Vibe-coded SaaS is the default now, and verification is the work that's left

YC's latest batch is roughly 95% AI-generated code. Founders are shipping SaaS MVPs in days, with Cursor and Claude Code cutting build time 3 to 5x and free tiers on Supabase, Vercel, and Resend widening the runway, per Superframeworks. The speed story is over. It won. Vibe coding isn't a trend to evaluate anymore, it's the baseline.

Here's the counter-signal that nobody putting "built in a weekend" in their launch tweet wants to read: roughly 45% of AI-generated code contains security vulnerabilities, and about 40% has exploitable bugs. So the batch shipped fast and shipped holes.

This lands exactly where story one did. The raw model isn't the moat. Anyone can generate the code. What's scarce is the judgment to verify it, harden it, and know which of the 45% is the load-bearing 45%. Speed-to-ship was the differentiator for about eighteen months. Now everyone has the speed, which means it differentiates nothing.

I've lived both sides of this. I shipped 360K+ lines solo last year leaning hard on Claude Code in my personal projects, and the parts that took real time weren't the generation. They were the review passes where my design and engineering background actually earned its keep, catching the auth check that looked right and wasn't, the input that got trusted when it shouldn't be. The model wrote the code in minutes. I spent the hours deciding whether to trust it.

The honest read: the cannibalization of paid SaaS by solo vibe-coders is real, and it's underwriting a remediation and security-tooling market that's about to get large. Every weekend MVP with a 45% vulnerability rate is a future customer for somebody's scanner. That's not a knock on vibe coding. It's where the defensible work moved. If you're building, the differentiated skill in 2026 isn't generating the feature. It's the verification loop around it. The taste to know what's wrong with output that looks fine is the thing a model still can't hand you.