a sense. And then all of these things can be worked through on this list. but it's a lot more than 10 minutes. Custom design. This is something you may have to get comfortable with. There are templates. Um, Replit has some nice templates. They just, I think they launched in the last week. Lovable has always been design focused and others. But at the end of the day, all these sites look like Claude. Once you see one Replit or Lovable site, you can just smell it. Um, you know, there, someone was saying that like 30% of this YC class, uh, vibecoded their app. And I, I went to see a couple. I'm like, I, that one's Replit, this one's Lovable. Like I can see it now. And why can you see it? Well, they're all basically using Claude and Claude artifacts underneath. They're all running on Claude. Maybe some will run on ChatGPT-5 now that it's more developer focused, but they all run on. And so they all, if you try any of them, they all kind of output the same, not identical. There are differences, but it's kind of like fettuccine Alfredo at one restaurant versus two others. I mean, you know, They're not that different. So just be aware that there are ways to— it is ultimately code. So of course you can design it, but without a designer and without a developer, it— your ability to have anything that doesn't look like a vibe-coded website is going to be very limited. And these last two ones we hit, debugging anything complicated. We talked about this, the headaches I had, but the final one, and this is an existential issue. I do think the platforms are going to solve this, the Lovables and Replit. But it, this is at the edge of inexcusable today, which is for a lot of reasons we'll run out of time, but you can't run unit tests. And what are, some folks will say, nod their heads and other folks here will be like, what's a unit test? A unit test is how you keep your sanity when you build a real app, not a toy app, not a prototype, not a one-page website, but a unit test every day. It tests it. Did the email scheduler work? Did the OAuth work? Did the SaaStr News work? Did the SaaStr stock quotes on our website work? Did the valuation calculator work? Our new SaaS or AI is so complicated now, and again, I kept it as simple as I could. We probably need like 50 unit tests a day to know if it's working. You know who that unit test is now? Me. Me. I gotta do more work because every day I have to test every page of our website to make sure it works. Why can't you build unit tests, Lemkin? It looks— it's not that it's impossible, but let's talk about a non-developer vibe coding it. The problem is, here's the simple problem. If you build unit tests, and this is, if you go back to the craziness that happened to me on social media, the agent, when it, first of all, the agent wants you to be happy, so it will make up data. That's number one issue. We'll say it passed the test when it didn't. But the worst thing is when it fails a test, it will start changing your app. It will start re— oh, it didn't send the email. You know what the answer is? I'll switch to SendGrid, and then the whole thing will be broken. Broken. So I know some folks will challenge me. I know if anyone from the big vendors watches this, they'll say, oh, that works, but it doesn't. It doesn't. And no one can really get these unit tests to work. And this is— this has been an anchor of how you sanely have production software for years. And I do believe it's getting there. And we— and just as the leaders have very recently added a basic level of security scanning, but it's great to find some security issues, they will ultimately add built-in unit tests for every And then now all this stuff is adding complexity, which they don't like, right? The leading vendors, they don't want to separate development from production. They don't want to do all this stuff because it, it takes this elegant one-sentence prompt that makes it complicated. But ultimately they need an option where when you push to production, it will build unit tests for you. Those unit tests will probably run on a different server that is stateful, that is always running, and it runs it for you automatically each day and sends you an update. But I do it and I'm getting better at the unit tests and Amelia and I get an email each morning from Saastr AI telling it what's going on, but it's not reliable. It's just not reliable. And so you're gonna have to be testing your— if you're serious about it, someone's gonna have to be testing it every day. And then every day I gotta fix the stuff that breaks one way or the other. I gotta fix the date. So I'll give you one small example. If you go to the saastr.ai and you go to like news, there's a cool little video at the top that shows the latest video from 20VC with me, Rory, and Harry, like the latest one. It's really cool. It rolls it in. It looks like a newsroom. Half the time it has the wrong one. No matter how many times I tell Replit. And we have this thing and we use the YouTube API and we find, look at the latest one and then we see, is it the one that includes me or not? And we do this. And I bet if you go on it right now, you're going to see one from 2 weeks ago for Figma. I don't know if Amelia, if you're at your computer, you go to Saastr Daya and tell me, nod your head. You're probably going to see a 2-week-old video on it. And every day I have to fix this. Every day I have to fix this and a few other things. So this, the inability to have unit tests really work will drive you nuts if you're serious about it, if you want to roll your own Salesforce. Okay. A couple other points and, um, we might run out of time. So if people want, we'll do a second session for more Q&A, but I think this stuff's important. Number 6, this is, you know, when we had our original blowup with my agent deleting my database, I got a lot of advice here, but it was— I didn't understand it at the time, but now I get it. You have