Sometimes the internet teaches you lessons in the weirdest ways possible. What started as a random argument inside a Flutter class WhatsApp group turned into one of the biggest reality checks I’ve ever handed out to another developer.

It wasn’t really about ego, frameworks, or even AI. It was about proving the difference between building something and actually understanding what you built.

One day, someone in our group started flexing an app he had built entirely through AI-assisted 'vibe coding.' Everyone was impressed, but something about it bothered me.

I replied that vibe coding shouldn’t be promoted heavily while people are still learning programming fundamentals. In my opinion, beginners first need to understand how systems work before outsourcing thinking to AI.

That simple comment quickly turned into an argument.

He kept saying things like:

'Vibe coding is the future.' 'I already work with an organization.'

At that point, the conversation stopped being technical and became personal. He was absolutely convinced that knowing the core fundamentals didn't matter anymore. I decided to see if his codebase could back up his confidence.

Out of curiosity, I started digging around and found his public GitHub profile. His live production projects were completely public, including backend repositories and it was in Django.

As a Django developer, I naturally started reviewing the codebase. I expected something sophisticated because of how confidently he was talking.

But the deeper I looked, the more obvious it became that the project wasn’t built with much understanding behind it.

The code worked—but it lacked structure, security awareness, and clear architectural thinking.

Then I found another repository called something like admin-dashboard.

Inside it was a README.md file that looked heavily AI-generated. Buried in the documentation was an exposed admin setup endpoint.

That immediately caught my attention.

I researched the flow, inspected the API behavior, and realized the endpoint could still create new admin accounts in production.

Using Postman, I tested the setup process—and it worked.

I suddenly had administrative access to his live project.

Instead of just telling him he was wrong, I decided to show him.

I didn't break anything. Instead, I generated an active admin session, took a screenshot of the internal dashboard, and dropped it right into the WhatsApp group chat where he had been flexing earlier. Along with the screenshot, I pasted the exact endpoint he left exposed.

The silence in the chat was deafening.

His confidence dissolved instantly. It wasn't an abstract debate about 'the future of coding' anymore. It was a real-time demonstration of why you cannot outsource critical security thinking to an AI prompt. I didn't just argue my point—I handed him a massive reality check.

That experience was a turning point for both of us, proving exactly why skipping the basics is dangerous:

1. Fundamentals still matter — Framework knowledge, authentication flow, permissions, and security basics cannot be automated away.
2. AI should assist, not replace thinking — If you don't review generated code, you're not software engineering; you're just gambling with production data.
3. Public repositories deserve caution — Leaving setup documentation and live endpoints exposed in a public repository is a disaster waiting to happen.
4. Confidence without understanding is dangerous — Especially when you are building software for an actual organization.

I’m not against vibe coding. In fact, I think AI-assisted development is incredibly powerful when used correctly. But this encounter proved that developers must know what’s happening underneath the abstraction.

If AI writes authentication logic for you, you should still understand authentication, authorization, permissions, API security, and deployment practices.

I think he finally understands that now. Because the scary part about insecure code isn’t how advanced the attack is.

Sometimes all it takes is someone in your group chat who is curious enough to read your README.md.