A contractor who spent the year fixing “vibe coded” games for solo devs put together the pattern he sees on every single project. The game runs fine in the dev’s own playtesting — then real players get it and the same half-dozen issues surface immediately.

None of these are exotic. They’re basic production-readiness checks that AI-assisted developers (who often come from non-engineering backgrounds) simply never learned to look for.

The repeating issues:

  • Secrets in the client build — API keys and backend credentials sitting in the APK, pullable in five minutes.
  • No server-side validation — Score, currency, and inventory sent by the client are accepted blindly. Save-file editing or request manipulation breaks the economy.
  • No account isolation — Cloud saves and multiplayer don’t separate players. Changing an ID lets player A read or overwrite player B’s data (invisible in solo testing because there’s only one player).
  • No crash tracking in production — Players don’t email bug reports. They uninstall and leave a 1-star review. Basic crash logging takes 20 minutes and tells you exactly where people quit.
  • Untested backups — Everyone claims they have backups. Almost nobody has verified a restore.
  • IAP trusting the client — Purchase state and pricing validated client-side. First person with a proxy tool wrecks the economy in a day.

The AI-specific gotcha: the model quietly modifies systems you weren’t asking about while fixing something else. Movement code that was fine last night breaks because the model touched it as a side effect of a different change. The mitigation is trivial — keep one test scene you click through after any big AI-assisted change — but you need to know to look for it.

The comment thread adds useful context: professional game devs with a decade of experience make these same mistakes, especially the “client trusts itself” one. The real problem isn’t AI code quality — it’s the absence of a QA mindset and any production-security awareness.

The takeaway: none of this is a rewrite. It’s a couple days of boring work. Way better to eat it before launch than after the Discord blows up.