The expensive part of vibe coding starts after the demo.

You can build a pretty convincing SaaS app with Lovable, Cursor, or Claude Code in a weekend. Auth works, Stripe is connected, dashboard looks great.

Then real customers show up.
Stripe retries a webhook and someone gets credited twice. A missing Supabase RLS policy exposes another tenant's records. Two concurrent requests push an account past its usage limit.

None of these bugs are obvious from a working demo.
When I take an AI-generated app toward production, I focus on the boundaries first: database constraints, tenant isolation, idempotent payment handlers, transactional usage accounting, and proper error tracing.

For example, a Stripe webhook should be signature-verified, deduplicated by event ID, and processed transactionally. A successful HTTP response alone doesn't mean the business operation completed correctly.

After 10+ years in software engineering, one thing still holds true: the real complexity is rarely in the UI. It's in the failure cases nobody thought to test.

Vibe coding is great for speed. Good engineering is what makes that speed sustainable.

Anyone here taking a vibe-coded SaaS into production? What's been the hardest part to get right?