The dangers of vibe coding a backup tool for your business

Week one: the cron job runs, the files land in the bucket, and Slack gets a green tick every morning. Week six: same green tick. Nobody opens the files, because why would you. Then someone deletes a ClickUp space by mistake, the team opens the bucket, and the "backups" turn out to be six weeks of empty API responses. The tool had been reporting success since the day the platform changed an endpoint.

That is a lightly anonymised version of a story a returning customer told us this summer. Over the past few months, several teams cancelled their ProBackup subscription with the same reason: "we vibe coded our own backup tool." One of them is now back.

We get the appeal. Prompt Lovable or Claude to "build a tool that backs up our ClickUp workspace every night" and twenty minutes later it works. The data lands in a bucket, the cron job runs, and the internal message writes itself: we just saved ourselves a SaaS subscription. But a backup tool is the one piece of software in your stack that only matters on its worst day, and a vibe-coded backup has usually never seen a worst day.

This post covers what vibe coding platforms do well, why backup is a special case, what a backup subscription actually buys, and an honest cost comparison between building and buying. The short answer to the question in the title: the danger isn't that AI writes bad code. It's that nobody ever tests the restore.

Vibe coding platforms are impressive, and getting better

Let's start with credit where it's due, because this isn't an "AI code bad" post.

Vibe coding, the practice of describing what you want in natural language and letting an AI agent write the software, has matured fast. Lovable's Agent can browse websites, search the web, and update code across multiple files at once, acting more like a developer working alongside you than an autocomplete. In May 2026 Lovable added AI subagents, including a Reviewer, that run in parallel during a build, and the platform now ships native Wiz security scanning, with findings surfacing in every project's Security view. In July 2026 Lovable became the first AI coding platform to achieve AIUC-1, a security and reliability standard built for AI agents.

That's real progress, and the productivity gains are real too. For internal dashboards, prototypes, landing pages, and your personal note-taking app, these tools are hard to beat. The question is not whether vibe coding works. It's whether a backup tool is the right thing to vibe code.

Why backup tools are a special case

A backup tool isn't a photocopier you run once. It's a system that has to notice and keep up with tens of millions of moving pieces every day, quietly, forever. That gives it an unusual property: it can fail silently for months and look completely healthy.

A healthy-looking backup and a complete backup are different things. The cron job running proves that the cron job ran. Real confidence comes from watching the data itself: noticing when a record type quietly stops flowing in, or suddenly doubles, or when a field that used to be populated is now blank across the board. That monitoring layer is invisible, boring, and almost never gets built in a weekend, which is exactly why DIY backups fail silently.

The scariest version of this risk is quiet deprecation. Platforms retire fields and endpoints with an announcement in an email nobody reads. The DIY tool keeps reporting success while a slice of your data stops arriving. You're sitting on an incomplete backup, and you'll find out on the one day it matters.

Scale does the same thing more slowly. A DIY backup that works on the demo workspace often collapses on the real one: API rate limits, accounts with hundreds of thousands of records, and the need to back up only what changed each night instead of everything. Getting that right is unglamorous engineering that never fits in a prompt.

Under the shared responsibility model (the standard SaaS arrangement where the vendor protects the platform and you are responsible for your own account data), that gap is yours to own. If your homegrown tool quietly broke, there is no vendor to call.

The risks, in the order they'll bite you

The research on AI-generated code is no longer anecdotal. Veracode's 2025 code security report found AI-assisted pull requests produced 2.74 times more security issues than human-written code; a 2026 GitGuardian report found AI-assisted commits leaked secrets such as API keys more than twice as often; a Cloud Security Alliance note from April 2026 found nearly one in five AI-generated code samples referenced a package that doesn't exist, names attackers now register in advance (a technique called slopsquatting); and Georgia Tech's Vibe Security Radar attributed 35 CVEs to AI coding tools in March 2026 alone. A backup tool holds admin-level API tokens for your most important systems, so every one of those findings lands harder here than it would on a landing page.

But the statistics aren't what kills homegrown backups. The stories are.

