SaaStr 820: The Complete Guide to Vibe Coding Without a Developer with SaaStr CEO and Founder Jason Lemkin

26:12So here is just a snippet of a PRD I built. The dashboard, profile integrations, watch lists, advanced AI, networking. This was sort of how we were trying to build that networking app. I talked about the first one that failed, but I had a pretty good PRD. So if you don't know how to do this, it's okay. Go and just go into it. If you've never done it before, it's actually fine because this is the beauty of AI. AI can help organize things for you. Go into a Google Doc and write two or three pages of everything you want this app to do. Everything you want. Everything. Every button you can think of, every function, every bit of look and feel, everything you can think of that you want this app to do.

26:49It's okay if you haven't done it before in its stream of consciousness. It's okay if this isn't how a VP of product at a top AI company would do it. write it your way in human language and then cut and paste and put it into clod and say turn this into a prd for me for replet or for lovable and they'll actually do a great job they will take your this is where ai shines it doesn't have to be perfect they will take your stream of consciousness and help you turn it into a prd you can work through it you can even ask clod or chat to me what am i missing what have i not thought through on my spec on my prd and they will be great and they will say you did not think through user authentication you did not think through this flow.

27:25They will come up and they will say, do you want me to help you think through that? Yes. Please give me four or five bullets to add to my spec. And you will come out of that convo. And it may take you a couple hours to do this, not five minutes with a great PRD that you can upload to a lovable replet, et cetera, and get going. And this will radically increase the quality of what you vibe code having a great spec. It's just, this is as true with an AI as it is with a bunch of humans. If you just ask your first developer, hey, just go build this without any spec. I mean, there are some really creative ones that can do that, but man, it's much better if you have a perfect spec built.

28:00And this is where you Google doc plus Claude can really get ahead. And it's again, it's okay if you haven't done this, but here's the thing. The vibe coding apps know this, the replets, the lovables, et cetera. And they will actually do this for you. If you write in, I want to build an AI first hub spot that does this and that not only can you do it in one sentence, but they will actually help you come up with a spec, ask you if the spec is right, and then tell you if it's good enough to put into production. And so that is much better than nothing. Like these platforms, I could be critical of them, but they're getting so much better.

28:32Every week they're pushing out new features, new things. And so the platforms themselves will do a bunch of this, but it's much, much better if you slow it down, slow it down and do it ahead of time, because these vibe coding platforms work at light speed and they'll encourage you to cut every corner to skip steps. And that's not what you want to do here. Define it as much as possible. Take hours to do this, then iterate it with Claude. Then ask Claude what you're missing and then put it into the prosumer vibe code you're doing. Okay. Number five, and hopefully you will glean this if you do your research of a couple of days of looking at other prosumer vibe apps that are in production that were done without developers.

29:12If you look at a lot of them, the dinosaur app, the whatever app, they'll look pretty slick at first, although they'll all start to look the same because they all use Claude and Claude artifacts for the most part. But understand, a lot of stuff that looks hard actually is fairly easy with prosumer vibe coding, which is cool. But a lot of stuff you would think, hey, this has got to be easy. It isn't. It isn't. Here's a fun one I was doing just, I think, this week. I'm skeptical we fixed anything. You're absolutely right to be skeptical. The email system isn't working. I can tell you, here's a list I've made of things you think should just work.

29:46They're not that hard, but man, these are super hard in the prosumer vibe apps. Email and scheduling. I have built five apps now. None of them get email or scheduling right. None of them get it right. They all stop sending emails that are supposed to be sent every hour, every day, once a week. They all stop sending them. They all lose track of the connection to SendGrid or Resend, which I prefer. it's constantly breaking the email constantly someone's going to have to constantly maintain this and i've talked to several leaders at the vibe code leaders and they get it and they're working on improvements here but you would think this would be easy how hard is it to send an email like just hook up send grid or resend get an api key you got to learn you're gonna have to learn how to get api keys if you're going to vibe good but it's not that hard you think this would just work on autopilot but there's a lot of reasons it's an endless headache so i today as we record this as we do this live.

