Skip to content

Six areas I work in, each with an example from my work.

Free book · A story

What Vibe Coding Didn't Tell You

The story of Salma, who built a booking system with AI for a padel club in Riyadh before Ramadan. Each chapter brings a problem that happened to her, the idea that solves it, the request she wrote to the assistant, and how she checked that it works.

Eng. Ahmed Helmy

The assistant builds only what you ask for

33chapters
5parts
3hours of reading
العربية / English
Before you start

How to read this book

Read it in order as a story, or jump to the idea you need from the index of ideas. You can copy every request in the book as it is, then adapt it to your project.

Salma and the people around her are fictional. I built them from situations I saw with the people I worked with and the people who learned from me. The names of tools and platforms are real, and the technical facts are correct as of November 2026. Prices and numbers inside the story are examples, not client figures. What I tell in the “From my site” boxes really happened on my site, ahmedhelmy.me.

Prologue · One hour sold twice

The first Thursday night of Ramadan

Thursday, February 11 · 11:04 PM · Riyadh

Two groups stood on court 2 at Rally Padel Club. Eight players, eight rackets, and two phones held up in front of Nouf at the front desk.

Both phones showed the same message:

“Your booking is confirmed. Court 2. 11:00 PM.”

It was the first Thursday night of Ramadan, the start of the weekend in Riyadh. All three courts were booked until suhoor, the meal before dawn, and there was no spare court.

“We paid before the taraweeh prayers,” one of the players said. “And the message came from your system.”

Nouf looked at the bookings dashboard on her phone. Two names on one hour, both paid.

She offered the second group the 3 AM slot at no charge. The oldest of them thanked her, and they walked out to their cars.

Nouf wrote one line in the management group on WhatsApp, with screenshots of both phones:

“Two bookings on court 2, and both are paid.”

In Alexandria it was 10:04. Salma sat at her screen, her tea gone cold an hour ago.

A voice note arrived from Faisal, the club's owner. It was 14 seconds long.

She didn't need to hear it to the end.

The system she had been building since November had sold the same hour twice.

Court 2 with eight players on it, and two phones with the same booking confirmation for 11 PM. Padel court 2 from above with two groups of four players, beside two phones showing the same message: booking confirmed, court 2, 11:00 PM. One hour sold twice, because the assistant built only what was asked. Thursday · 11:04 PM One hour sold twice Court 2 Booking confirmed Court 2 11:00 PM Booking confirmed Court 2 11:00 PM The assistant built only what was asked
On the first Thursday night of Ramadan the same confirmation reached two groups for the same court, because nobody asked the system to stop that.

This book is about the 14 weeks before that night, and the weeks after it.

Salma is 26. She studied commerce and worked 3 years in customer service for a delivery app.

In the evenings she taught herself to build with a coding assistant. Before this project she had built landing pages for two friends, and charged neither of them a pound.

In November she signed the biggest contract she had ever seen: SAR 15,000 in three payments, for a booking system at a padel club in north Riyadh.

Faisal repeated one condition on every call. It had to work before Ramadan, because Ramadan nights are the busiest of his year.

She called me every Thursday evening for half an hour. After each call she sent me what she had understood, in two lines.

I didn't write one line of her project, or open one of its files. I asked, and she built.

The assistant built everything she asked for. This book is about everything she didn't ask for.

Each chapter has a problem she ran into, the name of the idea that solves it, and her request to the assistant. Then how she saw with her own eyes that it was done.

Each chapter also ends with a rule she added to her rules file. The file started with one line in November, and you will find all of it at the end of the book.

You won't need to write the code. You will need to know what to ask for, read what changed, and see with your own eyes that it works.

We start with the first call between her and Faisal, on the evening of Tuesday, November 3. Faisal asked for 11 things, and Salma said yes to all of them.

Chapter 1 · Planning first and the MVP

What Faisal will pay for first

Tuesday, November 3 · 8:30 PM · Alexandria

The first call started at 8:30 Alexandria time, 9:30 in Riyadh. Faisal Al-Dosari was in his car outside the club, with the sound of balls from the courts behind him.

