AI coding tools have shortened the distance between an idea and working software. Prompt-to-app builders such as Lovable, Bolt, v0, and Replit can produce a functioning prototype of a customer portal or an internal operations tool in days, and so can AI-assisted development environments such as Cursor and Claude Code.
That speed explains why so many organizations now build their own software platforms instead of adding another subscription. It is also why vibe coding security has become a planning question for anyone putting one of those platforms in front of customers.
Why Organizations Are Building SaaS Platforms With AI Tools
Building software with AI is now established practice, and the organizations doing it well are pulling ahead. Bain & Company’s Technology Report 2025 found that AI leaders had already improved EBITDA by 10% to 25% while laggards fell further behind. Bain’s assessment of organizations still testing the waters was blunt: “If you’re still piloting, you’re dangerously behind.”
The market behind that shift is large. Bain’s May 2026 research sizes the US opportunity that agentic AI creates for SaaS at $100 billion. Vendors are already capturing roughly $4 billion to $6 billion of it, and more than 90% remains untapped.
Bain estimates that adding Canada, Europe, Australia, and New Zealand could double the total to about $200 billion. David Crawford, who chairs Bain’s global Technology, Media & Telecommunications practice, described the time SaaS companies have to respond in quarters.
That opportunity sits in work people do by hand between systems: pulling data from an ERP, reconciling it against a spreadsheet, reading an ambiguous vendor email, and deciding whether to escalate. Bain points to early movers such as Glean and Sierra, which built products that work across systems instead of inside a single tool.
The same movement is visible in our part of the industry. Patchstack’s State of WordPress Security in 2026 report says vibe coding is here to stay and is merging with WordPress. Agencies are generating new plugins on demand and using AI to build React front ends, while WordPress provides the stable backend CMS.
We see it in our own practice as well. Our team uses AI-assisted development for well-defined pieces of work, such as wiring components together and building component libraries. We are standardizing our design workflow on tokenized design systems so AI tools can translate styles into code consistently.
We have also been on the buying side of this shift. This year we trialed a newer AI-built tool to replace a time-tracking and billing subscription our team had used for years. The trial raised the same questions this article covers: how mature the product was, who maintained it, how it handled delivery and data, and whether building our own version would serve us better.
Bain’s research on generative AI in software development reaches the conclusion we reached. The tools raise productivity, but the value depends on changing the process around them. That process is what the rest of this article covers.
What Is Vibe Coding Security?
Vibe coding is the practice of describing an application in plain language and letting an AI tool write and often deploy the code. Vibe coding security is the review work that confirms a generated application handles authorization, secrets, dependencies, and customer data correctly before customers and their data reach it.
At Curious Minds Media, we have been building and maintaining websites and custom applications since 2004, and our in-house, US-based engineers now use AI-assisted development in our own work. The tools compress the part of a project that was always easiest to estimate, which is producing code that runs.
The parts that decide whether a platform holds up for years still depend on engineering judgment: data modeling, authorization, integrations, security, and maintenance. Those parts now arrive sooner in the project, because everything ahead of them moved faster.
Where AI-Built Platforms Need Engineering Attention
An AI model generates code from the instructions it receives. When the requirements behind those instructions are thin, the output drifts from what the business needs while still appearing complete.
We have written for years about technical debt as the cost of a series of poor fixes compared with doing the work right the first time. When nobody owns the architecture, AI-generated code accumulates that debt at the pace it produces features.
Ownership raises a second concern, because a prototype that lives inside a prompt-to-app platform can reach production before anyone on the team has read the code it depends on.
Much of our custom web development work starts from a familiar position, where changes feel risky because nobody fully owns the codebase and documentation is incomplete. A generated codebase can reach that state quickly when it skips review.
How Does Authorization Logic Affect Vibe Coding Security?
Authorization logic deserves the closest review in a generated application, because it encodes business-specific decisions a prompt seldom spells out. We work mostly in WordPress, where the security data is unusually detailed, but the patterns it shows apply to any platform assembled from generated code and third-party packages.
Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% increase over 2024, and 91% of them were in plugins. Broken access control was the most exploited vulnerability type.
Patchstack notes that these attacks are difficult for traditional firewalls to stop because the exploits resemble normal authenticated traffic. For the most heavily exploited vulnerabilities, the weighted median time to first exploitation was five hours.
In a multi-tenant platform, tenant isolation determines which records a user can see and what a login from one customer account can reach in another. Those decisions belong to the organization, and a generated application can pass every functional test with ordinary input and still get them wrong.
AI is also speeding up how quickly flaws are found. Wordfence reports that its agentic research framework, Argus, found and proved a six-step remote code execution chain in the Avada theme in about two hours.
In July, Argus also caught a supply-chain backdoor in a plugin less than two hours after the malicious code was added. The same speed is available to attackers, which shortens the window between a flaw shipping and someone finding it.
Secrets, Dependencies, and Input Handling
Patchstack has also opened early access to a product built specifically for apps made with tools such as Lovable, Replit, and Claude. Its position is that AI-built apps are not secure out of the box.
The exposure it describes centers on vulnerable packages, and on API keys or internal error details leaking through application responses. A generated app also pulls in hundreds of packages nobody on the team chose, and each one carries its own vulnerability history.
