The auth is always broken — you won't know until it's a lawsuit

Vibe-coded apps share one flaw: authentication that looks right and functions right, but whose security model is Swiss cheese. The developer never sees it, because they only ever tested with one account.

One user logs in — works fine. Ten users — still fine. A thousand concurrent users, and suddenly session tokens are colliding, JWTs aren't expiring, and user A is staring at user B's dashboard. That's not a bug, it's a lawsuit. You can recover from a slow app. You cannot recover from a data breach — so auth gets fixed before anything else ships.

The good news: you don't need a security team. You need three checks you run every time.

Two checks from this doctrine

Real value, not a teaser — two of the 4 checks in full. The rest are in the one-pager.

Auth is not a feature. It's the foundation. Get it right before anything else, because one breach erases everything else you've built.