“Salma, I have a list. Write this down.”

He dictated 11 requests in 7 minutes. An app on the App Store and Google Play, online booking and payment, monthly memberships, a schedule for the coaches, and tournaments.

Then a shop for rackets and balls, points for players, court ratings, a women's league, and a weekly report for Nouf. And, in his words, “something with AI, everyone asks about it.”

Then he said the line he would repeat on every call:

“Ramadan comes first. Last Ramadan we double-booked an hour, and I lost two longtime players.”

Salma said yes to every line.

At 10 PM she opened the coding assistant. She pasted the whole list into one long request that began like this:

“Build a complete booking system for a padel club in Riyadh with all these features, and start now.”

By 1 AM the folder held 40 files. She opened the first page in the browser, and it looked beautiful.

The page was all in English, for players who read Arabic. The time said 11:00 PM, on a 12-hour clock, and the big button said “Book now.”

Payment was by card only, Visa and Mastercard. And there was no booking without first creating an account with an email and a password.

Salma told me later that she thought of Abu Khaled at that moment. Faisal had mentioned him twice on the call.

He books every Thursday at 10 with a one-line WhatsApp message. He would never make a password account to book his usual hour.

Salma had made none of these four decisions. And nobody had asked her.

What actually happened

She called me on Wednesday morning, a day before our usual time. I asked her one question before we opened any file.

“Who is the first person who will pay, and what exactly will he do?”

“A player like Abu Khaled. He books the Thursday hour and pays.”

“How does he pay?”

“With mada, mostly. I didn't ask Faisal.”

By its own logic, the assistant made no mistake. It received 11 requests without one decision in them, so it decided.

It took what suits a website in America: a 12-hour clock, an English interface, and international cards instead of mada, the Saudi debit card. And an account before anything else.

The bigger problem was the list itself. Eleven things before Ramadan meant none of them would be ready before Ramadan.

And Faisal wasn't paying for the list. He was paying for a Thursday night in Ramadan with no hour sold twice.

The idea in plain words

When you ask the assistant to build without a plan, you hand it every decision you didn't write down. Programmers call the fix planning first. Claude Code has a mode made for it, called plan mode.

You press Shift+Tab until it shows. The assistant then reads, asks and suggests, and changes no file until you agree.

In Codex you ask for the plan outright, and tell it to change nothing before you approve.

Think of the contractor who finishes your apartment. You sit with him over the drawing before he breaks a wall. Otherwise he decides where every socket goes.

A good plan also starts small. The MVP, the minimum viable product, is the smallest version that someone uses and pays for. It is like a new juice shop that opens with six drinks it makes well, and adds a seventh when customers ask.

What has to happen before the first line:

  1. The assistant asks you about every decision it would make for you, one question at a time.
  2. You write the plan on one page: who uses the system, what they do on day one, and what you put off and why.
  3. The plan names the files that will change, and how each part will be tested.
  4. The MVP is small in features only. Payment and security in it are complete from day one.

When you don't need this: fixing a word, or changing the color of one button.

An iceberg with one request above the water and four decisions the assistant made under it, then the same scene after the planning page. An iceberg with Salma's long request above the water and four decisions the assistant made alone below it: a 12-hour clock, an English interface, card payment only and a required account. After the planning page the same decisions appear as Salma chose them. Wednesday 1:00 AM · 40 files Build the whole system, every feature Her request ?12-hour clock?English interface?Card payment only?Account requiredThe assistantdecided alone 24-hour clockArabic interfacePay with madaPhone number onlySalma decidedon one page Write the page before the first line
Every decision you leave off the planning page is made by the assistant without asking you, and you find it after it is built.

What Salma asked the assistant

That same evening Salma left the old folder as it was. She opened a new folder and turned on plan mode. Then she wrote:

The second line is my question to her, written for the assistant. Once it knows who will pay, it knows what to build first.

