PreFlight catches security issues. This is where we explain them — the patterns we look for, the real-world incidents behind the threat-intel, and the architecture shapes that shape (or break) your security posture. Read once, build safer forever.
From the floor of vibe coding to the ceiling of agentic engineering.
In 2025, Andrej Karpathy coined "vibe coding," the practice of building software by prompting AI tools and iterating on feel. A year later, at Sequoia AI Ascent 2026, he retired the term. The successor he named is agentic engineering: you orchestrate agents, you act as oversight, and there is real art and science to doing it well.
The two are not rivals. They are floor and ceiling.
Vibe coding raised the floor so anyone can prototype. Agentic engineering preserves the ceiling so what gets shipped is secure, production-ready, and trustworthy. This map is the climb between them.
Every rung on this ladder is a rung of judgment, not typing. AI made producing code nearly free. It did nothing to make judging, verifying, and structuring it free. The single skill that scales at every level is verification: knowing when to trust the machine and when not to.
The climb is not optional the way it was. Here is what the field actually looks like right now:
That last one is the whole thesis in a single statistic. People who use AI think they are faster. They are not. They are slower and shipping more bugs. The only thing that closes the gap is verification skill. That is what this map teaches.
Do not read it top to bottom. Find where you actually are. Focus on the next rung. Each tier names its essence, what you can be trusted with, the wall that keeps people stuck, the leap to the next tier, resources (free where possible, cost noted when not), and a checkpoint for knowing you have actually crossed. Tiers track where you sit between the floor (anyone can prototype) and the ceiling (it ships safely to real users at scale).
Where you stand: Below the floor. Curious. Maybe already using ChatGPT casually.
Essence: Intent without verification.
Trusted with: Nothing yet, and that is correct.
The wall: Believing software is magic. Cannot tell "the AI did something" from "the AI did the right thing."
The leap: Reading what comes out. Running it deliberately. Recognizing that errors are information, not failure.
What you need to learn, the ground floor most curricula skip:
Within this tier there is a small sub-climb: from someone who has never touched ChatGPT to someone who uses it daily for ideas, drafts, and one-shot tasks but has not shipped an app yet. That is the prompt operator state, still pre-floor, but oriented.
Resources: CS50's first two weeks, free, gold standard, lectures only at this stage, do not grind problem sets yet. Codecademy's "Learn How to Code" path, free intro, low pressure. freeCodeCamp's responsive web design intro, free, hands-on, gentle.
Checkpoint: You have crossed L0 when you can open a terminal and type ls or dir without panic, read an error message and identify which file and line it points at, and articulate to yourself what code is, in plain words.
Time investment: 5 to 10 hours of focused exploration.
Don't fall here: The failure mode at L0 is skipping it to get to AI tools faster. People who skip L0 never recover their debugging ability later, because they do not have the mental model for what is happening underneath. Spend the 10 hours. Earn the floor.
Where you stand: On the floor. Karpathy's original vibe coding. This is where most modern builders enter.
Essence: Flow without a safety sense.
Trusted with: Your own projects. Low blast radius. Tools for yourself, personal prototypes, landing pages.
The wall: Cannot distinguish fragile-but-working from sound. Does not see security, edge cases, or how data moves through the app.
The leap: A safety sense. Version control. Reading code. