there’s no evidence “Tea” was vibecoded (especially because it was launched in early 2023, when tools like Cursor weren’t really widely used). All evidence seem

there’s no evidence “Tea” was vibecoded (especially because it was launched in early 2023, when tools like Cursor weren’t really widely used). All evidence seems to point to the usual issue 9 out of 10 startups face (and have always faced) - unprotected S3 buckets (this was Tea’s issue), misconfigured firebase or supabase RLS (I made some good money helping startups close these holes a few times) or unauthenticated APIs.