Vibe coded apps do not fail because the AI writes broken code. They fail because the AI writes the happy path and silently skips the adversarial one. Here are the five holes I see most, mapped to what they actually are and how to close them. 1. Wide open data access (broken object level authorization) Builders that sit on Supabase or similar often ship with row level security off or permissive. The UI scopes per user, the database does not. Wrong: rely on client side filtering to keep data private. Right: enable RLS and write policies so user_id = auth.uid() is enforced at the database, not in the query. 2. Missing function and object level authZ (IDOR) Authentication is present, authorization is not. The classic tell is an endpoint that trusts a path or body parameter without checking ownership. Wrong: if (loggedIn) return record(id) Right: if (loggedIn && record.owner === user.id) return record(id) on every route, including the ones you think nobody will find. 3.…