Vibe-coding lets you build applications at unprecedented speed. But speed without structure can lead to fragile architectures. Nobody vibe-codes a video transcoder from scratch. You call FFmpeg, a project started by Fabrice Bellard in 2000 that has absorbed a quarter-century of codec quirks and hardware decoders.
Likewise, in this article, I want to share 5 common scenarios for vibe-coding apps where you should consider using a foundational software library or off-the-shelf component.
The good news is that you don’t need to be an expert in these systems to get started building durable software. This is where Agent Skills enter the picture.
Think of skills as an integration companion to vibe coding. When you equip an agent with curated skill packages, such as the open-source Google Agent Skills repository or dedicated partner skills, you give your model the knowledge and recipes to guide your agent effectively.
https://medium.com/media/79f89bc3e6950148b1c0e3bb430d132d/href
Authentication
Ask an agent for user authentication, and it might give you a login form. But how do you know this is secure and will handle all of the edge cases?
For instance, in my article on building a secure shopping cart with Firebase, I covered a scenario of progressive authentication where users start as a guest and then upgrade to a logged in user. When they do so, all of the items in their cart need to be maintained seamlessly.
With Firebase Authentication, you can provide path-based scoping to resources with anonymous authentication to give first-time visitors a persistent identity immediately. When the visitor eventually signs in with an identity provider, attaching their permanent account to that same anonymous ID keeps their cart in place with zero data migration.
Skills like firebase-auth-basics, firebase-basics, and firebase-firestore close the implementation gap here. Left alone, an agent often writes permissive database rules that grant any signed-in user access to everyone else’s data. Guided by these skills, the agent writes strict security rules that enforce path ownership and constrain writable document fields, preventing a modified client from tampering with prices while leaving product catalog costs untouched.
Payments
The Payment Card Industry Data Security Standard, or PCI DSS, exists because handling financial credentials safely is extraordinarily difficult. Direct card handling can bring your app under PCI DSS audit scope, creating severe compliance and security liabilities. Instead of writing payment logic, integrate an established payment provider like Stripe, Paddle, or Lemon Squeezy.
Also, left to its own devices, a vibe-coded app could accept item prices directly from the client request payload. A customer could open browser developer tools, edit the price, and complete the order.
An alternative architecture might be for the browser to send only a request to check out a specific cart. A backend service verifies identity, looks up current catalog prices directly from the database, and creates the checkout session directly with the payment provider.
Running npx skills find stripe surfaces dedicated integration skills like stripe-best-practices. On the infrastructure side, skills like cloud-run-basics and google-cloud-waf-security guide your agent to scaffold a stateless backend on Cloud Run and configure Google Cloud Well-Architected Framework (WAF) security controls to protect the fulfillment logic.
Dates and time zones
When you vibe-code date math, your model might implement a naive algorithm, such as adding 86,400 seconds to calculate tomorrow. On days when clocks shift for DST transitions, that calculation is off by an hour, causing subtle scheduling bugs. Time zones introduce further complexity, as regional offsets and daylight savings rules frequently change.
Remember two foundational architectural rules for date handling:
- Store historical data and transaction logs as UTC timestamps (using ISO 8601 strings or Unix epoch integers). For future appointments, store the local time paired with the IANA time zone identifier (e.g., America/New_York) so that future changes to time zone or DST rules don't shift scheduled events.
- Translate to local time zones only at presentation boundaries using the client locale.
Never hand-roll date calculations. In JavaScript and TypeScript, rely on libraries like date-fns-tz or Luxon, or use the modern Temporal API where available. In Python, use the standard library's zoneinfo module paired with UTC timestamps.
Skills like retrieving-developer-knowledge steer agents toward verified runtime documentation, ensuring your model selects current timezone-aware patterns instead of hallucinating outdated date arithmetic.
Cryptography and secrets
Modern cryptography libraries like libsodium or OpenSSL are built around defensive patterns such as constant-time comparisons to guard against timing attacks. While AI agents are fully capable of generating secure code, without clear guidance they tend to focus on immediate functional requirements. This means an unguided agent might fall back on insecure defaults like AES in Electronic Codebook (ECB) mode or rely on simple SHA-256 for password hashing instead of using robust, dedicated security patterns.
Similarly, when managing secrets for external API calls, an unguided agent prioritizes getting the code running quickly. Left without clear secret management patterns, it may place API keys directly into source code or frontend environment files that get bundled into client distributions.
Providing your agent with structured security frameworks ensures it consistently applies best practices. Grounding its instructions in tools like Google Cloud Secret Manager or Cloud Key Management Service (KMS) allows the agent to build architectures where backend containers retrieve credentials securely into memory at runtime using identity-based access.
Equipping agents with skills like google-cloud-waf-security and iam-helper-for-privileged-access-management enables them to systematically configure least-privilege service accounts. Guided by these tools, the agent reliably generates precise configurations that restrict secret accessor roles strictly to the services that require them.
Task scheduling and retries
Need to send confirmation emails or process background data? Agents might initially suggest using simple in-memory timers. While this works in a local environment, it fails in production.
In serverless environments like Cloud Run, CPU is throttled to near-zero as soon as the HTTP response finishes (and idle instances can be terminated at any time). Any uncompleted background process or in-memory timer will freeze or be lost.
Similarly, agents might try to write their own ‘retry’ loops. While this seems helpful, it can accidentally crash your system. If a downstream service is struggling, a simple loop that retries immediately without ‘backoff’ (waiting between attempts) creates a stampede of traffic, making the outage worse. Libraries like tenacity have time-tested patterns for exponential backoff and jitter to address these issues.
Your use case might require even more than retries. You can offload background work to reliable queue systems like Google Cloud Tasks or Pub/Sub. These tools handle the heavy lifting: they manage retries, enforce rate limits, and safely move failed jobs to a ‘dead-letter queue’ for you to review later.
You can keep your agent on the right track by using specialized skills. Pairing cloud-run-basics with google-cloud-waf-reliability provides your agent with the Google Cloud Well-Architected Framework (WAF) blueprints. These guide the agent to separate background work from your main application traffic, ensuring your setup is resilient and production-ready.
Using agent skills
Whether you pull from Google Skills for cloud infrastructure or partner registries for services like Stripe, skills turn your coding agent into an informed integration assistant.
Discovery tools like finding-google-skills even allow agents to search for and activate relevant skills dynamically as requirements change.
Vibe code your application layouts, user journeys, and feature prototypes. For the foundation, let battle-tested services and agent skills do the heavy lifting.
What libraries and infrastructure do you depend on for your vibe-coded apps? Tell me on X, LinkedIn, and Bluesky.
5 things you shouldn’t vibe code (and what to use instead) was originally published in Google Cloud – Community on Medium, where people are continuing the conversation by highlighting and responding to this story.
Source Credit: https://medium.com/google-cloud/5-things-you-shouldnt-vibe-code-and-what-to-use-instead-330c875ccb83?source=rss—-e52cf94d98af—4
About the Author
