# Personal Fit and Shareability Trade Off in Vibe-Coded Software ## Claim The more precisely a vibe-coded app is shaped to one person's specific workflow, the less safely it can be handed to anyone else, because it stays unaudited and hard-coded to that one context. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds while vibe-coded apps remain single-context, non-configurable, and unreviewed for security — the current default state per the source panel. - Breaks if a trusted, configurable open-source "core" scaffold exists for a category of app (notes, to-do, email) that vibe coders can build on top of rather than from scratch — the panel names this as an open wish, not something that exists yet. - Non-engineer builders currently have no way to evaluate the vulnerabilities their own tooling flags, which compounds the shareability problem: even if they wanted to share, they can't vouch for what they're sharing. ## Evidence Hayden Field's browser-extension project on The Vergecast surfaced 15 high and 15 medium security vulnerabilities she could not evaluate ("I'm not a developer, so I don't know what they are"), and the agent itself told her not to worry about them. The panel frames browser extensions specifically as the safest starting point *because* their blast radius is small — an implicit admission that most vibe-coded output isn't safe to hand to someone else as-is. ## Links - [[Product & Startup Instincts MOC]] — the boundary personal software hits the moment someone else tries to use it - [[3. Resources/Permanent Notes/The Build-Cost Collapse Moves the Bottleneck to Idea Quality]] — because extends; the same source's other claim, about what becomes scarce once building is cheap — here the scarce thing is safe transferability, not the idea itself. - [[3. Resources/MOCs/AI & the Future of Knowledge Work MOC]] — because applies-in; non-engineer AI-assisted output at scale raises the same security-literacy question this note names for a workplace context, not just a hobbyist one. - [[3. Resources/Permanent Notes/A Nightly Agent Rebase Makes a Personal Fork Cheap Enough to Keep]] — constrained by: maintenance, not writing, kills personal software; a nightly rebase removes that cost for small patch sets (Crawshaw). ## Tests / falsifiers - If a widely-adopted trusted-core scaffold for a common app category emerges and vibe coders start sharing derivatives of it safely, the "unaudited and hard-coded" scope condition no longer holds and this claim needs updating. - Survey vibe coders on whether they've ever shared an app with a non-technical friend; if sharing is common and incident-free, the claimed risk is overstated. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/Our Vibe Coded Projects That Actually Work the Vergecast]] — Hayden Field's vulnerability-count anecdote and the panel's browser-extension recommendation