I want to talk honestly about vibe coding.
Not to tear it down. Not to hype it up beyond recognition. I want to talk about it the way you'd talk to someone who just discovered something genuinely powerful and is about to sprint full speed without understanding the terrain.
Because that's what I did. Mostly on purpose. And it taught me more about AI-assisted development — its real ceiling, its real floor, and the discipline it actually demands — than anything I'd read about it.
Here's the project: Memtoon. The tagline is YOUR LIFE. YOUR STORY. YOUR WEBTOON. The pitch is this: you sign in with Google, connect your calendar, optionally upload a selfie, pick a timeframe (last 24 hours, last 7 days, or last 30 days), and in under two minutes your actual week becomes a personalised, manga-style webtoon comic. AI-written story arc. AI-rendered panels. A permanent shareable link. Zero creative effort required from you.
I built the whole thing — ten phases, full-stack, production-deployed — using an AI coding agent on Replit.
Let me tell you exactly what that looked like.
The problem that wouldn't leave me alone
Every week, I have a week worth remembering. Most of you do too.
But the data evaporates. Calendar apps accumulate structured, timestamped records of your life and do absolutely nothing with them. Photo rolls bury context. Social feeds flatten everything into the same scroll. The problem isn't that we lack tools for storytelling. The problem is that no tool has ever done the storytelling for you — from data you already have, in a format compelling enough to share.
I kept turning over this question: there are over 500 million Google Calendar users in the world. Every single one of them has a structured, timestamped record of their life sitting in a database. And nobody has turned that into a product. Not Google. Not Meta. Not any of the well-funded AI comic startups operating in this space.
The existing AI comic generation market — Dashtoon, Jenova, LlamaGen, Komiko — has solved exactly the wrong problem. They're all creation tools. They require you to bring a story idea, write a script, design a character, supply creative direction. Those are tools for aspiring creators, and the addressable market for aspiring creators is narrow.
The real market is everyone who lived an interesting week and would pay a dollar to see it as a comic.
That realisation was the starting gun.
What vibe coding actually is (and isn't)
Andrej Karpathy coined the term in early 2025: "There's a new kind of coding I call 'vibe coding', where you fully give in to the vibes, embrace exponentials, and forget that the code even exists."
The internet ran with it. Some people heard "forget that the code exists" and thought it meant code quality stops mattering. Some developers reacted like the craft was being disrespected. I think both reactions missed the point.
Vibe coding is a workflow shift. Instead of writing implementation, you describe intent. Instead of debugging syntax, you describe behaviour. The agent handles the plumbing; you handle the architecture of ideas.
What it is not — and this is the part most people learn the hard way — is a replacement for judgment. It amplifies whatever judgment you bring. If you bring clear thinking, it moves fast. If you bring vague thinking, it moves fast in the wrong direction.
This is true whether you're an experienced engineer or someone who came to building software through AI tools and never had a traditional development background. The tool doesn't care. The discipline is the same.
I've been building scalable web apps since 2009 — supply chain platforms, telehealth systems, social networks, zero-knowledge architectures. By the time I sat down to build Memtoon, I'd accumulated opinions about how systems should behave. Vibe coding let me act on those opinions at a pace I'd never experienced before. But the opinions still had to be mine.
If you don't yet have that accumulated opinion base — that's fine. Building is how you form it. The key is to slow down at the decisions that compound, and let the agent move fast everywhere else.
That distinction matters more than anything else I'll say in this post.
Building in phases: what ten rounds with an AI agent actually looks like
I structured Memtoon's development across ten discrete phases. Not because the AI required it, but because I required it. That structure — clear, bounded, outcome-defined — turned out to be the single most important practice I developed.
Phase 1 was foundation: a TypeScript monorepo, database schema, an Express 5 API skeleton, Google OAuth authentication via Passport.js, session storage, a working login-to-dashboard-to-generate flow, and a bootstrapped admin panel. The AI scaffolded all of this. I was the architect; the agent was the crew.
Phase 2 connected the AI pipeline: Google Cloud Storage for permanent image storage, story generation via Anthropic Claude, image generation via Together AI's FLUX models, and the gallery system. This is also where the first real lesson surfaced. Early test generations produced panels with non-English text and brand watermarks embedded in the images. The pipeline needed three-layer enforcement — a Claude language gate, an image style guide, and a negative prompt — to consistently produce clean output. An AI coding agent cannot tell you that problem exists before you see it. You have to observe, think, and direct. The agent then executes the fix.
Phases 3 through 5 covered product polish (SEO, Google Analytics, demo personas, light and dark mode), first monetisation with Gumroad, the move to a custom domain, and a pricing revision that established $1.00 per credit as the stable price point. Each phase had a specific brief. The agent worked within it.