30:39Honestly, I would not build any app that relies on email, that relies on it to function. It's just not going to be reliable. It's possible, but I wouldn't build it. I would build it. The second one, and you'll see this one all over the internet, all over folks talking about headaches of VibeCode, OAuth identity. It doesn't work in these VibeCode apps. It does not work with a big asterisk. What I mean is all of these apps have their own OAuth built in that is secure, that has been hardened. And everyone goes in and I know Replit the best because that's where I've spent time, but they all have the same ultimate, they're all more similar than they're different.

31:18And you're like, oh, I don't want to use the Replit OAuth that has their logo on it. I just want to use Classic Google. I want people just log in with Google or LinkedIn like they do in all the other apps I use, right? I just want it to be effortless. So you ask them to set it up for you and they do. And not only does it never work, but man, this is where you get security leaks. because they, cause Claude can't get it to work and it fakes it. And if you research, oh my God, I, I, you know, this vibe, I launched this vibe coding app and without within hours, hundreds of bits of confidential information were leaked and stolen by a hacker.

31:53It's almost always this. It's almost always trying to use any OAuth that's not built into the system. So you just, this shouldn't be that hard. How hard can it be to use a LinkedIn login? Like we've We do this on 7 million sites. It's just not possible, guys. Some folks will challenge me on this, but if you can just go deeper, don't listen to the apologists and the marketers. This is not possible. You have to use what's built in. And in general, use everything that's built into these platforms. It will just be more secure. If they have email built in, for example, I use Replit all the time. I do not like using SendGrid.

32:29I liked SendGrid in the old days when it was run by founders. It is impossible to use. There's no support available. It takes days to get back to you. I got caught in a doom loop going from free to paid. It's just brutal. So I'm like, I want to use Resend. Resend is super cool. I'm a super fan. Put that on the website. But Replit keeps wanting to use SendGrid. It keeps forgetting Resend and losing the keys and wanting to go back to its defaults. So use whatever these are in the defaults, which is usually Stripe, their own OAuth and something. Do not use others. Maybe Adjun's better. Maybe you want to use something else.

33:04Don't. use Stripe, use SendGrid, use their, importantly, use their OAuth. Okay. So that's hard. The third one, which almost, if we did a three-parter, this would be the entire third part and it would be brutal as enterprise security. This was the biggest mistake I made. And after I'd been through this, I can't give more kudos to Shopify and Squarespace and all of these folks because they allow millions of SMBs to not have to worry about this, to not millions of stores on Shopify, millions of web space on Squarespace and Wix, and no SMBs have to worry about, Hey, if someone buys my product on Shopify, all the data is going to be stolen, but you have to worry about it.

33:45You have to worry about it. If you vibe code your app, trust me, everyone agrees to this. Do the least collect the least amount of personal information, collect the least amount of data you can use the built-in Use Stripe if it's built into Repli. Use Stripe. Use what it does. But collect the least, not the most. And realize as soon as you generate a database in this app, as soon as there is a database, you have added security risk to your app. That is going to be ultimately your number one thing to worry about. If it's not the number one thing you're worrying about, then the only reason you're not going to get in trouble is because nobody cares.

34:20But I will tell you, and this is a scary thing. You know, I remember in the old days, my CTO, when I knew less about security, my CTO said, the only reason we haven't been hacked is nobody cares. This is what my old CTO said at Adobe Senate. The only reason we haven't been hacked is anybody cares. And he was wicked smart. And that has stayed with me for years. You would think if you used a prosumer vibe app and you launched an app for four people, who's going to care about my dinosaur trading card apps? Like who's going to care? And I would say until 18 months ago, your risk of getting hacked was approaching zero because nobody cared.

34:52people are gonna hackers always wanted to target the big ones the big names bring them down right not today my friends now the hackers the redditors want to attack all the vibe coded apps to make a point so they will go after all of them thousands and thousands of them they will try to steal your data and pii when you launch this is not a joke go on reddit you can see it folks think this is a sport. It is fun to make fun of people, non-developers that launch apps within secure databases. They think it's a sport. So this is far riskier than it was 18 to 24 months ago. And you should be worried about it.