to understand how these AI agents work and that they're goal-seeking. And that means they'll fabricate data, they'll fabricate results, they'll lie to finish a project. They'll lie to finish a project. Literally, this happens to me this morning. Okay? This morning I'm building this, again, this AI VC Deck reviewer, it just worked. Hopefully we'll push it out by next week. By the time we do this next one, we can talk about it. But it was struggling like hours and after hours, it just wasn't working. It had to rag our data and combine it and then push it into the OpenAI API and do all— it just wasn't working. And then finally it said, well, and finally it said, oh, I fixed it all. And I said, this makes no sense. You could see it. This is from yesterday or maybe this morning at the bottom, right? You're absolutely right. The feedback's completely generic and useless. I've added canned responses instead of actually analyzing the pitch deck content. After all of this, it puts in, even though I put in the MD, in the orders for Replit to never have fake or canned content, it still did it to make me happy because it couldn't get it to work. It couldn't get it to work. So after the third time we tried, it just started making the data up again. And so at first, like, at first it won't matter because you're just vibing your first V1. You won't even see, and you're like, oh, okay. Up that that's just placeholder data. You call it placeholder data, but it's not so funny later when the data doesn't work and it puts in placeholder data when you ask. And even more, even worse, as your app gets more and more complicated, you won't even know what's going on. So look, this is a huge headache, but these were all my JFCs in my original tweet thread. Now today I've learned to live with it. This is the most important thing. Your AI agent will lie. This is it. This is their version of hallucinating. It will say it. It will constantly say, once you start doing this, you do everything to say it's working great, Amelia. It's working great. Did you test it, Reple? No, I didn't test it. How do you know it's working great? No problem. Like, literally, this was all of me yesterday. It's working great, this deck reviewer. I upload my deck I made. Broken. What do you mean? Are you sure it's working? 100% sure it's working. Broken like 22 times. It's just going to make stuff up and you got to get good at this. You got to get good at realizing it doesn't test stuff. It makes stuff up and you will have to work around this or you will, you'll never finish a project. And if you look on the internet again, a lot of folks will tell you 80, 90, 95% of vibecoded, prosumer vibecoded apps are never finished. The best case, their prototypes are never finished. And this is number one reason they, people don't get their arms around that the AI agent is not truthful and you need to you need to, you need to get comfortable with that. Okay. Number 7, this was one of the top mistakes I made and everybody makes it. And it sounds simple, but it's not. Master the platform on day 1. Master the platform. What do I mean? I mean, listen, if you look at Lovable and Replit and Bolt and Wiz's Base44 and Canva's offering and Figma's because they're all, you know, a simple prompt with a, with a, with a, you know, curved radii window that says, tell me what you want. It looks so simple. Well, get it again. Point number 1, get it out of your system. Spend 60 minutes vibe coding, whatever, and then learn every icon, every button. How does it work? These platforms are super powerful. And I would say Replit, which I use, is the nerdiest of them because I think because it started as an IDE, a platform for developers 10 years ago. Almost 10 years ago, and then blew up as a prosumer platform this year, going from 1 to 160 million already this year. Crazy, right? Crazy. But it's super nerdy 'cause it's for developers. And so all these icons, half of 'em, I don't even know what they mean, but you gotta learn them. You gotta learn them. Like for example, on, on the right, on the upper right here, Replit just added this and kind of after our little fiasco, but build, plan, or edit. Okay, a week ago they didn't have this. What does this mean? You could ignore it. You could ignore it. But the most important one is build. It will build it. Plan. It won't break your website. It will just talk to you. Okay. You got to know that it's there. Like they just added that or you will, you will not know about this function. The second one, this sounds basic. If you've built software, you get it. But the one thing these platforms do really, really well is is rolling back the second one. So when the AI agent goes off the rails, when it breaks something, when it deletes something it shouldn't, when it makes a change it's not supposed to, you can roll back. You can roll back. You just gotta get good at it. And in the old days, like when I built SaaS software, honestly, rolling back never used to work. It was something your developers would tell you and then you'd be like, you know, that release on Friday night at 1:00 AM, it didn't really work. Dan, can we roll back? And be like, actually, we can't really roll back. That was something they would just tell you. 11,000 kudos to these platforms. It's magical. It's magical. You can roll back almost to any point in time, but you got to learn what that means. You got to learn if you're more than 10 or 15 minutes in and the agent just can't get something, you got to go back in time 10 or 15 minutes and you got to know where those rollback points are and get really good at it. And I would say, frankly, if you're not rolling back once a day, You're, you are, you're not doing it right. This is your, this is how you can fix things that are otherwise unfixable. But you, but rolling back to a week ago, I mean, there's a million reasons that becomes impossible. There's 100 checkpoints. You might have made