The security problem with vibe coding is not that generated code sometimes has bugs. That is true, but it is the smaller story. The bigger story is that prompt-to-app tools are creating a new production surface outside the engineering perimeter: apps with URLs, databases, forms, customer data, and business logic