Vibe code a secure app in 2026 (4 experts share all)

Thank you to Supabase for partnering with No-Code MBA on this webinar. Learn how to go from AI prototype to production-ready app in a safe, scalable way. PANELISTS: Zemo - Lead Product Builder, Brothers Agency: https://brthrs.nl/en/ Harry - Founder & CEO, Imaginary Space: https://imaginaryspace.co.uk/ Victor - CTO, Performanze: https://www.performanze.com/en ━━━━━━━━━━━━━━━━━━━━━━ KEY TOPICS COVERED: ━━━━━━━━━━━━━━━━━━━━━━ 1️⃣ PROTOTYPING WITH CONTEXT ENGINEERING (ZEMO) THE 80/20 RULE: Spend 80% of time planning, 20% implementing. Real skill isn't prompting - it's context engineering. "AI is average intelligence. It goes to the average. But if you provide the right context, you can build something that scales." SUPABASE DOCUMENTATION STRATEGY: Instead of "Build authentication" do this instead: "Go into Supabase docs and find the right way" "Create a plan based on research" "You're a junior engineer - review docs and ask questions" PRO TIPS: 💡 Keep PRDs simple (goal, user stories, metrics, features) 💡 Read all AI output - don't just accept everything 💡 Ask AI to explain technical elements in plain English 2️⃣ SECURITY & PRODUCTION (HARRY) WORKING WITH ENTERPRISES: Can't just vibe code and hope. Need proven security practices: Code checks between dev and production Tools like Cursor Bug Bot, Code Rabbit Supabase RLS policies, SSO, enterprise features Branching and sandbox data for safe testing DEMO WORKFLOW: → Create DB schema visualization with Claude → Use Claude to pull data from Slack, Linear into Supabase → Build custom front ends that summarize data → Companies get single source of truth instead of SaaS overwhelm 3️⃣ SOFTWARE - CUSTOM INTERNAL TOOLS (VICTOR) THE PROBLEM WITH SAAS: "I only use one small menu in Salesforce but pay for everything. I want THIS specific feature but I'm too small." SOFTWARE BENEFITS: → Your data is YOUR commodity (not locked in SaaS) → No unused license fees → You own the code → Add features in weeks, not waiting on SaaS roadmap MODEL SELECTION: Complex planning: Opus 4.6 or GPT o1 Simple tasks: Smaller models for cost savings Victor's preference: Opus 4.6 for coding DEMO: HR EVALUATION PLATFORM Built custom tool replacing multiple SaaS products: Custom assessments and questionnaires Copilot/GPT replacement with multiple models Context from Teams, SharePoint, Outlook Email reading/sending, auto presentations ━━━━━━━━━━━━━━━━━━━━━━ SECURITY ESSENTIALS: ━━━━━━━━━━━━━━━━━━━━━━ OWASP TOP 10: Have AI review codebase against standard security checklist ACTIVELY TRY TO BREAK YOUR APP: → Test prompt injection attacks → Check if AI returns restricted data → Structure database so AI can't access wrong areas "80% of apps had security issues BEFORE AI. Security isn't new to vibe coding - but you need to actively check." ━━━━━━━━━━━━━━━━━━━━━━ CHANGING CLIENT EXPECTATIONS: ━━━━━━━━━━━━━━━━━━━━━━ THE REALITY CHECK: CEO built CRM with console.log exposing all security info. Built, but not production-ready. "Programmers aren't replaced. They have more tools to be productive. But you need core knowledge for secure systems." RESETTING EXPECTATIONS (ZEMO): "Yes, time and cost collapsed. But production-ready still requires time, effort, money, and engineering expertise. You can build in one prompt - but will it be consistent over time? Probably not." IMAGINARY SPACE APPROACH (HARRY): Started with "build startup in 30 days" Adjusted for enterprise complexity Spend extra weeks on scope/security Set up guidelines, design system, security preferences upfront "We build fast, but if you want something secure that won't leak everyone's email, we need time." ━━━━━━━━━━━━━━━━━━━━━━ KEY TAKEAWAYS: ━━━━━━━━━━━━━━━━━━━━━━ ✓ Context engineering → prompting skills ✓ Supabase docs make AI implementation better ✓ Traditional security practices still essential ✓ Software (custom tools) viable alternative to SaaS ✓ Plan database schema before building ✓ Different models for different tasks ✓ Actively test security ✓ Fast prototyping ≠ instant production ⏰ TIMESTAMPS: 0:00 - Introduction & overview 2:15 - Prototyping with Lovable (Zemo) 8:30 - Context engineering strategy 18:45 - Demo: Dog walking app 25:30 - Security for production (Harry) 38:20 - Demo: Internal tooling 45:15 - Software concept (Victor) 52:40 - Demo: HR platform 58:30 - Security deep dive 1:05:20 - Client expectations 1:12:45 - Q&A #supabase #ai #vibecoding #lovable #production