The AI-built product was already selling. What was missing was knowing what would break

Forja did what every new product should do: it reached the market before it looked good. The founders built the platform by talking to an AI — no engineering team, no designed architecture, no repository with an owner. When Epicora came in, in February 2026, there were 1,312 active users, monthly, quarterly, half-yearly and lifetime plans being sold, and the whole gamification roadmap running: XP, streaks, achievements, leaderboard, coin shop, weekly challenges, user duels. More than 40 tables, 14 pages, eight server functions. It worked, and it sold.

That’s when the bill arrived. Not as a broken screen, but in the three things vibe coding doesn’t solve on its own: who is allowed to call what, who pays for the infrastructure, and what happens the day something goes wrong. The audit covered the code, the database and the configuration of the live platform, and came back with nine findings — two of them requiring immediate action.

• All eight server endpoints accepted unauthenticated requests. Payment endpoints included: with no signature verification, anyone who found the URL could fake an approved purchase and grant themselves a lifetime subscription, credit unlimited coins or cancel someone else’s subscription. One of them allowed deleting the system’s historical records.
• Strictly private data was visible to the entire user base. Any user’s tasks, habits, goals and daily sleep, mood and productivity logs could be read by any other — and some of it without even being logged in. One table had a rule letting anyone create, edit and delete anyone else’s records.
• Database credentials were committed to the repository — the environment file wasn’t in `.gitignore`, which exposes the infrastructure and survives in Git history even after the file is removed.
• Business rules lived in the user’s browser. With no server layer, that included the rule deciding how much XP someone earns — the team was already manually watching, from the admin panel, who was gaming their own game.
• The infrastructure bill grew with no visibility. The environment ran on the AI tool’s own managed cloud, with daily charges that went unnoticed for days, and credit purchased beyond actual consumption: around R$2,000 a month.
• No automated tests, no monitoring, no staging environment and no documentation. Changes went straight to production, on top of paying users, and if a payment failed nobody was notified. The knowledge of how the platform worked lived in the conversation with the AI.

The first decision is the one that matters most in an audit: separate risk from preference. A product with paying subscribers can’t stop to become elegant, and most of what an engineer complains about in AI-generated code is aesthetics, not risk. So every finding came in the same shape — severity, urgency, what was configured, the evidence in the code and the attack it enabled — and the queue was ordered by consequence, not by taste: first what causes direct loss and leaks personal data, then what blocks growth, and technical debt last.

The two critical fixes went in first, and both were about money and user accounts: signature verification on the payment webhooks, with any request lacking the correct secret rejected before any processing, and a valid token required on administrative functions, which stopped accepting anonymous calls. Then the rest: database access policies rewritten so each person reaches strictly their own record, credentials out of the code, request origins restricted, rate limits on login and email verification, and file storage locked per user.

The second front was cost. The infrastructure moved off the AI tool’s managed cloud — the most expensive and least visible option — to a proper managed database plus dedicated front-end hosting, with automatic backups and its own domain. The bill went from around R$2,000 a month to around US$20 a month. Users and the founders themselves reported a faster platform after the migration. The third front was writing what didn’t exist: Terms of Use and a Privacy Policy compliant with Brazil’s LGPD, with a legal basis per purpose, retention, account deletion, and what one user can see of another in the leaderboard and duels.