Before any code
Ownership and system of record, risk classification, and a complete product definition — Phases 0–2.
Visual Edition 2.1 · Current through Aug 4, 2026
Your AI can write the app.
It can't tell you what's missing.
A generated app can look finished while only the happy path exists. The Vibe Coder Guide is a 93-page, gate-by-gate system that takes an AI-assisted build from prompt to production — with the security, privacy, accessibility, reliability, and legal work that demos quietly skip.
Build smarter. Ship faster. Stop guessing.
- Instant download
- 93-page PDF
- Secure checkout by Stripe
- Yours to keep — no subscription
The gap
A working screen is about 8% of a production app
The demo passes. Then the first real user, the first duplicate request, the first screen reader, the first refund, the first outage. Here is the surface area a vibe-coded app usually leaves undefended.
Authorization that exists only in the UI
Tenant boundaries nobody ever tested
Secrets sitting in client code or git history
Privacy promises the code doesn't keep
Flows no keyboard or screen reader can finish
Retries and timeouts that double-charge users
Backups that were never actually restored
Migrations with no rehearsal and no rollback
Alerts that reach nobody at 3am
Store disclosures that contradict the app
Admin tools that can impersonate without audit
AI features that can act with the user's authority
The rule the whole guide is built on: a feature is not done when it works. It is done when it
works for the right person, with the right data, under failure and abuse — accessibly, observably, reversibly,
and with test evidence.
The system
Ten stages. Every one has a gate you have to earn.
You work one stage at a time. Your Builder AI creates. A separate, clean-session Audit AI reviews the frozen version read-only and reports evidence. You fix, retest, and only then pass the gate. Nothing advances because code exists — it advances because proof exists.
- Initialize AUD-01Own the app. Name the Builder AI, the Audit AI, and where evidence lives.
- Classify AUD-02 + MOD-*Users, ages, markets, data, money, AI, regulated functions. Risk tier assigned.
- Specify AUD-03Workflows, edge states, harms and measurable requirements — before any code.
- Design AUD-04 → 07Data, privacy, architecture, threat model and accessible UX.
- Establish controls AUD-08 + 18Repository, environments, secrets, dependencies and a pipeline that blocks unsafe releases.
- Build slices AUD-09 → 13One vertical feature at a time, each against the Feature Definition of Done.
- Verify together AUD-14 → 21Tests, security, accessibility, privacy, resilience and recovery on the real candidate.
- Legal & distribution AUD-22 → 23Contracts, claims, billing and store disclosures aligned with what the app actually does.
- Launch AUD-24 → 25Freeze, review the audit register, staged rollout, go/no-go with rollback and abort thresholds.
- Operate AUD-26 → 2724h / 7d / 30d reviews, monthly control checks, quarterly audits, annual assurance.
Separate the AIs
Builder AI creates. Audit AI starts clean, reviews read-only, and reports evidence. No AI silently approves its own work.
Freeze the exact version
Every audit names the exact commit, build, configuration, model, prompt and environment it examined.
Test reality, not prose
Scanners, tests, staging, physical devices and manual checks — not an AI's confident summary.
Escalate red triggers
Defined moments where an AI review must stop and a qualified human takes over: law, certification, high-impact risk, severe harm.
What the guide contains, by the numbers
93pages, visual edition
10gated build stages
27defined audits
20numbered phases
8audit environments
4risk tiers
What's inside
Nine parts, from "before any code" to "shut it down responsibly"
Every phase ends in an exit gate with required artifacts. Every audit says when it runs, where it runs, who performs it, and what evidence it must produce.
Design the whole system
Data inventory and governance, architecture and failure boundaries, threat modelling, and accessible, honest UX — Phases 3–6.
Build it safely
Supply chain, identity and authorization, application security controls, data integrity and recovery, resilient APIs and jobs, safe admin and moderation — Phases 7–12.
Conditional modules
Activated by what your app actually does: payments and subscriptions, AI and autonomous agents, children and education, health, credit and housing decisions, location and biometrics, enterprise multi-tenancy, offline and IoT, analytics and SEO, internationalization.
Prove it works
The complete test system, reliability, performance, observability and cost, plus incident, breach and business-continuity response — Phases 13–15.
Legal & commercial
Entity and IP ownership, terms, privacy notices, DPAs, licences, billing, taxes, refunds, marketing substantiation, and app-store readiness — Phases 16–17.
Launch and operate
The launch gate itself — staged rollout, abort thresholds, rollback owner — then operating, patching, retesting and retiring safely — Phases 18–19.
Reusable templates
Feature Definition of Done, ten questions to ask before accepting any AI-generated feature, stop-ship red flags, a paste-ready build instruction for a coding agent, and AI-first vs human-escalation checkpoints.
Baselines & sources
Primary sources to check at project start and again before launch — security, accessibility, privacy, children and health, payments, stores and AI.
Proportional, not paranoid
Four risk tiers decide how hard you have to work
A public marketing site and a consumer lending app do not deserve the same process. Stage 2 classifies the app, and the tier sets the minimum review posture for everything downstream. When you're uncertain, you classify upward until evidence justifies a lower tier.
The same logic activates conditional modules — payments, AI agents, children, health, biometrics — so you only carry the obligations your app actually triggers.
Tier 1 — Low Clean-session Audit AI
Tier 2 — Standard Different Audit AI + tools
Tier 3 — Sensitive External assurance
Tier 4 — High impact Human-led validation
Look inside
Real pages from the guide
It's a visual edition: diagrams, decision tables and fill-in templates you can work from directly — not a wall of prose.
