I built a SaaS, set up payments, and didn't launch it.Because I wanted to sleep at night.

My writing tool was ready to sell. The server was running and the domain was set up, and colleagues could already work with me in shared projects. In the end I had even built in payments. All that was left was marketing, to find the first customers.

Then I pulled the handbrake and didn’t launch. To this day, I’m glad I made that call.

I have been designing and developing software for almost 30 years. When AI got good at writing code, I started building tools for my daily life and my projects, like a lot of people did. One of them I almost turned into a SaaS: software that people use in the browser, with their own account, and pay for.

The tool my friends wanted

It translated texts and helped you write and improve your own. I built a lot of my own way of writing into it, and a memory, so it remembered what you had worked on. Even the first version had several AI helpers, each with its own job: one looked closely at your writing style, another searched for repetition, contradictions and logical errors.

How it guided you through the work was brilliant, if I say so myself. When a few friends saw it, they wanted to use it too, and that is how it slowly turned into a product.

What I didn’t know about my own code

I knew how the tool felt to use, but I hadn’t read and understood all of its code, and I had no overview of it. I come from the visible side of software, the screens and buttons. My view of everything behind them, like servers, databases and security, was rather naive. I was the prompter: the human who told the AI what to build.

And while using it myself, I kept finding bugs.

When I pictured the launch, I saw a server on a hosting platform and the customer data at a database company, set up by AI and not by me. I had no idea how secure or insecure any of it was.

As long as nobody knows a thing exists, I thought, it’s fairly safe. But ads ask for attention. I would be pointing the giant evil eye from The Lord of the Rings straight at my own front door, and everyone who likes to break into things would look there too. I couldn’t have slept.

The bots don’t wait for your ads

While researching this post, I found out that a quiet launch wouldn’t have protected me either.

Every website with “https” has a certificate, a kind of ID card that browsers check. New certificates are listed in public logs that anyone can read, and attackers’ programs read them too. So the moment your site gets its certificate, the world can know it exists.

In a small 2018 experiment, researchers set up 11 new web addresses. One to three minutes after the certificates appeared in the logs, the first programs came asking about those addresses. One visitor then scanned their servers for open doors, “likely with malicious intent”, as the researchers wrote.

In 2021, a security team at Palo Alto Networks put 320 deliberately weak servers on the internet as bait. Attackers got into 80% of them within 24 hours, and into all of them within a week.

So programs will knock on your door within hours, without a single ad. I think ads and launch announcements add something else: curious people who look closely at your app in particular.

That is how one big problem was found: by a curious person. In March 2025, a researcher looked at one app made with an AI app builder, a service that builds an app for you from a description. Then he checked 1,645 apps from that builder’s public gallery. In about one in ten, parts of the database could be read from outside, and that was from their home pages alone.

When this was registered as an official security flaw, the app builder disputed it. Its reason, in the public record: each customer “accepts a responsibility over protecting the data of their application”. To me that shows who the platform expects to carry the blame when something goes wrong: you.

The responsibility is the same with 2 customers or 2,000

Building software got fast, but running it goes on. Someone has to keep it online and secure, make sure no data gets lost or stolen, and answer users when something doesn’t work. That is a huge responsibility, and it doesn’t get smaller because you only have two customers. Their data matters to them as much as anyone’s.

The law sees it that way. I live in Switzerland. Under Swiss data protection law, the person in charge must report a data breach “as quickly as possible” to the federal data protection office. That applies when the breach is likely to put people at high risk.

European law (the GDPR) asks for a report within 72 hours where possible, whenever the breach could put people at risk. Neither law makes an exception for small companies in this duty. If someone breaks in, you have to work out what happened and tell the authorities, and maybe write to every customer too.

And “passive income”, the dream of money that comes in while you sleep, isn’t passive. In 2001, the software researcher Robert L. Glass summed up studies going back to the 1970s: the work after launch makes up roughly half or more of a program’s lifetime cost. Much of that is new features. But even if you add none, the systems your software runs on get updates, new security holes are found, and something you never thought about breaks on a Sunday.

Some people do this well

Many people who build with AI know what they are doing: they read the code and test it. I don’t want to accuse anyone. I admire the founders who run their AI-built product safely, without incidents.

“I won’t commit any code to my repository if I couldn’t explain exactly what it does.”

Simon Willison, programmer and writer, March 2025

In plain words: he doesn’t add a line to his project that he couldn’t explain. He calls code that AI wrote and a person then reviewed, tested and understood simply “software development”.

There is also a name for the opposite: “vibe coding”. The AI researcher Andrej Karpathy coined it in February 2025. He described accepting all of the AI’s changes without reading them anymore, and wrote that this is “not too bad for throwaway weekend projects”. I’d draw the line well before anything that holds other people’s data.

In a small Stanford study with a 2022 AI model, people with an AI assistant wrote less secure code than people without one. They were also more likely to believe their code was secure. The people who trusted the AI less and thought harder about how they asked the AI wrote safer code.

In 2026, the security company Veracode tested AI models on security tasks, such as handling passwords safely. The models failed about 44% of them, almost as often as a year before. That test checked the AI on its own, with no human reviewing the code. The review is exactly the part the test left out, and I think it’s the part that matters most.

The questions I would ask you before launch day

On X (formerly Twitter), people proudly share what they built with AI. But I often read that many of these projects go online and then get little care.

So if you’re about to launch, here is what I would ask you:

• Can you explain what your code does, especially the parts that handle logins, payments and customer data?
• What happens the day after launch? A month after, a year?
• Who answers when a customer writes at 11 at night that their data is gone?
• If someone breaks in, how would you even notice?
• Do you want to look after this for years, or was it a one-off?

If you have good answers, launch, and I mean that. If you don’t, the tool isn’t wasted. You can keep using it yourself, or find someone who knows servers and security and can answer these questions with you.

I still use my writing tool now and then, only for myself. These days I look for projects that don’t need user accounts and don’t store people’s data. And I sleep fine.

Sources

• Andrej Karpathy, post on X about “vibe coding”, 2 February 2025
• Simon Willison, “Not all AI-assisted programming is vibe coding (but vibe coding rocks)”, simonwillison.net, 19 March 2025
• Neil Perry, Megha Srivastava, Deepak Kumar, Dan Boneh, “Do Users Write More Insecure Code with AI Assistants?”, ACM CCS 2023
• Veracode, 2026 GenAI Code Security Report, press release, 28 July 2026
• Quirin Scheitle and others, “The Rise of Certificate Transparency and Its Implications on the Internet Ecosystem”, ACM IMC 2018
• Unit 42 (Palo Alto Networks), “Exposed Services in Public Clouds”, November 2021
• Matt Palmer, “Statement on CVE-2025-48757”, May 2025, and the official CVE record
• Swiss Federal Act on Data Protection (FADP), Art. 24, in force since 1 September 2023
• General Data Protection Regulation (EU) 2016/679, Art. 33 and 34
• Robert L. Glass, “Frequently Forgotten Fundamental Facts about Software Engineering”, IEEE Software, 2001
• Jussi Koskinen, “Software Maintenance Costs”, University of Eastern Finland, 2015