Why we don't vibe code platforms that hold people's data

You can build a good looking app in an afternoon now. That's real, and it's exciting, but when the app holds private information about real people, the part that matters most is the part nobody can see.

That's why we don't vibe code community platforms. Not because the tools are bad. Because the job is different.

First, credit where it's due

Vibe coding is describing what you want in plain language and letting AI write the code. Andrej Karpathy coined the term in February 2025, and that November, Collins Dictionary named it Word of the Year. That tells you how fast this moved.

Tools like Lovable and other AI app builders are genuinely useful. They're a great fit for a prototype, a landing page, a demo for a pitch, or a simple site that doesn't hold anything sensitive. If you want to test an idea before you spend real money, go for it. We'd tell a friend the same thing.

And to be fair, Lovable takes security seriously. Its documentation describes built in security scans, and one of them runs automatically when you go to publish. It's also honest about the limits. In its own words, "You are responsible for ensuring that your app meets the security requirements appropriate for its use case." It also says its tools "do not replace a thorough security review."

That's the right message. We just take it one step further. When the use case is a community full of real people, the security review isn't a final check at the end. It's the whole build.

What the research found

In 2026, researchers audited 200 live apps built mostly by describing what you want to an AI. 91% had at least one security hole. About two out of three of the holes they found were rated high or critical, and most of them sat in three places: who can get in, who can see what, and code that lets an attacker slip in commands of their own.

The same study found that better setups and better prompts cut the problems down but didn't make them go away. That isn't a knock on anyone using these tools. It's a picture of what the job really takes.

A community platform is a different animal

Think about what lives inside a coaching or community platform.

Names and emails. Billing details. Private messages. Journal entries. Recordings and transcripts of live coaching sessions. Notes about goals, setbacks and fears. Signals about who showed up, who finished the step and who went quiet.

People tell a coach things they haven't told their own family. They do it because they trust the space. That trust is the product, whether anyone says it out loud or not.

And trust comes with legal weight. In the European Union, Article 17 of the GDPR gives people the right to have their personal data erased "without undue delay" when certain grounds apply. In California, the CCPA gives consumers the right to ask a business to delete the personal information it holds about them, and the state's own guidance says that request reaches the business's service providers too.

And in the United States, the rules change at every state line. California says your privacy notice has to tell people how long you keep each kind of personal information. Washington's My Health My Data Act treats health information inferred from behavior as health data, requires a separate opt in to collect it and another to share it, applies to businesses of any size, and lets people sue. Maryland limits sensitive data to what's strictly necessary and bans selling it outright. HIPAA gets most of the attention, but most coaching communities sit outside it. Washington's law was written for exactly that gap.

This isn't legal advice, and the rules depend on where you and your members are. The point is simpler. When someone says "please delete me," that has to actually work. Every table, every file, every place their information quietly ended up.

It's not what you see on the front end. It's what's behind it.

Two platforms can look identical. Same colors, same buttons, same smooth welcome screen.

One has a locked door behind every room. The other has a beautiful front door and a back window that was never latched.

You can't tell by looking. Your members can't either. They're trusting you to know.

An AI builder is very good at making the front door. The walls, the locks and the logbook are a different kind of work. Someone has to decide each one on purpose, test it, and keep owning it long after launch.

What we put behind the front end

We describe our standard as 16 layers of security and privacy guards. Here are the ones that are easiest to explain over coffee.

Who can get in. Every person signs in, and every role sees only what that role allows. Members, coaches, admins and the owner each get their own view, walled off from the others.

Every client walled off. Each client gets its own database. Your members never share a room with anyone else's.

Members only see their own data. The check happens in the database itself, not just on the screen. One member can't open another member's journal by poking at a link.

Encryption. Private information is locked while it's stored and while it travels.

Sensitive views are logged. When someone opens something sensitive, there's a record of who looked and when.

Members in control of behavioral features. Paying attention to what people do, like whether they showed up or went quiet, stays off until a member opts in. Those insights live in the owner's view only.

Vendors don't train on your members. Before any outside service touches member content, we find its training setting and turn it off. Your members' words, voices and faces aren't there to improve someone else's models.

Building and testing on throwaway data. We build and test on fresh, fake data that we can wipe and rebuild from scratch. Real members never become test subjects.

Backups we've actually tested. A backup you've never restored is a hope, not a plan. We restore ours to prove they work.

None of that shows up in a screenshot. All of it shows up the day something goes wrong.

How it feels when it's done right

For the owner, it feels like sleep. When a member asks "what do you have on me?" you can answer. When someone asks to be deleted, you know it's done, not hoped done.

For the member, it feels like permission. Permission to write the honest journal entry. To say the hard thing on a live call. To admit they're stuck.

That's the part people miss. Security isn't only about keeping bad things out. It's what lets good things happen inside. People open up where they feel safe, and the people who open up are the ones who actually change.

So when should you use an AI builder?

Use one to test an idea. To show an investor what you mean. To spin up a simple site or an internal tool with nothing sensitive inside.

When real people start trusting you with their real lives, that's the moment to have a team that treats the backend as the main event. And whoever builds it, make sure you own the platform, the code and the data. With us, you do.

If you're bringing people together and want to talk through what should sit behind your front door, we'd love to have that conversation with you.