Your vibe-coded MVP isn't the problem. Your next 12 months are.

There's a new company shape in 2026: real revenue, real users, and a codebase no human fully understands. If that's you, you've probably absorbed some sneering about it. Ignore the sneering. You made a rational trade — you spent almost nothing to find out the only thing that matters, whether anyone wants the product. They do. Congratulations.

Now comes the part nobody's tweeting about: the four quarters after the vibe-coded MVP works.

The pattern we keep seeing

The same arc, at company after company:

Quarter one: euphoria. Features ship daily. AI tools scream along. The burn is tiny. Anyone suggesting caution sounds like a consultant inventing billable hours.

Quarter two: friction. New features start breaking old ones in surprising ways. The AI's fixes fix the symptom and quietly add another layer of coupling. Velocity is still okay — but "okay" used to be "astonishing."

Quarter three: fear. Now there's a customer list worth protecting. Somebody asks about your security posture — an enterprise prospect, an insurer, an investor. Nobody has a confident answer. Deploys start feeling like coin flips, so they happen less often, so each one is bigger and scarier. The doom loop engages.

Quarter four: the reckoning conversation. An engineer — new hire, contractor, friend — says "honestly, this needs a rewrite." And because nobody in the room can independently evaluate that claim, it lands as either doom or heresy, when it's actually just a claim, evaluable like any other.

The companies that stumble aren't the ones with the messiest code. They're the ones that hit quarter four with no one who can adjudicate that conversation.

What actually needs to happen (it's not a rewrite)

The boring, unglamorous truth is that the next twelve months are about converting a prototype into an operable system without stopping the feature engine. In rough priority order:

1. Security pass on the money and data paths. Not everything — the parts that handle payments, auth, and personal data. AI-generated code is confidently insecure in ways a focused human audit catches in days.
2. Tests around behavior you can't afford to lose. Not coverage theater. Checkout works, login works, the core loop works — encoded so a bad deploy announces itself before a customer does.
3. A deploy pipeline with an undo button. Half the quarter-three fear evaporates when shipping is reversible.
4. Monitoring that tells you before Twitter does.
5. One person who owns "no." Every codebase drifts toward entropy without someone empowered to say "we're not adding that dependency" and "this module gets untangled before it grows." That's a judgment role, not a headcount — it can be a fractional arrangement, a senior advisor, or your best engineer given explicit authority.

Notice what's not on the list: a rewrite, a migration to this year's framework, or a six-month feature freeze. Those are occasionally right. They are rarely right in year one, and they are never right as a reflex.

The uncomfortable question

Here's the one to sit with: if a serious engineer told you tomorrow that your codebase needs a rewrite, how would you know if they were right?

If the answer is "I couldn't," that's the actual gap — not the code. The code is a fixable artifact. The missing judgment layer is what turns fixable artifacts into existential dramas. Close that gap — however you close it — and the vibe-coded MVP becomes what it was always supposed to be: the cheap first draft of a real company.