The third line turned the session into a conversation. Salma answered 26 questions in 50 minutes: a 24-hour clock, Arabic first, Riyadh time, and booking by phone number.

In the first draft of the plan, the assistant put a required account, with email and password, on day one. Salma wrote under it:

“The club's players book by phone number, from WhatsApp. The account can wait.”

The assistant moved it to the postponed list, and didn't argue.

The page came out with four things for day one. Booking one hour on a court, paying with mada, a confirmation message on WhatsApp, and a bookings list for Nouf on her phone.

The other seven went under “Later,” each with its reason.

At the 21st question, the assistant asked about two players who press the book button for the same hour at the same moment. Salma wrote: “We'll come back to this later.”

How to check it yourself

  1. Count the decisions written in the plan: the language, the time zone, the payment method, and whether an account is required. Every decision you can't find written down, the assistant will make for you.
  2. Read the section on what you postponed. If it is empty, the plan hasn't said no to anything yet.
  3. Write down the name of the first person who will pay, and what they will do, step by step. You should find every step in the plan.
  4. At the end of the planning session, ask the assistant for the list of files it changed. The right answer is none.

Before she went to sleep, Salma opened a text file on her laptop. She named it rules.txt and wrote the first line in it.

The ruleWrite the page before the first line

Salma sent the page to Faisal on Thursday morning. An hour later a 40-second voice note came back from him, with a question she couldn't answer.

“Where will the app live?”

Chapter 2 · Frontend, backend, database and JSON

Where the app lives

Thursday, November 5 · 4:10 PM · Alexandria

Three voice notes from Faisal arrived one after another. It was 5:10 in Riyadh, and he was in the club office, waiting for his partner.

Chapter 3 · Commits and Git

The demo that stopped in front of the partner

Thursday, November 5 · 9:05 PM · Riyadh

At 9:05 Riyadh time, Salma sent the link. It was a temporary link that opened the app straight from her laptop in Alexandria. The assistant had set it up for her in 20 minutes.

Chapter 4 · Lockfiles and isolated environments

The receipt prints the letters apart

Thursday, November 12 · 6:20 PM · Alexandria

Nouf tried the first booking from her phone at the front desk, at 7:20 in Riyadh. A PDF receipt reached her on WhatsApp within seconds.

Chapter 5 · Environment variables, secret keys and least privilege

The payment key in a screenshot

Thursday, November 12 · 11:48 PM · Alexandria

Two minutes after she sent the photo, Salma's phone rang. It was Omar Fathy, her friend since university, a developer at a payments company in Cairo. He didn't say hello.

Chapter 6 · CLAUDE.md and the assistant's memory

An assistant that forgets our decisions every morning

Saturday, November 14 · 10:15 AM · Alexandria

At the start of the session, the assistant asked her: “Where do you want me to put the payment settings?”

Chapter 7 · Data design and SQL

The court's name changed in a thousand bookings

Tuesday, December 1 · 9:20 PM · Alexandria

A 31-second voice note came from Nouf at 10:20 Riyadh time. She was going through the weekly report on her phone at the front desk.

Chapter 8 · Migrations and staging

Two databases that don't match

Thursday, December 10 · 10:04 PM · Riyadh

Abu Khaled opened the booking page to book next Thursday's hour, as he always did before playing. He got a blank page with one line in the middle: “Server error.”

Chapter 9 · Modularity and separation of concerns

Three prices for one booking

Thursday, December 17 · 10:40 PM · Riyadh

Three players from Reem Al-Harbi's league stood at Nouf's desk, each holding out her phone. They had booked court 1 at 11 PM, at the new peak price.

Chapter 10 · Transactions and money as integers

The money was taken, and the booking wasn't saved

Saturday, December 19 · 5:12 PM · Riyadh

Abu Khaled pressed the pay button to book Thursday, December 24, at 10 PM, for SAR 200 with mada. Seconds later his bank's message arrived: SAR 200.00 charged.

