I vibe-coded a travel app in a weekend, security scan found 8 critical flaws