The 'Scorched Earth' of SaaS: Vibe Coding Is Flooding the Market With Apps — And Most of Them Are Terrible

Hagen Hübel, a developer with 30 years under his belt, published an essay in January that put a name to something a lot of us were already feeling. He called it the "Scorched Earth" of SaaS. The thesis: AI-generated apps are flooding the market so fast, and so badly, that they're burning customer trust before quality products even get a chance.

He's right. But the essay, and most of the commentary it spawned, missed the punchline. The scorched-earth problem isn't an argument against tools that let non-developers build software. It's the strongest argument *for* structured no-code platforms that anyone has made in 2026.

TL;DR: Vibe coding is producing a flood of insecure, unmaintainable, and abandoned apps, draining budgets and destroying trust in new software. Structured no-code platforms (Bubble, Webflow, Stacker, Glide) solve every single problem on the scorched-earth checklist. The "no-code is dead" narrative has it exactly backwards.

The graveyard is real, and it's growing

The data is not subtle.

An MIT study of 100,000 developers found that AI coding agents boosted code output by 180% but only increased shipped software by 30%. That gap between generating code and actually delivering working, production-grade applications is where the bodies are buried.

Taskade published a "vibe coding graveyard" in April cataloguing 14 AI app builders that launched with hype and died within 18 months. Three failure patterns keep repeating: Feature Wrappers (thin UI on someone else's API), Single-Purpose Plays (no moat), and Hype-Led Architecture (built for demos, not production). Y Combinator's W25 batch was 40% AI coding startups. Half of them are already gone.

The security picture is worse. Veracode found that 45% of AI-generated code introduces OWASP Top 10 vulnerabilities. That number hasn't improved across testing cycles from 2025 through 2026. WIRED investigated 5,000+ vibe-coded apps and found that roughly 40% exposed sensitive data: medical records, financial information, corporate documents, all sitting on the open web. Georgia Tech's Vibe Security Radar tracked 35 CVEs in a single month directly attributable to AI coding tools.

And on Reddit, the r/SaaS and r/vibecoding communities have turned into support groups. "SAAS is now ultra saturated, due to vibe coding," reads one post. "Either poorly coded, or abandoned within weeks." Another: "Is SaaS still a viable starting point in 2026, or has vibe coding killed it?"

Hübel's "Market for Lemons" is not a metaphor. It's happening.

Why "no-code is dead" gets it exactly backwards

Some people look at this data and say: see? Building software without knowing how to code is a disaster. No-code is dead.

That argument confuses two things that have almost nothing in common.

Vibe coding means asking an LLM to generate raw code, which you then deploy. You don't understand it. You can't verify it. You can't maintain it. The AI might have left an API key exposed in client-side JavaScript. It might have skipped authentication on an admin endpoint. It might have written a database query that works for 10 rows and collapses at 10,000.

Structured no-code is the opposite. You build visually, on a platform that has already solved authentication, permissions, database scaling, and deployment. The platform doesn't generate code you can't read. It gives you a visual representation of your app's logic that you can inspect, test, and verify. When something breaks, you can see why.

Let me map this point by point.

Security: Platforms ship with guardrails; vibe coding ships with hope

The WIRED investigation found vibe-coded apps with no authentication, exposed API keys in browser-side code, and patient data stored in local storage with no encryption. These aren't edge cases. They're the default output of an AI model that was asked to "build a scheduling app" and was never told to secure it.

Bubble handles authentication at the platform level. You toggle it on, and every data request goes through a permissions check the platform enforces, not something the AI remembered (or forgot) to write. Stacker takes this further: it's built on a governance-first model where permissions, roles, and data isolation are foundational, not afterthoughts. You don't configure auth. It's the water you swim in.

When OWASP says 45% of AI-generated code has vulnerabilities, what they're actually saying is that structured platforms eliminate that entire category of risk. The platform owns the security surface. You own the business logic.

Determinism: What you build is what you get, every time

One of the most surreal things about vibe coding is non-determinism. Ask the same prompt twice, get two different codebases. Deploy an update, and the AI silently changes behaviour in a module you thought was finished.

Structured no-code platforms don't hallucinate. A workflow in Make or a database view in Stacker runs the same way every time. If you change one thing, that's the only thing that changes. This sounds boring. It is. Boring is what you want when you're building software people depend on.

Maintenance: You can actually understand what you built

The Shipsquad.ai analysis of 1,247 vibe-coded projects found that only 3.4% were still active a year later. The most common cause of death? Not scaling failures. Maintenance collapse. The original builder couldn't understand their own code three months later. When they asked the AI to add a feature, it broke five other things.

In a structured no-code platform, the interface *is* the documentation. You can look at a workflow or a permissions table and understand what it does without reverse-engineering generated code. You can hand it to someone else and they'll understand it too. That's not a nice-to-have. It's the difference between software that dies in six months and software that lasts.

The Stacker case: Governance as a feature

Stacker is the clearest example of this philosophy in action. The platform is built on the assumption that serious software needs serious permissions. Every data request is mediated. Every user sees only what they're supposed to see. You don't configure RBAC as an afterthought; the entire platform is RBAC.

It also gives you something vibe coding never will: a client portal with baked-in authentication and role-based access. Building that from scratch with AI-generated code is a security minefield. On Stacker, it's a configuration setting.

This is the pattern. Structured platforms don't compete with vibe coding on speed-to-prototype. (Vibe coding wins that race every time.) They win on what happens after the prototype. When real users show up. When real data enters the system. When someone asks "is this compliant?"

The market is sorting itself

The scorched-earth period doesn't end with "no-code is dead." It ends with a market split.

On one side: the vibe-coded slop. Cheap to generate, impossible to maintain, and increasingly radioactive to customers who've been burned before. The churn on these apps will accelerate as the graveyard grows.

On the other: structured platforms that give you visual verification, deterministic behaviour, platform-level security, and maintained infrastructure. They cost more upfront. They take longer to build. And they actually work.

Hübel's essay argued that 2026 is the "Year of the Veteran," a return to deep engineering experience as the competitive advantage. I think he's half right. The veteran advantage isn't knowing how to write code. It's knowing how to build systems that don't collapse. And the fastest way to do that in 2026 isn't writing code at all. It's picking a platform that already solved the hard problems.

The takeaway

If you're building an internal tool, a client portal, or any piece of software where data integrity and security actually matter, structured no-code is not the compromise option. It's the smart one. Vibe coding gives you a demo in an afternoon. Structured no-code gives you software that's still running in two years.

In a market being burned to the ground by AI-generated junk, the platforms that ship with guardrails, governance, and determinism baked in stop looking boring. They start looking like the only sensible way to build.