You’ve probably seen the posts. “I built a SaaS in a weekend with AI.” “From idea to launch in 48 hours.” Maybe you’ve tried it yourself, typed something like “build me a task manager app,” and watched code appear on screen.
It works. Sort of. Until it doesn’t.
The difference between vibe coding and agentic engineering isn’t the tools. It’s the prompts. It’s what you bring to the conversation before the AI writes a single line of code.
Let me show you what I mean.
The Project: A Simple Task Manager
We’re going to build a task manager. Users can sign up, log in, create tasks, mark them complete, and get email reminders. Basic stuff. The kind of project that shows up constantly in r/vibecoding as someone’s first SaaS attempt.
It’s also the kind of project that regularly ends up with exposed API keys, broken auth, and databases that leak user data. Not because AI is bad at coding, but because the prompts were bad at architecting.
Let’s look at how the same project gets built two different ways.
The Vibe Coding Prompts
Here’s how someone without architecture experience might prompt their way through this project:
Prompt 1:
Make me a task manager app with user login and email reminders
Prompt 2: (after getting something that sort of works)
The login isn’t working, fix it
Prompt 3: (after more issues)
Add a database to store the tasks
Prompt 4: (when emails don’t send)
The email reminders aren’t sending, make them work
Prompt 5: (when styling looks off)
Make it look more modern and clean
You can see the pattern. Each prompt is reactive. Something doesn’t work, ask the AI to fix it. Something’s missing, ask the AI to add it. No context about how pieces connect. No requirements beyond “make it work.”
The AI will produce code. It might even run. But you’ll end up with:
- Authentication that stores passwords in plain text (or some other security nightmare)
- Database queries built with string concatenation instead of prepared statements
- API keys hardcoded in client-side JavaScript
- No session management, or broken session management
- Email credentials sitting in a config file that gets committed to git
- Five different ways of doing the same thing across different files
- No error handling because nobody asked for it
This isn’t hypothetical. There’s a guy who became internet-famous after his vibe-coded SaaS got hacked. Exposed API keys, bypassed subscriptions, database corruption. His response: “as you know, I’m not technical so this is taking me longer than usual to figure out.”
As I’m writing this, there’s a vibe-coded app circulating that leaked its entire user database and gave full access to users social media accounts. It’s currently for sale for $50k USD. This is the dangerous territory we’re in now.
That’s the vibe coding trap. You can’t debug what you don’t understand. You can’t secure what you didn’t know was exposed.
The Agentic Engineering Prompts
Here’s how I’d approach the same project. Before writing any code, I’d start with planning mode.
Prompt 1: Planning
I’m building a task manager in PHP with MySQL. Before we write any code, let’s plan the architecture.
Users need to register, log in, create/edit/delete tasks, mark tasks complete, receive email reminders for tasks with due dates.
I want to discuss database schema, authentication approach, session handling, file structure, and how we’ll handle the email reminder system.
Don’t write code yet. Let’s talk through the architecture first.
This prompt does something critical. It forces a conversation before implementation. The AI will ask clarifying questions. You’ll discuss options. You’ll make decisions together about how things connect.
Prompt 2: Database Schema
Let’s design the database schema.
Users table needs id, email (unique), password hash (using password_hash()), created_at, updated_at.
Tasks table needs id, user_id (foreign key), title, description (nullable), due_date (nullable), completed (boolean, default false), created_at, updated_at.
Write the MySQL CREATE TABLE statements with proper indexes. Use InnoDB, utf8mb4 charset.
See the difference? I’m specifying password_hash() because I know that’s the right way to handle passwords in PHP. I’m asking for foreign keys because I understand relational data. I’m specifying the charset because I’ve been bitten by encoding issues before.
Prompt 3: Authentication
Now let’s build the authentication system.
Requirements:
- Registration with email/password, validate email format, minimum 8 character password
- Login creates a session, regenerate session ID on login to prevent fixation
- Logout destroys session completely
- All password operations use password_hash() and password_verify()
- Store only the session ID in cookies, user data lives server-side
- Include CSRF protection on all forms
Use PDO with prepared statements for all database queries. No string concatenation in SQL.
I’m not asking the AI to “make login work.” I’m telling it exactly how authentication should work, what security measures to include, and what patterns to follow. The AI fills in the implementation details while I maintain architectural control.
Prompt 4: Task CRUD
Build the task management functions.
All database operations should be in a Task class with these methods:
- create(int $userId, string $title, ?string $description, ?string $dueDate): int
- getByUser(int $userId): array
- getById(int $id, int $userId): ?array (include user_id check to prevent accessing other users’ tasks)
- update(int $id, int $userId, array $data): bool
- delete(int $id, int $userId): bool
- markComplete(int $id, int $userId): bool
Every method that takes a user ID must verify the task belongs to that user. Use prepared statements.
Notice I’m explicitly requiring user ownership checks. A vibe coder might not think about this until someone accesses another user’s tasks by guessing IDs. By then it’s a security incident, not a learning opportunity.
Prompt 5: Email System
For email reminders, I want a separate cron job approach rather than sending during web requests.
Create a script that:
- Will run via cron every hour
- Finds tasks with due_date within the next 24 hours that haven’t had reminders sent
- Sends reminder emails using PHPMailer
- Logs what was sent to prevent duplicate reminders
Email credentials should be loaded from environment variables, not hardcoded. Include a .env.example file showing required variables without actual values.
I’m specifying environment variables for credentials because I know API keys in code get leaked. I’m asking for a cron job because I understand that sending email during a web request is slow and unreliable. I’m asking for logging because I know duplicate emails will annoy users.
The Difference Isn’t Typing Speed
A vibe coder and I can both build a working task manager. The vibe coder might even finish faster on day one.
The difference shows up on day thirty. When something breaks. When you need to add a feature. When you discover a security issue. When a user reports a bug you can’t reproduce.
The vibe coder is stuck. They don’t know why the code works, so they can’t figure out why it stopped. They throw more prompts at it, hoping something fixes the problem. Sometimes it does. Sometimes it makes things worse.
I can trace through the system because I designed it. I know where authentication happens. I know how sessions work. I know where the database queries live. I can debug because I understand.
Using Planning Mode and Agents
If you’re using Claude Code, planning mode is your secret weapon. Instead of jumping straight into code generation, you can have a conversation about architecture first.
Start with /plan or just tell it you want to discuss before implementing. Lay out what you’re building, what pieces need to exist, how they’ll connect. Let it ask questions. Answer them. Make decisions together.
When you do start coding, use agents for specific tasks with clear boundaries. “Review this authentication code for security issues.” “Write tests for the Task class.” “Check how this new feature interacts with the existing reminder system.”
The agent works best when you give it context and constraints. What files are relevant. What patterns you’re following. What you’re worried about. What you want it to check for.
This is collaborative. You’re the architect reviewing the builder’s work. Not a passenger hoping the car knows where it’s going.
The Bottom Line
Good prompts come from understanding what you’re building. You don’t have to write every line of code yourself. But you do need to know what questions to ask, what patterns to specify, and what security issues to prevent.
AI can hold context across your entire codebase and move faster than any human. That’s its superpower. Your job is pointing that power in the right direction.
The vibe coder says “build me a thing” and hopes for the best. The agentic engineer says “here’s what we’re building, here’s how the pieces connect, here’s what I need you to watch out for.”
Same tools. Wildly different results.