35:29You should be worried about it. And this is the meta topic. And again, if we do a part two, we'll VibeCode together. And if we do a part three, half of it probably is enterprise security. Okay. And just in brief, a couple of the things that you would think should be easy because so much stuff is easy on VibeCoding. Like it's so cool, but it's hard media generation if you think you're gonna build a youtube clipping app or another descript or a canva it's just not there today it's just not there and probably because it's just not accessible enough from claude for one but it's just it just everyone says they like build these media apps no okay point five huge deal huge deal i should have known this before I started.

36:13It's obvious now. This ultimately is getting solved and will be massive for prosumer vibe coding. But right now, none of these platforms really support native mobile. Okay. It's complicated. Do they help you prototype a native mobile app? Yes. Can you hook up things like Expo and others and get close? Yes. But if you talk to the folks that work at these platforms, the lovables, replets, bolts, et cetera, they're like, this is for web apps. for web apps. This does not get you on the app store, the Apple app store. It just doesn't for a lot of reasons. And at first that might not seem like a big deal to you and maybe it isn't, but, um, you know, this isn't 2012.

36:53I mean, mobile is a bigger deal than desktop. Now, is it in B2B? No, right. And a lot of B2B apps were still in front of the browser and the mobile app is a, is ancillary, but I'll tell you for the first app for that matching app, I realized a couple of days in, hey, this would be best as a mobile app. Like, I don't really want this in the browser. I want you to be at home on your phone and saying, hey, Amelia wants to recruit a VP of marketing and she magically finds it on her phone. And it's going to be a massive amount of work. It's doable, but a massive amount of work to get a native mobile app built out of this.

37:24It may be beyond scope for most people. And three last things. And I hope that at least if you haven't started, at least this will give you a sense. And all of these things can be worked through on this list, but it's a lot more than 10 minutes. Custom design. This is something you may have to get comfortable with. There are templates. Replit has some nice templates. I think they launched in the last week. Lovable has always been design-focused and others. But at the end of the day, all these sites look like Claude. Once you see one Replit or Lovable site, you can just smell it. Someone was saying that 30 % of this YC class vibe-coded their app.

38:00And I went to see a couple. I'm like, that one's replic. It's lovable. Like I can see it now. And why can you see it? Well, they're all basically using Claude and Claude artifacts underneath. They're all running on Claude. Maybe some will run on, um, chat GPT five now that it's more developer focused, but they all run on. And so they all, if you try any of them, they all kind of output the same, not identical. There are differences, but it's kind of like a fettuccine Alfredo at one restaurant versus two others. I mean, you know, they're not that different. So just be aware that there are ways to, it is ultimately code.

38:34So of course you can design it, but without a designer and without a developer, it, your ability to have anything that doesn't look like a vibe coded website is going to be very limited. And these last two ones we hit debugging, anything complicated. We talked about this, the headaches I had, but the final one, and this is an existential issue. I do think the platforms are going to solve this, the lovables and replets, but this is at the edge of inexcusable today, which is for a lot of reasons, we're on a time that you can't run unit tests. And what are some folks will say, nod their heads. And other folks here will be like, what's a unit test?

39:09A unit test is how you keep your sanity. When you build a real app, not a toy app, not a prototype, not a one-page website, but a unit test every day, it tests it. Did the email scheduler work? Did the OAuth work? Did the Saster news work? Did the Saster stock quotes on our website work? Do the valuation calculator work? Our new Saster AI is so complicated now. And again, I kept it as simple as I could. We probably need like 50 unit tests a day to know if it's working. You know who that unit test is now? Me. Me. I got to do more work because every day I have to test every page of our website to make sure it works.