Phase 6 shipped the feature that separates Memtoon from every competitor in the AI comic space: selfie upload. The user's photo is passed to FLUX.1-kontext-pro as an image-to-image visual reference. The model uses it to anchor the protagonist's appearance across every panel. No biometric data is stored — the selfie is staged in cloud storage, used for generation, and deleted within seconds of generation completing, guaranteed by a finally block on both success and failure paths. That privacy-first-by-design pattern wasn't suggested by the agent. I designed it. The agent implemented it.
Phase 7 was PayPal integration, which turned out to be genuinely non-trivial. PayPal's New Checkout Platform strips custom query parameters from return URLs, which means you cannot pass a session identifier through the standard flow. The solution required a UUID token generated at checkout initiation, stored server-side, and matched at claim time against the authenticated session. Three new database tables. A race-condition guard for concurrent IPN delivery. The agent wrote the code. I understood the problem.
Phase 8 added Microsoft Outlook as a second calendar source, parallel-fetched alongside Google Calendar. Phase 9 shipped a full investor pitch deck with React and GSAP ScrollTrigger animations, connected to live production data from the stats endpoint so the metrics an investor sees reflect the actual state of the platform in real time. Phase 10 added a cinematic intro video, a Product Hunt badge, and a security audit that surfaced a GCM authentication tag length vulnerability. createDecipheriv was being called without specifying authTagLength, meaning Node.js would accept any authentication tag between 4 and 16 bytes. The fix added explicit authTagLength: 16 enforcement and a pre-decrypt length guard — two layers of defence in depth. Static analysis caught it, I understood the attack vector, and the agent patched it.
Ten phases. Zero days of pretending the code didn't exist.
What I learned that nobody told me
1. The brief is the product.
In baseball, a pitcher with great stuff but no command is a liability. The velocity means nothing if it doesn't find the zone. Vibe coding is the same. The raw power of the AI agent is impressive, but the prompt — the brief you give it — is the control mechanism. Vague briefs produce vague code. Specific, outcome-defined briefs produce specific, outcome-defined code.
Before every phase, I wrote what I wanted as if explaining it to a senior engineer joining the project mid-sprint: what the feature does, what it needs to connect to, what the edge cases are, what success looks like, and what should not change. That discipline — treating the brief as a first-class artifact — made the difference between sessions that produced shippable output and sessions that produced iterations.
This matters just as much if you're not a developer. You don't need to know how something is built to describe precisely what it should do and what failure looks like. That precision is the skill.
2. Scope creep kills agent sessions.
This is the practical version of point one. AI coding agents do not resist scope creep. They comply enthusiastically. If you ask for a payment integration and then start adding "while we're here" requests mid-session, you will end up with a payment integration and a dozen half-finished adjacent features, some of which interact in ways neither you nor the agent fully tracks.
Bounded phases work because they bound the blast radius. One phase, one outcome. Review, commit, move on.
3. You cannot delegate architectural judgment.
The agent will make choices about data models, API shape, and security patterns. Some of those choices will be fine. Some will be wrong for your system in ways that aren't visible until later. The only way to catch the wrong ones is to read the output with intent — not every line, but the structural decisions. How is state managed? Where does this data live? What happens if this fails?
I reviewed the credit deduction logic because race conditions in payment systems are the kind of bug that looks fine until it isn't. I read through what the agent produced, understood the atomic SQL pattern it had chosen (UPDATE users SET credits = credits - 1 WHERE id = $userId AND credits > 0 RETURNING credits), and confirmed it carried no advisory locks and no application-level mutex. The agent got it right. But I had to know what to look for, and I had to be the one asking.
If you're newer to building: you don't need to understand every line to develop this habit. Learn to ask the agent to explain what it produced, especially for anything touching money, user data, or access control. The explanation will tell you whether to trust it.
4. Security is your responsibility, not the agent's.
The GCM vulnerability caught in Phase 10 was real. The agent hadn't introduced it maliciously. It had written idiomatic Node.js code without specifying the authTagLength parameter — something most developers would never think to check. Static analysis found it. I understood its implications. The agent fixed it.
Security hardening across the stack — webhook idempotency, OAuth token encryption, PayPal IPN verification, reCAPTCHA, rate limiting, input sanitisation — none of this happened automatically. Each pattern was specified, reviewed, and in some cases corrected.
5. The agent is always in the session. You are the one who holds the thread.
The agent doesn't maintain context across sessions the way you do. You carry the mental model of the system. That means when you return to a codebase after a break, you need to re-orient the agent to the current state before asking it to change anything. I developed a habit of starting each session with a brief: "Here is where we are, here is what's live, here is what we're doing today." That thirty seconds of orientation saved hours of undoing.
The stack and why it is what it is
If you're not a developer, you can skip or skim this section — the takeaway is that every technology choice was made for a reason, not grabbed at random. The discipline of deliberate choices compounds over many agent sessions.
