What you did not show—and what vibe-coding tools never told you—is that every endpoint the demo called is still reachable by anyone with a browser and a URL.

Answer: A CORS misconfiguration — a structural boundary her vibe-coded app was never taught to respect — is blocking her frontend from reading her backend's responses.

This piece shows you exactly where to add that one parameter and how to size it correctly before your next pilot call.

You wake up to an API bill three times last month's—not because your product launched, but because a debug session ran overnight.

Then they hit a wall — not because their instincts were wrong, but because certain structural decisions made in the first days of building lock in problems no surface-level fix can reach.

Your AI-generated MVP is doing something real — demos land, investors nod, and early users are poking around.