I vibe-coded a tiny SaaS for about a month with basically zero software background. It works well enough that real users are poking at it, which is exactly when the fun left the room. a dev friend asked one question that ruined my evening. Can user A change an ID in a request and see user B's records. I had no answer. Claude generated a lot of the app and I nodded along becuase the UI looked right. Tenant isolation is not a UI feeling. It is route checks, database policy, ownership, and a...