The TypeScript monorepo with pnpm workspaces meant that an API shape change failed at the compiler before it reached any environment. An OpenAPI 3 spec driving Orval codegen meant the frontend never manually wrote a single fetch call — the client hooks were generated automatically. These are the kinds of structural patterns that prevent the silent drift that accumulates across many agent sessions.
Wouter over React Router: 2KB versus 14KB, no History API dependency in proxied environments. Drizzle ORM over Prisma: the schema is TypeScript types, with raw SQL expressiveness available for the atomic credit deduction pattern. connect-pg-simple for sessions: no Redis dependency, one service to manage, indexed primary-key lookups that stay fast at scale.
For the AI layer, Anthropic Claude (claude-sonnet-4-5-20250929) handles story generation. The structured output quality for narrative generation is the best I've evaluated, and a 200-plus line system prompt that produces consistent, privacy-compliant, English-only story arcs requires a model that reliably follows complex, layered instructions. Together AI's FLUX.1-kontext-pro handles image generation and delivers manga-native panel quality. The kontext-conditioning API — image-to-image context anchoring — is the technical basis for the selfie protagonist feature.
The admin panel deserves mention because it's where I invested disproportionate attention. Twelve tabs covering analytics, user management, full generation history, waitlist, all settings, AI provider and model configuration (swappable at runtime without redeploy), editable prompts, gallery management, payment configuration, credit ledger, CMS-managed pages, and a support inbox with threaded conversation view. Why this level of tooling on a solo-built product? Because the ability to change AI models, swap payment providers, adjust prompts, and control feature visibility without a redeploy is how a solo operator runs at the iteration speed that makes vibe coding valuable in the first place. The product is the admin panel as much as it is the user-facing app.
The broader trend: what's actually happening here
The webtoon market sits at $10.85 billion in 2025, projected to reach $60 billion by 2031 at a 33% CAGR. LINE Webtoon alone has over 82 million monthly active users. The AI comic sub-market sits at $1.52 billion today, growing toward $2 billion next year. This isn't a niche.
But the more interesting trend is the one underneath all of it. The convergence of AI generation quality, AI coding capability, and cloud infrastructure has created a window where a single builder — with the right judgment, the right workflow, and the right AI stack — can ship a production-grade, full-stack, AI-native product that a team of five couldn't have shipped two years ago.
That window is real. It is not permanent. The companies that were slow to ship are catching up. The moats of the future will not be "we shipped first" but "we iterated fastest and understood our users best." Vibe coding, practised with discipline, is an iteration accelerant. That's what it is. Not a magic wand. An accelerant.
The developer community's instinct to be sceptical of hype is healthy. The instinct to dismiss the capability is not. And for people who came to building through AI tools rather than through traditional development — the discipline described in this post is the same discipline. You don't need a CS degree to develop judgment about what you're building and what could go wrong. You need curiosity, honesty about what you don't know, and the habit of slowing down at the decisions that compound.
The right frame for everyone is: this is a powerful tool that rewards clear thinking and punishes vague thinking. Learn to use it with the same seriousness you'd apply to any tool that can make you dramatically faster or dramatically slower depending on how you hold it.
What Memtoon is, right now
You can use it at memtoon.com. Every new user gets two free credits — enough to generate two full webtoons and experience the complete product before spending anything. After that, a 10-credit pack is $10. One credit, one webtoon.
The product supports Google Calendar and Microsoft Outlook for calendar reading. Generation runs server-side from calendar fetch to finished webtoon, meaning a dropped connection or closed browser doesn't interrupt your generation — you come back to find it done.
What's coming: Outlook integration to full feature parity with Google Calendar, regional payment methods including Toss Payments for the Korean market where webtoon culture originates and where Memtoon is registered under Movable Ads Korea Inc., and a tiered credit model that unlocks FLUX.1-kontext-max for higher-fidelity, larger-panel generation.
The go-to-market is organic. Every public webtoon is a distribution asset. The permanent shareable link renders the full webtoon for anyone — no account required to view. When a user shares their webtoon, every viewer sees a Memtoon-branded, publication-quality output and a direct path to create their own. The product sells itself through the output. No AI content tool can replicate the emotional resonance of your week rendered as art, because no generated story feels like your story.
What I'd tell you if you were about to start
Build the brief first. Scope each session before you open the agent. Read the structural decisions in the output — not every line, but the ones that matter: data, money, access. Take security seriously from the first commit, not the last. And build the admin tooling early — the ability to change your product without redeploying is not a luxury; in an AI-assisted context, it's the mechanism that makes fast iteration possible without accumulating invisible technical debt.
Vibe coding is real. The productivity gains are real. The risks of moving without judgment are also real. The builders who thrive with these tools — whether they started as engineers or started as non-technical people learning through building — will be the ones who bring more clarity to the work, not less. The agent will go wherever you point it, fast.
Point it somewhere worth going.
Top comments (0)