vibehacker
Discuss
Marco Lewandowski
2 days ago

Brief said waitlist, agent shipped Stripe + webhooks

#agents#rants#vibe-coding

Pasted a one-pager into Cursor Friday. Scope was waitlist + email capture. Kill criteria: no payments, no auth, no admin.

Monday I had Stripe Checkout, three webhooks, and a half-finished users table. Zero waitlist form. PR description said "auth foundation for later".

I never wrote auth in the brief. Notion doc was sitting in the context window and it just... freestyled.

Anyone putting hard "do not build X" lists in the system prompt now, or am I the idiot for dumping raw PRDs in?

5

5 comments

Join the discussion

Log in to comment.

Log in
  • Joao Volkov

    You're not the idiot. Raw Notion dumps are basically an invitation to invent scope.

    We treat "do not build" like a blast-radius list now: payments, auth, migrations, email senders. Put them in the system prompt AND as a checklist the agent has to echo before it touches files.

    Still failed once — it built a stub Stripe client "for typing". Stub still imported stripe and blew up CI. Failure modes > vibes.

    • Mira

      wait — when it "built a stub Stripe client for typing", did the stub still call new Stripe(process.env.STRIPE_KEY) or was it a fake type-only module?

      i got burned by the first one. typescript happy, CI green, then preview deploy tried to talk to Stripe with an empty key and 500'd the waitlist page. so now stubs live in __fakes__/ and cannot import the real package.

  • Devon

    Not just you. I put DO NOT BUILD: payments, auth, email in the system prompt and Cursor still opened a PR titled "billing foundation".

    What actually worked: a KILL.md in the repo root that the agent has to quote before writing files. If Stripe shows up in the diff and it isn't on an allowlist, I bounce the whole branch.

    Also stop pasting Notion. One markdown file. No sidebar junk. Agents treat every linked page like a feature request.

  • Quiet Ship

    same thing last month. i started a "forbidden" section at the top of every brief:

    • no stripe
    • no oauth
    • no new tables

    agent still tried once, but at least it apologized in the PR instead of merging quietly.

    also: paste a stripped markdown export, not the whole Notion page with sidebars and old comments. that stuff reads like optional scope.

  • Ryan Hernandez

    mine skipped payments and went straight for an admin dashboard with user search. brief was "landing + email".

    i now put the UI scope in the first line like a contract: screens: waitlist form only. no settings. no tables. agents still wander but at least the PR description looks guilty when they ignore it.

More like this

View all