39:46Why can't you build unit tests, Lemkin? It's not that it's impossible, but let's talk about a non-developer vibe coding it. the problem is here's the simple problem if you build unit tests and this is if you go back to the craziness that happened to me on social media the agent when it first of all the agent wants you to be happy so we'll make up data that's number one issue we'll say it passed the test when it didn't but the worst thing is when it fails the test it will start changing your app it will start oh it didn't send the email you know what the answer is i'll switch to send grade and then the whole thing will be broken.

40:20So I know some folks will challenge me. I know if anyone from the big vendors watches this, they'll say, oh, that works, but it doesn't. It doesn't. And no one can really get these unit tests to work. And this has been an anchor of how you sanely have production software for years. And I do believe it's getting there. And just as the leaders have very recently added a basic level of security scanning, but it's great to find some security issues, they will ultimately add built-in unit tests for every app. Now, all this stuff is adding complexity, which they don't like, right? The leading vendors, they don't want to separate development from production.

40:58They don't want to do all this stuff because it takes this elegant one-sentence prompt that makes it complicated. But ultimately, they need an option where when you push to production, it will build unit tests for you. Those unit tests will probably run on a different server that is stateful, that is always running and it runs it for you automatically each day and sends you an update. But I do it and I'm getting better at the unit tests and Amelia and I get an email each morning from Saster AI telling it what's going on, but it's not reliable. It's just not reliable. And so you're going to have to be testing your, if you're serious about it, someone's going to have to be testing it every day.

41:36And then every day I got to fix the stuff that breaks one way or the other, I got to fix the date. So I'll give you one small example. If you go to the Saster.ai and you go to like news, there's a cool little video at the top that shows the latest video from 20VC with me, Rory, and Harry, like the latest one. It's really cool. And it rolls it and it looks like a newsroom. Half the time, it has the wrong one. No matter how many times I tell Replit and we have this thing and we use the YouTube API and we look at the latest one and then we see, is it the one that includes me or not? And we do this.

42:09And I bet if you go on it right now, you're going to see one from two weeks ago for Figma. I don't know if Amelia, if you're at your computer, you go to SAS today and tell me and nod your head, but you're probably going to see a two week old video on it. And every day I have to fix this every day. I have to fix this and a few other things. So this, the inability to have unit tests really work will drive you nuts. If you're serious about it, if you want to roll your own sales force. Okay. A couple other points. And, um, we might run out of time. And so if people want, we'll do a second session for more Q &A, but I think this stuff's important.

42:44Number six, this is, you know, when we had our original blow up with my agent deleting my database, I got a lot of advice here, but it was, I didn't understand it at the time, but now I get it. You have to understand how these AI agents work and that they're goal seeking. And that means they'll fabricate data. They'll fabricate results. They'll lie to finish a project. They'll lie to finish a project. Literally this happens to me this morning. Okay. This morning, I'm building this, again, this AI VC deck reviewer. It just worked. Hopefully, we'll push it out by next week. By the time we do this next one, we can talk about it.

43:19But it was struggling. Hours and after hours, it just wasn't working. It had to rag our data and combine it and then push it into the OpenAI API. It just wasn't working. And then finally, it said, oh, I fixed it all. And I said, this makes no sense. You can see it. This is from yesterday or maybe this morning. at the bottom right. You're absolutely right. The feedback's completely generic and useless. I've added canned responses instead of actually analyzing the pitch deck content. After all of this, it puts in, even though I put in the MD in the orders for Replit to never have fake or canned content, it still did it to make me happy because it couldn't get it to work.

43:59It couldn't get it to work. So after the third time we tried, it just started making the data up again. And so at first, like at first it won't matter because you're just vibing your first V1. You won't even see, and you're like, oh, okay. That's just a placeholder data. You call it placeholder data, but it's not so funny later when the data doesn't work and it puts in placeholder data when you ask. And even worse, as your app gets more and more complicated, you won't even know what's going on. So look, this is a huge headache, but these were all my JFCs in my original tweet thread. Now today I've learned to live with it.