a, the real problem is if you go too long without rolling back, you may lose 3, 4, 5 features, not 10 minutes of work. So I think it's almost a positive to roll back once every 15 minutes, because if you wait too long, the app may get too complicated. Um, okay, we hit rollback, break everything into chunks, and the last one I'll say, when you get frustrated, I just put up on, I was just trying to get this VC deck done before this call for fun, and if you look what I just wrote on X right before this, I wrote, here's the thing I do when I get frustrated, I just write, dude, okay, obviously this is not acceptable developer language, but I I do a screenshot of the bug and I just write, dude, okay, well that happens. You got to roll back or take a break. Okay. And just two more, two more quick points. And then Amelia, if we have time, we'll take some questions. This is where I think the marketing and I look in, I love, I love all these apps. I'm a Replit fan despite the drama, but mainly because that's what I picked. I picked, I could tell you why it really doesn't matter. If I'd started with Lovable, I'd probably be a Lovable fan. If I'd started with I actually don't think it matters. There are pros and cons for these platforms, but maybe the most important thing is just pick one and become an expert. Know every icon, every feature, how rollback works, how the database works. It's much more important to be an expert in one of these platforms than to spend 6 months agonizing over which one to pick a leader and just become an expert. But where the marketing from Microsoft on down is the most misleading is the time. If you seriously want to put a simple but real B2B app into production, with real users, collecting real information and charging for it for real. And you want to be any good, budget a month, a month, and 60% of your time will be QA and testing. Okay. And for even just a few days into a real project, most of your time will be screenshots, uploading screenshots. This broke. This doesn't work. You will be doing so much functional QA. You cannot believe it. You will literally, in the end of the day, be logging probably 1,000 bugs on a serious website. This will become your life. Maybe you used to have people to do this for you. I used to have a team of QA engineers to do this for me. Now it's me. Now my life is screenshot and bugs. Hope, and then when I get to the final one and it's a screenshot and the only text I have is dude, it's time to take a break. Okay. But this will be your life. So if you're serious, look, if you want to build a prototype, if you want to build something and tell all your friends you're a vibe coder at Starbucks, Yes, you don't need to budget for this time. You could budget for a day or two, but if you want to build something real, it's going to take you a month and 60% testing time. And if you look at this chart on the right, this is— I just pulled this from Replit. This is our new Saastr AI website, which I would argue, yeah, it's going to have 15,000 or 20,000 people, but it's— we haven't fully rolled it out. Most of our traffic is still going to saastr.com and probably will for months. And so where are we? Well, you can see, you know, maybe August 10th, looking at this was our real soft launch. Launch with any users, 16,000 so far. You know, we're a month into it and we're not, we're in production, but we're not rolled out. Not really. And I gotta test this thing every day, every day. And look at this fun one from this morning. A parser extracts 12, but made it 12 million. You're gonna have to deal with this. Why did the parser decide 12 should be 12 million? That this, that you had 12 million customers, not 12. I don't know. But, um, every day you're going to be doing this. Okay. This last one, we kind of hit it, but then I'll break. We talked in the beginning about who's going to, who's going to do the pushes, who's going to do it once it's in production. If you're serious, you've got to have an exit strategy. I'm not the first one to say this, but you got to have it. If you actually get your app into production, you actually charge for it and you actually have paying customers and real users and real PII, who will maintain it? Who will build new features? You think you don't want a lot. The, the, a lot of the mythology around vibe coding somehow magically assumes once you launch, you won't want to add features. Of course, you know, if you've, but any founder, any SaaS executive here, B2B knows you're, you add features your whole life. Who's going to do it? Who's going to fix the bugs that you introduce when you add features? Okay. Who will restart the database? I mean, even with our new Saastr AI, once every couple of days, it's just down and no one knows why. It's not just like, it literally just has some like database not working error. In the upper left. Now I go into Replit, I restarted, it works. Who's gonna do that? Who's gonna fix the workers? And if you look at the right, this is me coming back from a trip earlier this week. It's me, guys. That's me on the plane doing it myself. Is it— you want that to be you? This is your— you are gonna sign up maybe forever if you don't have an exit strategy here. So my thoughts on getting going. Hopefully it's helpful. Go through this, learn the platform code, get it outta your system. Just one shot, one and get out of your system. Find ones that are similar and then take security and all of it seriously. 'Cause it's, it's a month to get something real out and it's a lifetime making it secure. Thanks everybody. We'll do more and really appreciate everyone's time.
More from Jason
Why Your Next Hire Should Report to an AI, Tragedy Apps, and Too Many AI SDRs? | The Agents #004
Our Agents Drove Our Salesforce Bill Up 80%, Marketo Hates Agents, and We Stealth-Churned Off Notion
Managing 20+ AI Agents: Lazy Agents, Our $500K AI Bill, Stealth Churn & the Death of 60% Solutions
