{"slug": "renovating-a-vibe-coded-app-readable-code-no-reasoning-behind-it", "title": "Renovating a vibe-coded app: readable code, no reasoning behind it", "summary": "A developer tasked with making a client's vibe-coded education platform production-ready found four separate engines computing the same daily student score, with two weighting the same sub-score differently at 60-40 versus 40-30-30, so the same student receives a different letter grade depending on which engine ran last. An agent-driven audit of the React/Vite and Supabase codebase surfaced 319 findings, 29 of them critical, including a flaw letting a student create a school and make themselves administrator. Because no commit history, PR thread, or documentation identifies the authoritative scoring engine, the developer escalated the choice to the client as a product question.", "body_md": "A client had been building an education platform in Lovable for months. Too many issues piled up, so they brought in devs. I got assigned to it. The job was to turn a vibecoded app into something production ready.\n\nFirst time I'd worked on a fully vibecoded app.\n\nFirst thing I did after getting access and exporting the code was try to run it locally. React/Vite frontend, Supabase backend. Quick read through: 132 migration files. Figured I'd spin up a fresh Supabase project, run them, and have the app up. Took two days instead. Fine, that's just work.\n\nRan an audit over the whole thing through an agent, came back with 319 findings, 29 critical. Security was about what you'd expect. A student could create a school and set themselves up as administrator. All fixable though.\n\nWhat I wasn't ready for was the stuff where I could read the code fine and still not tell what it was supposed to be doing.\n\nThe core of the product is a daily score for each student, shown to their parent as a letter grade. That's the thing the schools are paying for.\n\nFound 4 completely separate engines computing that daily score. Two of them weight the same sub-score differently, sixty-forty against forty-thirty-thirty, so the same kid gets a different number depending on which one ran last. All four write to the same field.\n\nThat's what makes it bad. Imagine four engines all doing their job, nothing throwing, nothing erroring, because why would it. But in business terms it's off the rails. Same input, different grade, and if you're not technical you've got no way of telling anything is wrong.\n\nNothing anywhere says which one is the real one. Not in the code, not in a comment, not in anything the client said. So I can't just pick, because picking changes what grade a kid gets. Sent it back to them as a product question.\n\nNormally you'd get this off a commit message, a PR thread, or just asking whoever wrote it. None of that exists here.", "url": "https://wpnews.pro/news/renovating-a-vibe-coded-app-readable-code-no-reasoning-behind-it", "canonical_source": "https://dev.to/yveshabchy/renovating-a-vibe-coded-app-readable-code-no-reasoning-behind-it-2eg1", "published_at": "2026-09-13 17:19:33+00:00", "updated_at": "2026-09-13 17:45:37.543724+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-tools"], "entities": ["Lovable", "Supabase", "React", "Vite"], "alternates": {"html": "https://wpnews.pro/news/renovating-a-vibe-coded-app-readable-code-no-reasoning-behind-it", "markdown": "https://wpnews.pro/news/renovating-a-vibe-coded-app-readable-code-no-reasoning-behind-it.md", "text": "https://wpnews.pro/news/renovating-a-vibe-coded-app-readable-code-no-reasoning-behind-it.txt", "jsonld": "https://wpnews.pro/news/renovating-a-vibe-coded-app-readable-code-no-reasoning-behind-it.jsonld"}}