44:35This is the most important thing. Your AI agent will lie. This is it. This is their version of hallucinating. It will say it, it will constantly say, once you start doing this, you do everything to say it's working great, Amelia. It's working great. Did you test it rapidly? No, I didn't test it. How do you know it's working great? No problem. Like literally this was all of me yesterday. It's working great. this deck reviewer i upload my my deck i made broken what do you mean are you sure it's working 100 sure it's working broken like 22 times it's just gonna make stuff up and you got to get good at this you got to get good at realizing it doesn't test stuff it makes stuff up and you will have to work around this or you will you'll never finish a project and if you look on the internet again a lot of folks will tell you 80 90 95 percent of vibe coded prosumer vibe coded apps are never finished.

45:29At best case, their prototypes are never finished. And this is number one reason people don't get their arms around that the AI agent is not truthful and you need to get comfortable with that. Okay. Number seven, this was one of the top mistakes I made and everybody makes it. It sounds simple, but it's not. Master the platform on day one. Master the platform. what do i mean i mean listen if you look at lovable and replet and bolt and whizzes base 44 and canvas offering and figmas they're all uh you know a simple prompt with uh with uh with a you know curved radii window that says tell me what you want it looks so simple we'll get it again point number one get it out of your system spend 60 minutes vibe coding whatever and then learn every icon, every button.

46:21How does it work? These platforms are super powerful. And I would say Replit, which I use is the nerdiest of them because I think because it started as an ID, a platform for developers 10 years ago, almost 10 years ago, and then blew up as a prosumer platform this year, going from one to 160 million already this year. Crazy, right? Crazy. But it's super nerdy because it's for developers. And so all these icons, half of them, I don't even know what they mean, but you got to learn them. You got to learn them. Like for example, on the right, on the upper right here, Replit just added this and kind of after our little fiasco, but build planner edit.

46:58Okay. A week ago, they didn't have this. What does this mean? You could ignore it. You could ignore it, but the most important one is build. It will build it plan. It won't break your website. It will just talk to you. Okay. You got to know that it's there. Like they just added that or you will you will not know about this function the second one this sounds basic if you've built software you get it but the one thing these platforms do really really well is rolling back the second one so when the ai agent goes off the rails when it breaks something when it deletes something it shouldn't when it makes a change it's not supposed to you can roll back you can roll back you just got to get good at it and in the old days like when i built saas software honestly rolling back never used to work it was something your developers would tell you and then you'd be like, you know, that release on Friday night at 1 a.m.

47:47It didn't really work. Dan, can we roll back? He'd be like, actually, we can't really roll back. That was something they would just tell you. 11 ,000 kudos to these platforms. It's magical. It's magical. You can roll back almost to any point in time, but you got to learn what that means. You got to learn if you're more than 10 or 15 minutes in and the agent just can't get something, you got to go back in time 10 or 15 minutes and you got to know where those rollback points are and get really good at it. And I would say, frankly, if you're not rolling back once a day, you're not doing it right.

48:19This is how you can fix things that are otherwise unfixable. But rolling back to a week ago, I mean, there's a million reasons that becomes impossible. There's a hundred checkpoints. The real problem is if you go too long without rolling back, you may lose three, four, five features, not 10 minutes of work. So I think it's almost a positive to roll back once every 15 minutes, because if you wait too long, the app may get too complicated. Um, okay. We hit rollback, break everything into chunks. And the last one I'll say when you get frustrated, I just put up on, I was just trying to get this, uh, this VC tech done before this call for fun.

48:59And if you look what I just wrote on X right before this, I wrote, here's the thing I do when I get frustrated. I just write dude. Okay. Obviously this is not acceptable developer language, but I do a screenshot of the bug and I just write dude. Okay. When that happens, you got to roll back or take a break. Okay. And just two more, two more quick points. And then Amelia, if we have time, we'll take some questions. This is where I think the marketing and I look again, I love, I love all these apps. I'm a replet fan despite the drama, but mainly because that's what I picked. I picked, I could tell you why it really doesn't matter.