Chapter 11 · Webhooks and idempotency

Reem paid twice

Sunday, December 20 · 9:30 AM · Riyadh

Reem Al-Harbi attached two screenshots of bank messages to her line. A charge of SAR 200.00 at 11:02 PM on Saturday, then a second charge of SAR 200.00 at the same 11:02.

Chapter 12 · Timeouts and retries

The payment page spins without end

Thursday, December 24 · 9:04 PM · Riyadh

At 9:04 PM on Thursday, Nouf sent Salma a photo from her phone. The bookings dashboard she keeps open at the front desk was blank white, with a circle spinning at the top.

Chapter 13 · Domain, DNS and TLS

An address for the sticker before it goes to print

Tuesday, January 5 · 4:30 PM · Riyadh

On Tuesday morning the print shop sent Faisal three stickers, one for each court. In the middle of each one was a QR code, and under it a line in the club's font: “Book your court from your phone.”

Chapter 14 · Authentication, authorization and password hashes

The coach's account opens every booking

Wednesday, January 13 · 8:10 PM · Riyadh

On Wednesday evening, after the 8 o'clock session, Coach Mazen sent Salma a screenshot and one line: “This isn't my booking.”

Chapter 15 · Brute force and attempt limits

40 password reset emails

Sunday, January 17 · 5:40 AM · Riyadh

Faisal came out of the mosque after the dawn prayer and opened his email as he walked to the car. He found 40 emails with the same subject line, “Password reset request.”

Chapter 16 · Input validation and XSS

A fake review and a phone number in Arabic-Indic digits

Friday, January 22 · 11:20 PM · Riyadh

At 11:20 PM on Friday, a player stood at Nouf's desk with his phone in his hand. He asked her: “Do I have to type my card again to confirm the booking?”

Chapter 17 · CORS and CSRF

Nouf's dashboard on its own address

Tuesday, January 26 · 7:52 PM · Riyadh

At 7:52 PM on Tuesday, a message from an unknown number arrived in the club players' WhatsApp group: “A free hour for the first 50 players, book it here.” Under it was a link.

Chapter 18 · SSRF

The team logo that opened the server's door

Saturday, January 30 · 11:30 PM · Cairo

At 11:30 PM on Saturday, Omar sent Salma a file named logo.png, with one line under it: “Open it in a text editor.”

Chapter 19 · Testing, and end-to-end tests with Playwright

The suhoor hours became free

Monday, February 1 · 11:40 PM · Riyadh

At 11:40 PM on Monday, Nouf was going through the bookings for the first week of Ramadan. On the dashboard she saw a column of zeros, 37 bookings, all between 1 and 3 AM, and every one of them at SAR 0.

Chapter 20 · Staging and CI/CD

A manual deploy at 2 AM

Thursday, February 4 · 2:05 AM · Riyadh

At 2:05 AM on Thursday, Riyadh time, the last match of the night ended at the club, and Salma began the deploy. In Alexandria it was 1:05. In front of her was a sheet of paper on which she had written the deploy steps a month earlier.

Chapter 21 · Prompt injection, cost per conversation and personal data

A WhatsApp agent answers the players

Tuesday, February 9 · 11:40 PM · Riyadh

At 11:40 PM on Tuesday, Nouf sent Salma a picture of a chat from the club's WhatsApp number. It was the second night of the WhatsApp agent that Salma had built in 3 days, to answer the players in Nouf's place.

Chapter 22 · Race conditions

Two bookings for one court

Thursday, February 11 · 11:09 PM · Riyadh

At 11:09 PM, 5 minutes after Faisal's voice note, Nouf sent Salma two pictures. Both were confirmation messages for court 2 at 11 o'clock. The first was in Abu Khaled's name, and the second was for a player booking at the club for the first time.

Chapter 23 · Structured logs and error tracking

Logs that can't say who booked first

Saturday, February 13 · 1:40 PM · Alexandria

Four hours before iftar, Salma opened the server log for Thursday night. She wanted one answer before she spoke to Faisal: which of the two requests for court 2 had arrived first.

