Phase 0: Vibe Coding Fundamentals · 15 min · Claude Code, Cursor, Lovable, v0, Bolt.new, Replit Agent, or similar
Objective
Your mission
You'll scope 3 real project ideas through a decision framework and decide the approach for each: full vibe, vibe + review, or engineering review needed. Output: project_scoping.md.
You need: A text editor. Your brain.
Time: 15 minutes.
Step 1: list 3 things you want to build (3 min)
Real ideas, not hypotheticals. Things you actually want to build.
Write in your file:
## My 3 Project Ideas
1. [Project 1]
2. [Project 2]
3. [Project 3]
Step 2: run the decision framework on each (10 min)
For each project, answer these 4 questions:
- Who will use this? Just me → low risk. Small team → medium. The public → high.
- What happens if it breaks? Minor inconvenience → low. Lost data or exposed info → high.
- Does it handle user data? No → low risk. Yes → you need to understand security.
- Is this a prototype or the real thing? Prototype → full speed. Real thing → plan for the last 30%.
Then assign an approach:
- Full vibe coding: Low risk, no user data, prototype or personal tool
- Vibe code + review: Medium risk, small team, internal tool — check for red flags before sharing
- Engineering review needed: High risk, user data, customer-facing, payments, health data
Write in your file:
## Project 1: [name]
- Who uses it: [answer]
- What if it breaks: [answer]
- User data: [yes/no — what kind]
- Prototype or real: [answer]
- Approach: [full vibe / vibe + review / engineering review]
- Why: [one sentence referencing the risk level]
Repeat for Project 2 and 3.
The 70% problem (read this)
AI gets you to a working prototype — maybe 70% of the way — incredibly fast. An afternoon instead of a week. That first 70% feels like magic.
Then you hit the last 30%:
- Auth needs to be secure, not just present
- Database needs proper permissions, not just a connection
- Error handling needs to cover edge cases the AI didn't anticipate
- Real users are hitting it — performance matters
The AI can help with each individually. But it can't tell you which ones matter for your project. That's your judgment call.
The 70% is the trap
The 70% problem is dangerous because the first 70% feels so easy that you assume the last 30% will be the same. It won't. The last 30% is where real vibe-coded apps have leaked API keys and exposed user data. The AI generated working code that omitted security — and nobody checked because the first 70% worked so well.
Your prototype took one afternoon and works. Next you plan to open it to the public with sign-ups. What does the lesson say the last 30% will hold?
The first 70% feels like magic; the last 30% is where security, database permissions, error handling and real-user performance live, and the AI can't tell you which of those matter for your project.