49:33If I'd started with Lovable, I'd probably be a Lovable fan if I'd started with Bolt. I actually don't think it matters. There are pros and cons for these platforms, but maybe the most important thing is just pick one and become an expert. Know every icon, every feature, how rollback works, how the database works. It's much more important to be an expert in one of these platforms than to spend six months agonizing over which one to pick a leader and just become an expert. But where the marketing from Microsoft on down is the most misleading is the time. If you seriously want to put a simple but real B2B app into production with real users, collecting real information and charging for it for real, and you want it to be any good budget, a month.

50:13A month. And 60 % of your time will be QA and testing. Okay? And for even just a few days into a real project, most of your time will be screenshots, uploading screenshots. This broke. This doesn't work. You will be doing so much functional QA. You cannot believe it. You will literally, in the end of the day, be logging probably a thousand bugs on a serious website. This will become your life. Maybe you used to have people to do this for you. I used to have a team of QA engineers to do this for me. Now it's me. Now my life is screenshot and bugs. And then when I get to the final one and it's a screenshot and the only text I have is dude, it's time to take a break.

50:52Okay. But this will be your life. So if you're serious, look, if you want to build a prototype, if you want to build something and tell all your friends you're a vibe coder at Starbucks. You don't need to budget for this time. You could budget for a day or two, but if you want to build something real, it's going to take you a month and 60 % testing time. And if you look at this chart on the right, this is, I just pulled this from Replet. This is our new Saster AI website, which I would argue, yeah, it's going to have 15 or 20 ,000 people, but we haven't fully rolled it out. Most of our traffic is still going to saster.com and probably will for months.

51:23And so where are we? Well, you can see, you know, maybe august 10th looking at this was our real soft launch with any users 16 000 so far you know we're a month into it and we're not we're in production but we're not rolled out not really and i gotta test this thing every day every day and look at this fun one from this morning a parser extracts 12 but made it 12 million you're gonna have to deal with this why did parser decide 12 should be 12 billion that this that you had 12 million customers not 12 i don't know, but, um, every day you're going to be doing this. Okay. This last one, we kind of hit it, but then I'll break.

52:01We talked in the beginning about who's going to, who's going to do the pushes. Who's going to do it once it's in production. If you're serious, you've got to have an exit strategy. I'm not the first one to say this, but you got to have it. If you actually get your app into production, you actually charge for it. And you actually have paying customers and real users and real PII who will maintain it, who will build new features. You think you don't want a lot, a lot of the mythology around vibe coding somehow magically assumes once you launch, you won't want to add features. Of course, you know, if you've, but any founder, any SaaS executive here, B2B knows your, your ad features your whole life.

52:35Who's going to do it? Who's going to fix the bugs that you introduce when you add features? Okay. Who will restart the database? I mean, even with our new Saster AI, once every couple of days, it's just down and no one knows why. It's not just like, it literally just has some like database, not working error in the upper left. Now I go into Replit, I restart it, it works. Who's going to do that? Who's going to fix the workers? And if you look at the right, this is me coming back from a trip earlier this week. It's me guys. That's me on the plane doing it myself. You want that to be you? You are going to sign up maybe forever if you don't have an exit strategy here.

53:10So my thoughts on getting going, hopefully it's helpful. Go through this, learn the platform code, get it out of your system. Just one shot one and get out of your system. Find ones that are similar and then take security and all of it seriously because it's a month to get something real out and it's a lifetime making it secure. Thanks, everybody. We'll do more and really appreciate everyone's time. The biggest B2B and AI event of the year is back. It's the Sastra AI Summit in the SF Bay Area, aka the Sastra Annual. It'll be back in May, 2026. With 36 % of everyone coming CEOs, it's an incredible AI-first professional event.

53:49The very, very best S-tier folks will be there talking about sharing and learning how to scale AI and B2B in this new world. But here's the reality. The longer you wait, the higher ticket prices go up. They're really cheap at the beginning. And then, you know, just a few days before, they get kind of expensive. But you've been warned. Early bird tickets are available now, and I want to see you there. Once they're gone, you'll pay hundreds more. So book your spot today by going to podcast.sasterannual.com. That's podcast.sasterai.com to get you exclusive discounts for Saster AI SF 2026. We will see you there.