1. Nobody maintains it. Ask one question: which engineer's name is next to "owns the backup"? For vibe-coded tools the honest answer is usually nobody. The author changed roles, the codebase is a chat transcript, and the platforms it connects to keep moving.
2. The restore is never tested. Copying data out is the easy half. Putting it back, with hierarchy, relationships, comments, custom fields and permissions intact, is the hard half, and it's the half a weekend build almost never includes. A backup you can't restore from is a storage bill.
3. False confidence. The most dangerous property of vibe-coded software is that it looks finished. It demos well. The one scenario that would expose it, a real disaster, is the one you can't rehearse by accident.
4. The odds of needing it are going up. The same AI wave that produces vibe-coded tools is putting AI agents inside ClickUp, HubSpot and Notion, creating, editing and bulk-deleting at machine speed. Teams are being tempted to downgrade their backup at exactly the moment they're most likely to need it.
5. The watchman has no watchman. Your backup is the safety net under every other tool. If the safety net itself is the least-tested, least-owned, least-monitored piece of software in the company, you don't have a safety net. You have a feeling.

What a dedicated backup vendor actually does all day

ProBackup is a SaaS backup service that takes automated daily snapshots of your cloud app data and lets you restore individual records, files or whole projects back to the original account. That sentence hides a lot of work, so here is what the subscription pays for:

Continuous integration maintenance. We back up 20 platforms, and right now every one of them is rolling out features and API changes at the fastest pace we've seen. When ClickUp adds a new field type or HubSpot versions an endpoint, updating the integration is our job that week, not a ticket in your backlog competing with actual product work.

Security as a discipline, not a feature. SOC 2 Type II certified since May 2025, GDPR compliant, AES-256 encryption at rest, TLS in transit, least-privilege API scopes, and nine AWS storage regions you choose at signup. No hardcoded tokens in a script someone pasted from a chat window.

A restore that's been through real disasters. Our restore paths cover the scenarios that actually happen: single-record recovery, full-space recovery after a malicious deletion, and point-in-time recovery (restoring data exactly as it was on a chosen date) after a bad sync or an agent gone wrong. You choose whether to restore as new duplicate records, leaving the originals untouched, or to overwrite existing records field by field. These paths get exercised constantly. In the last 30 days alone, 36 different teams hit the restore button, 94 times between them. Those restores put roughly 64,000 records back where they belonged, each in the right order, with relations rebuilt. The disaster you're insuring against isn't rare; for someone, it's today. Your DIY restore gets its first production test during your emergency.

The humans behind the product. Even after nine years of engineering, roughly one in a hundred restore steps hits something specific to that account: a quirk of their setup that the API refuses. That's when our support team, which has guided hundreds of restores across 4,000+ teams, steps in and finishes the job. A vibe-coded tool's support team is a chat history and whoever prompted it, if they still work there.

The cost breakdown: from $25 a month vs building it yourself

Assume a realistic DIY scenario: one technically capable team member, a vibe coding platform subscription, and a sincere intent to keep the thing alive.

Price out the person's time at even a modest internal rate and the DIY option costs more in month one than ProBackup costs in year one.

But that isn't the number to remember. This is: one bad day costs more than a multi-year subscription. When a DIY restore fails, you pay for several people from several teams spending days on manual re-entry, plus the business standing still while they do it. That's thousands of dollars against roughly $300 to $830 a year. Framed as insurance, which is what a backup is, the "savings" of DIY round to zero.

What good looks like

If you take one section from this post, take this one.

1. Vibe code freely for tools where failure is cheap: internal dashboards, prototypes, automations, your own note-taking app.
2. For anything that protects business-critical data, buy from a vendor whose entire business depends on the restore working, or commit to building with real engineering rigour: code review, dependency scanning, secret management, data-level monitoring and scheduled restore drills.
3. Whatever you choose, test a restore this quarter. Not an export. A restore.
4. Put a named owner next to "owns the backup". Then audit which API tokens your homegrown scripts hold today, and what happens to them when that person leaves.
5. Date your assumptions. An integration that worked "as of March" is not an integration that works.

Conclusion

Would you vibe code your fire insurance? Nobody disputes that AI can build the thing. The question is whether you want to depend on it on the worst day of your company's year.

The tension we opened with is real: vibe coding platforms are excellent and improving monthly, and the case against using them for backup keeps getting stronger. Both are true because they answer different questions. Lovable answers "can I build this?" with an increasingly confident yes. A backup tool answers "will this work when everything else has gone wrong?", and that question is answered by maintenance, monitoring, security discipline and restores tested dozens of times a month, none of which fit in a prompt.

There's a simpler way to say what a backup subscription is. You're not buying software. You're buying someone whose entire business fails if your restore fails. No vibe-coded tool has anyone whose livelihood depends on it working.

Build your next internal tool with AI. We probably will too. Just don't let the tool that guards everything else be the one nobody is maintaining. [Start your free trial] or [see which plan fits your team].

This post is written for IT admins, ops leads, and founders who are responsible for their organisation's data in SaaS tools, and who have at least once been tempted to just build it themselves.