Vibecoding Critique
The community counter-narrative to vibecoding: agent-generated code needs aggressive quality, scope, and security enforcement. The output is fast, but cleanup and launch-readiness gates are not optional.
The Problem
Vibecoding - letting AI generate code with minimal human review - produces functional software quickly but accumulates technical debt at an unprecedented rate. The code works, but it's bloated with dead functions, redundant imports, inconsistent patterns, and logic that no human wrote or reviewed. The term itself (coined by Andrej Karpathy) was aspirational; the community response increasingly focuses on the mess it leaves behind. Source: compiled from X bookmarks, 2026-03-15 to 2026-04-25
Failure Modes, One Conclusion
Shaw: The 8-Subagent Cleanup Prompt
@shawmakesmagic (5,948 likes, 16,495 bookmarks) called vibecoded output "horrible" and proposed a structural fix: split codebase cleanup and quality improvement across 8 subagents rather than asking one agent to fix every failure mode in one pass. The captured bookmark stops before the eight dimensions are listed, so it should validate the fan-out pattern, not a canonical skill recipe. The bookmark-to-like ratio of 277% makes this the most reference-saved of the critique set, suggesting practitioners immediately adopted the shape. Source: X/@shawmakesmagic, 2026-04-15
The approach mirrors Kevin's own Security and Review Skills and Doctor Pattern architecture: don't try to fix everything in one pass; decompose quality into orthogonal dimensions and run them in parallel.
Ernesto: Structural Audit Before Serious Work
@ErnestoSOFTWARE's prompt card reframes cleanup as the bridge from "vibe coded slop" to "serious project." The reviewed image asks the agent to audit dead code, folder structure, hardcoded values, naming, scalability risks, the worst file, and README documentation before the project is treated as production material. This is not a new skill route; it is a compact preflight checklist for Security and Review Skills, Security and Review Skills, and Doctor Pattern before a generated prototype gets real users. Source: X/@ErnestoSOFTWARE and local artifact review, 2026-07-03
Gabriberton: ruff + vulture for Dead Code
@gabriberton focused on dead code as the primary symptom (see lead quote above). Functions from earlier approaches, unused imports, unread variables. Run ruff + vulture during development, not only at PR time. Source: X/@gabriberton, 2026-04-09
The deep-review decision is no new standalone global skill. Kevin's existing no-sus-code-doctor, Frontend and Design Skills, and Lint-Enforced Agent Guardrails routes already own agent-authored code cleanup. ruff + vulture are the Python-specific dead-code pass to add inside that route when the repo is Python or mixed Python, not a separate workflow to memorize.
This maps to Kevin's Lint-Enforced Agent Guardrails thesis - catching slop at write time rather than review time. The earlier in the feedback loop you kill dead code, the less it compounds.
Staysaasy: The Nostalgia Frame
@staysaasy (9,924 likes, 1,214 bookmarks) took a different angle - a nostalgic description of receiving a "beautiful, elegant" 400-line pull request from a coworker in 2018. The implicit contrast: vibecoded PRs are neither beautiful nor elegant. They're sprawling, incoherent, and nobody can explain why any particular line exists. Source review found the enriched "self-thread" rows were later standalone @staysaasy posts, not continuation evidence for this PR essay. Source: X/@staysaasy, 2026-05-12
The low bookmark-to-like ratio (12%) compared to the other two suggests this resonated emotionally but wasn't treated as actionable reference material. It names the feeling; the other two name the fix.