Who this guide is for
Built for you if…
- You're shipping something real with Claude Code, Cursor, Copilot or similar
- You're the only person accountable — no security team, no QA department
- Your app touches accounts, money, personal data, children, health or AI decisions
- You're heading for the App Store, Google Play or a first enterprise customer
- You can read a gate and refuse to pass it
Not for you if…
- You want a language tutorial or a framework walkthrough
- You want prompts that make the AI write code faster
- You're building a weekend toy nobody signs into
- You want a certification, an attestation or legal advice
- You want permission to skip the parts you don't like
Grounded in current baselines
Mapped to the standards your reviewers already use
Default engineering targets are OWASP ASVS 5.0, NIST SSDF 1.1 and WCAG 2.2 Level AA — plus the platform and sector sources that apply to what you're building. Part IX lists every primary source so you can re-check them at project start and again before launch.
- OWASP ASVS 5.0
- OWASP MASVS
- NIST SSDF 1.1
- NIST SP 800-63B-4
- WCAG 2.2 AA
- ADA & Section 508
- European Accessibility Act
- GDPR
- CCPA
- COPPA
- FERPA
- HIPAA
- PCI DSS 4.0.1
- CISA Secure by Design
- NTIA SBOM
- NIST AI RMF
- EU AI Act
- Apple & Google policies
The Vibe Coder Guide — Visual Edition 2.1
One file. Every gate. $49.95.
One unreviewed authorization bug, one failed store review, one untested restore costs more than this in a single afternoon. Buy once, use it on every app you build.
- 93-page PDF, Visual Edition 2.1 — diagrams, decision tables, fill-in templates
- The ten-stage build-and-audit graph with exit gates
- 27 audit definitions — when, where, who, and what evidence
- 20 numbered phases plus conditional modules for payments, AI, children, health, finance, location and enterprise
- Reusable templates — Feature Definition of Done, stop-ship red flags, and a paste-ready build instruction for your coding agent
- Read on any device — no app, no account, no DRM
$49.95 USD · one-time
Instant download after checkout, plus a copy by email.
Secure payment by Stripe. We never see or store your card details.
All sales are final — it's a digital file, delivered instantly. So we've put six real pages on this page: read them before you buy, or ask us anything first.
By purchasing you agree to the Terms of Sale and the Privacy Notice.
- Encrypted checkout
- PDF, 424 KB
Questions
Before you buy
What exactly do I get for $49.95?
A 93-page PDF — The Vibe Coder Guide, Visual Edition 2.1. It contains the ten-stage build-and-audit graph, 20 numbered phases, 27 audit definitions with when/where/who/evidence, eight audit environments, four risk tiers, conditional modules for payments, AI, children, health, finance, location and enterprise, plus reusable templates including a Feature Definition of Done and a paste-ready build instruction for a coding agent. You download it immediately after checkout and the link is also emailed to you.
Do I need to be a professional developer to use it?
No. The guide is written for a solo builder working with AI coding tools. It tells you what to require, what evidence to demand, and when to stop and bring in a qualified human. You don't need to write the code yourself — you need to be able to read a gate and refuse to pass it.
Is this specific to one programming language or framework?
No. It's stack-agnostic. The requirements, audits and gates apply whether your AI wrote React, Swift, Python or anything else, and whether you ship to the web, the App Store or Google Play.
Which standards does the guide align to?
Default engineering targets are OWASP ASVS 5.0, NIST SSDF 1.1 and WCAG 2.2 Level AA, plus the platform and sector sources listed in the final chapter — OWASP MASVS, NIST SP 800-63B-4, CISA Secure by Design, NTIA SBOM minimum elements, GDPR and CCPA, COPPA, FERPA, HIPAA, PCI DSS 4.0.1, the NIST AI Risk Management Framework and the EU AI Act.
Is this legal advice or a compliance certification?
No. It's an engineering and product-governance guide. It's explicit that an AI-assisted internal audit is not a third-party certification or a licensed opinion, and it routes you to qualified humans — counsel, clinicians, accessibility specialists, external penetration testers — at defined escalation triggers.
How is the file delivered, and what's the refund policy?
Checkout is handled by Stripe. The moment payment succeeds you get a secure download link on screen and by email, and you keep the file permanently.
All sales are final. It's a digital file that transfers to you instantly and can't be returned, so we don't offer refunds, returns or cancellations — which is exactly why six real pages, the full contents breakdown, and a blunt "who this isn't for" section are all on this page before you spend anything. Still unsure? Ask us first and we'll tell you honestly if it's not a fit.
Separately: if your link expires, you lose the file, it won't open, or you're charged twice — that's not a refund, that's support, and we fix it free. See the refund policy.
Can I use it for client work or inside my company?
Yes — one purchase covers you as an individual builder, including on apps you build for clients. What you can't do is redistribute, resell or republish the file itself, or share your download link. Team and organisation licences are available: email support@vibecoderguide.net. See the licence for details.
Is this site accessible?
It's built to WCAG 2.2 Level AA — full keyboard operation, visible focus, tested contrast, semantic landmarks, reduced-motion support and a light theme. If anything blocks you, tell us and we'll fix it: read the accessibility statement.
Stop guessing. Start building.
The durable advantage isn't generating more code. It's making every requirement, boundary, failure, control and proof explicit — then refusing to launch until the important ones are real.
93-page PDF · instant download · secure Stripe checkout · all sales final