The same question now applies inside WordPress. Version 7.0 added the Connectors API, a central place to manage AI provider credentials, and keys entered through its settings screen are stored as plain text in the database.
Defining them as environment variables keeps them out of reach of a SQL injection flaw or an exposed database backup.
Patchstack’s outlook for 2026 reaches the same conclusion from the WordPress side. Securing a site now requires coverage of custom-coded plugins and deep visibility into the JavaScript and PHP packages in use, because the attack surface extends well past WordPress core and the extensions built on it.
The same whitepaper found that 46% of vulnerabilities had no fix from the developer by the time of public disclosure. That is why we treat updates as one layer of protection and plan monitoring alongside them.
We see how quickly this moves in our own maintenance work. This year, a vulnerability in a WooCommerce companion plugin was used against one of our client’s sites, and we contained it within hours.
On another engagement, unfamiliar commits appeared in several repositories in a client’s GitHub organization. Because we review repository activity, we caught them and rotated the compromised credentials before any damage was done, and none of the code touched the repository behind the live site.
Input handling belongs in the same review. Generated code that renders user input or builds database queries without validation reopens injection flaws that hand-built applications have guarded against for years, and those flaws pass ordinary functional testing the same way authorization gaps do.
Prototypes built outside the engineering team carry a separate exposure, since an application can be live and holding customer data before anyone responsible for security knows it exists. An inventory of what has already been generated is the first step in any review.
For organizations in healthcare and other regulated industries, data-handling requirements add a layer that a prompt will not cover. Governance has to align with internal compliance requirements from the first sprint.
Should You Build, Buy, or Connect?
Buy when an existing product fits without significant workarounds. Build when the business logic is specific enough that adapting a generic tool creates more problems than it solves. Connect when the workflow crosses systems you already use. AI build tools lower the cost of a first version, but they do not change which of those situations you are in.
Bain’s finding about coordination work points the same way. For many organizations weighing custom SaaS development, a well-built integration layer between the platforms they already use often delivers more than replacing those platforms with something generated from scratch.
We apply that discipline in our own recommendations. When Rubicon Project (now Magnite) came to us expecting WordPress for a series of roughly 20 microsites, we recommended a headless CMS and static site generator instead. The content was consistent, and individual dynamic sites would have cost more to build and maintain.
Scope sets the timeline either way: a focused custom feature or integration might take a few weeks, while a full application involving multiple systems can take several months. We set those timelines from realistic estimates.
What Durable Custom Platforms Have in Common
Local Lens operates a global photography marketplace with bookings across more than 200 destinations. We designed and built a custom application in Laravel and EmberJS that manages the full booking lifecycle: availability, location-based routing, photographer task management, and delivery coordination.
Push notifications drive interface state as bookings change, and kanban-style task flows keep photographer work moving without manual intervention. Our support developers work with the Local Lens team every week to maintain the application and add new features as the platform grows.
The platform was worth building because generic booking tools could not model how Local Lens operates. The same reasoning applies to SaaS platform development with AI tools. The value sits in business logic specific to the organization, and that logic has to be defined and maintained by people who understand how the business runs.
Recent scoping conversations have often had to separate website work from custom application work before an estimate made sense. When the requirements are not yet clear enough to commit to an architecture, we run a discovery phase before development begins, whether or not AI tools will write part of the code.
How We Approach AI-Assisted Platform Development
An AI-assisted build at Curious Minds Media starts where any custom development engagement starts. We define requirements, map the data, and settle the architecture before AI tools write production code, because the quality of generated code depends on the quality of the context behind it.
We estimate projects from those requirements using standard methods instead of assuming efficiency gains that have not been demonstrated on the specific project.
During development, we use AI in small, reviewed pieces. We write tests for business logic, API endpoints, and integration points as part of the build.
For custom platforms, we keep business logic separate from the services it depends on, a pattern known as ports and adapters or hexagonal architecture, so a payment provider, CRM, or AI model can be swapped without rewriting the application.
Generated code goes through the same coding standards and automated code review we apply to code our developers write by hand, so problems surface before they reach production.
We stay involved after launch, since AI-connected systems need ongoing maintenance as models and APIs update and as edge cases surface in production.
Governance is part of the engagement from the start, including who controls the system’s behavior and how outputs are validated before they reach users or trigger downstream actions.
Where This Leaves Organizations Considering a Build
Bain’s research makes the cost of waiting clear, and our own work shows the cost of building without ownership. Organizations building platforms with AI tools are compressing the timeline to a working product. The ones that benefit most treat the prototype as the start of an engineering project, with security and long-term maintenance planned from the beginning.
A platform generated quickly without that ownership tends to accumulate technical debt at the same pace it gained features.
“Our development team has very high standards. We vetted dozens of WordPress agencies before finally finding Curious Minds. They’re an incredibly responsive and proactive partner. We’ve outsourced 100% of our WordPress development and maintenance to them for several years and they never fail to deliver.” Becky Kane, Doist, Senior Content Marketing Manager
If you are weighing a custom platform build, or you have an AI-built prototype that needs to be ready for production, our custom web development team can start by reviewing what you have and talking through where the limitations are.
For AI connected to the systems you already run, see our AI integration work.
