Blog
Seven million apps, zero audit trails
Vibe coding is the fastest software wave in history: millions of production apps built by people who have never heard of prompt injection. This isn't a complaint about the wave. It's a description of what the wave leaves behind.
July 17, 2026 · 4 min read
The fastest-growing software company of 2026 is a vibe-coding platform: describe the app you want, and agents build, deploy, and maintain it. Eight months in, its users, shopkeepers, solo founders, small businesses, have shipped over seven million applications, and by some estimates the majority of new applications this year were built by people with no prior coding experience. We think that's genuinely great. More people building software is a good thing, and this wave is not the problem.
The wave's exhaust is the problem.
What a vibe-coded app actually contains
A meaningful fraction of those millions of apps call LLM APIs at runtime: a support bot, a summarizer, a recommendation feature, wired up by an agent, running on a provider key. Now ask the questions a security review would ask, of a builder who has never needed to know the answers: Is customer data screened before it goes to the model? Is there a record of what was sent where? What happens when someone pastes a prompt injection into the contact form? Who rotates the key that's sitting in an environment variable?
The honest answer, at wave scale, is that nobody knows, because the people shipping these apps were never supposed to need to know. That was the entire promise of the platform. The engineering knowledge was abstracted away, and the governance knowledge went with it.
This is shadow AI at industrial scale
We've written before about shadow AI: the developer who points a script at a provider and creates AI activity nobody logged. That was a one-developer-at-a-time problem. Vibe coding industrializes it: every generated app is another ungoverned integration, produced faster than any review process could examine it, by builders who reasonably assume the platform handled "all that." Some platforms will handle some of it. None of them produce what a bank, an insurer, or an acquirer will eventually ask any real business for: evidence of what its AI actually did.
The governance layer has to meet the wave where it is
Here is the constraint the wave imposes: if governing an AI call requires knowing what PII screening is, it will not happen. The only governance that works at vibe-coding scale is governance that costs one decision, not a discipline. That is the design bet behind RemKey: one base URL, and every call through it is screened fail-closed, routed to the cheapest capable model, and signed onto a tamper-evident audit chain, whether or not the person who built the app has ever heard of any of those words. The builder's experience is unchanged. The evidence exists anyway.
We build for regulated financial services first, because that's where the evidence is legally required today and where the questions are sharpest. But the reason we're confident about the years after that is exactly this wave: seven million apps and counting, built by people who will never write a governance layer, all one growing incident away from being asked "can you show us what your AI did?" The companies that can answer will have decided early that proof should be a default, not a discipline.