Chapter 24 · The N+1 problem and caching

The list of open courts after taraweeh

Tuesday, February 16 · 9:40 PM · Riyadh

The worshippers came out of taraweeh prayers in north Riyadh, and many of them opened one page on their phones: “Open tonight.” In half an hour the page was opened 2,000 times.

Chapter 25 · Pagination and indexes

Nouf's dashboard won't open on her phone

Thursday, February 18 · 10:55 PM · Riyadh

Abu Khaled reached the front desk 5 minutes before his slot, as he did every Thursday. He told Nouf: “11 o'clock, court 1, under my name.”

Chapter 26 · Rate limiting

The night-hour scalpers

Sunday, February 21 · 12:01 AM · Riyadh

The system opens bookings 7 days ahead, at midnight. At 12:01, Abu Khaled opened the app to book next Thursday's hour, as he did every week.

Chapter 27 · Background jobs and queues

The confirmation arrives 10 minutes late

Wednesday, February 24 · 11:20 PM · Riyadh

Abu Khaled booked Thursday's hour at 11:08 PM, and paid with mada. The circle spun on his screen for 8 seconds, then a message appeared: “Connection timed out.”

Chapter 28 · The circuit breaker and a unified interface

The night the WhatsApp provider went silent

Friday, March 5 · 10:15 PM · Riyadh

On the 27th night of Ramadan, all three courts were booked until suhoor, and the waiting list held 23 names. At 10:15 PM, the WhatsApp message provider stopped answering.

Chapter 29 · UTC and a second currency

An Alexandria branch, in pounds

Sunday, April 4 · 8:10 PM · Alexandria

At Hazem El-Shazly's club in Smouha, 10 minutes from Salma's home, the two courts had been ready for weeks before the opening. Hazem tried the system himself. He booked court 1 at 9 PM from his phone, and paid EGP 600 with Vodafone Cash from the test page.

Chapter 30 · NoSQL or tables

Tournaments that don't fit one table

Thursday, April 8 · 7:00 PM · Alexandria

Hazem put a sheet of paper on his desk at the club and wrote three names on it: Americano evenings, the team league and the kids' camp.

Chapter 31 · Skills

The same steps for every new club

Sunday, April 11 · 10:30 AM · Alexandria

Hazem called Salma at 10:30 AM. The site showed an hour on court 2 at EGP 60 instead of 600. Two players had booked at that price before anyone noticed.

Chapter 32 · MCP and the assistant's tools

The assistant sees what Salma sees

Thursday, April 15 · 9:00 PM · Alexandria

At 7 PM, Hazem sent an 11-second voice note: “How many hours did each court sell last week? And the day's weakest hour?”

Chapter 33 · Backup and restore

The backup we never tested

Tuesday, April 20 · 11:15 AM · Alexandria

Nine days before the opening, Salma wanted to clear the test data out of the system. There were made-up teams named Test 1 and Test 2, and bookings under her friends' names.

Epilogue · Opening night in Smouha

The end of the story

Thursday, April 29 · 7:30 PM · Alexandria

Hazem stuck a QR code sticker on the glass of court 1 in Smouha, like the ones printed for Rally Padel Club in January. At the front desk stood Yasser, with his new reception account, opening the bookings on his phone one page after another.

Appendix · The full CLAUDE.md file

The rules file Salma wrote

The file started as one line in a text file on Salma's laptop, the night she wrote her first plan. In chapter six it became a CLAUDE.md file that the assistant reads in every session. By the end of the season it had a line for each chapter, and each line came after a problem in the story.

Appendix · Index of ideas

If you are looking for one idea

Every idea in the book, by its name, with the chapter where it appears. When an entry lists more than one chapter, the first one explains the idea, and the others come back to it in a new situation.

Search every chapter
What idea are you looking for?Try: race condition · secret key · backup
What Vibe Coding Didn't Tell You · Ahmed Helmy↵ Start the story