Paoloanzn: The Scope-Naivety Variant
A related but distinct critique targets the claims vibecoders make, not just the code. @paoloanzn (4,924 likes) skewered the pattern of "vibecoder asks claude code to build a chat app, gets a working prototype in 20 minutes, immediately tweets 'just killed slack and discord'" — "brother you don't even know what a distributed system is. you don't know what database replication means." A working prototype hides the engineering (distributed systems, replication, websocket scale, failure modes) that separates a demo from a product. This is the demand-side complement to the supply-side quality critiques above: even clean vibecoded output can ship on a profound underestimation of scope. Source: X/@paoloanzn, 2026-03-13
Prajwal Tomar: The Launch-Security Variant
@PrajwalTomar_ adds the product-security failure mode: vibecoded SaaS apps often reach users before the launch guardrails exist. The reviewed Lovable/Supabase artifact is concrete: Row Level Security, auth flows, password reset routing, form validation, CORS restrictions on edge functions, endpoint rate limits, server-side input validation, env-var handling, and CAPTCHA status. This belongs to the same critique because prototype speed can conceal missing boundaries just as easily as it conceals dead code or distributed-systems complexity. Source: X/@PrajwalTomar_, 2026-03-15; Source: local artifact review, 2026-07-02
The later "vibe coders are getting sued" artifact extends that same failure mode from technical security into launch compliance. The screenshot frames the missing basics as personal/product exposure: privacy policy when collecting user data, an explicit view of how data is stored and handled, and a minimum security posture review before real users touch the app. This is the product wrapper around the technical checklist above: generated prototypes need legal, privacy, and security gates before they become shipped software. Source: X/@PrajwalTomar_ and local image review, 2026-07-04
Kevin's July 6 legal checklist makes that launch-compliance layer operational: AI claims/disclosure, terms/arbitration, privacy labels/data maps, and UGC liability/DMCA/moderation are now the minimum legal gate for user-facing apps. The critique owns the failure mode; App Legal Launch Checklist owns the repeatable launch workflow. Source: User request, 2026-07-06; https://www.instagram.com/reel/DZs7mU3RJKE/
Synthesis
The posts form a complete argument:
- The quality is bad (Shaw - naming the problem)
- Run a structural audit before treating it as serious (Ernesto - cleanup preflight)
- Here's a specific tool to fix it (Gabriberton - ruff + vulture)
- Here's what we lost (Staysaasy - the craft of human-authored code)
- Prototype is not infrastructure (Paoloanzn - Slack/Discord-scale claims need distributed-systems proof)
- Here's what breaks at launch (Tomar - auth, RLS, rate limits, validation)
Kevin's wiki already encodes solutions to this problem: Lint-Enforced Agent Guardrails for automated quality gates, Security and Review Skills for staff-engineer-level review, Security and Review Skills for React-specific hygiene, and the Doctor Pattern for decomposed health checks. The vibecoding critique validates that these aren't optional tooling - they're load-bearing infrastructure for any AI-assisted codebase. Source: User, 2026-05-17
Timeline
- 2026-03-13 | @paoloanzn's scope-naivety critique ("just killed slack and discord… you don't even know what a distributed system is"). 4,924 likes, 1,232 bookmarks. Extends the critique from code quality to overclaimed scope. Source: X/@paoloanzn, 2026-03-13
- 2026-03-15 | @PrajwalTomar_ posts a Lovable/Supabase pre-launch security checklist: RLS, auth flows, endpoint rate limits, CORS, server-side validation, env-var handling, and CAPTCHA status. 498 likes, 864 bookmarks. Source: X/@PrajwalTomar_, 2026-03-15
- 2026-04-15 | @shawmakesmagic posts the 8-subagent cleanup prompt for vibecoded output. 5,948 likes, 16,495 bookmarks. The captured source preserves the fan-out instruction but not the full list of subagents, so no new executable skill was created from this row. Source: X/@shawmakesmagic, 2026-04-15
- 2026-03-17 | @ErnestoSOFTWARE posted the "vibe coded slop into a serious project" structural-audit prompt card. The reviewed artifact names seven audit passes: dead code removal, folder restructure, hardcoded-value extraction, naming standardization, scalability risks, worst-file rewrite, and README documentation. Source: X/@ErnestoSOFTWARE, 2026-03-17; Source: local artifact
wiki/assets/x-bookmarks/2033897291644334424/image-01.jpg - 2026-05-12 | @staysaasy contrasts 2018 human-crafted PRs with vibecoded output. 9,924 likes, 1,214 bookmarks. Source review treated later same-author rows as adjacent standalone posts, not a direct continuation. Source: X/@staysaasy, 2026-05-12
- 2026-04-09 | @gabriberton recommends ruff + vulture for vibecoded dead code. 6,395 likes, 11,578 bookmarks. The source review kept this as a Python-specific dead-code check inside existing code-quality doctors, not a new skill. Source: X/@gabriberton, 2026-04-09
- 2026-07-04 | Deep-reviewed @PrajwalTomar_'s "vibe coders are getting sued" screenshot and preserved the launch-compliance rule: privacy/data-handling basics plus a minimum security posture review before a generated prototype gets real users. Source: X/@PrajwalTomar_, 2026-05-27
- 2026-07-06 | Added the legal-app checklist framing: FTC AI disclosure/claims, arbitration/terms, privacy nutrition labels/data maps, and UGC liability/DMCA/moderation. Routed execution to App Legal Launch Checklist. Source: User request, 2026-07-06; https://www.instagram.com/reel/DZs7mU3RJKE/