A broken system is not frightening; you can fix it. More frightening is a system that starts up and runs smoothly, while everyone in the company knows only the rough outline and nobody knows exactly how it came to work.
The words “it works ” are often one of the most devious disguises worn by a cybersecurity disaster.
Over the past year or so, real incidents have taught us a harsh lesson about “default insecurity.”
From a popular vibe-coding platform that left out RLS security rules (CVE-2025-48757) , leaving hundreds of applications exposed, to a dating app that configured Firebase for public reads, allowing tens of thousands of identity documents to be downloaded directly ; and even an autonomous agent that, while optimizing automatically, formatted the production database .
Making a system “work” merely means taking a stroll down the calm “Happy Path ,” which probably accounts for only 10% of the effort in software development. The remaining 90% of genuine expertise lies in reasoning through every kind of situation: What happens when the network goes down? How do you prevent an outage when traffic surges? When a malicious attacker enters strange characters, how do you stop the system from handing over the entire database?
Typing has become cheaper and code generation has become faster, but the cost of security and defense has not decreased at all.
Tools have not eliminated software engineering.