A few months ago, a founder posted about the SaaS he'd just shipped — built entirely with an AI coding assistant, not a line of it typed by hand. He was proud of it, and he had every right to be. Within days of launch, someone found the API key sitting in plain sight in the client-side code. It got used to bypass the paywall, spam the backend, and write garbage into the database. The founder spent the next stretch rotating every key, moving secrets into environment variables, and locking down the API endpoints that should have been locked down before anyone ever saw the site.
Nothing about that story is about the AI being bad at its job. The AI did exactly what it was asked: build a working product, fast. Nobody asked it to think about what happens when a stranger opens dev tools.
In the replies, someone made a simple point: AI is a great research aid, but shipping a large application still means understanding the code — copying and pasting isn't programming. The founder didn't push back. He agreed: he'd learned it the hard way.
The same story, over and over
Swap the platform and the same shape of story repeats. Here's the WordPress version — three separate, ordinary launches, three separate silent failures.
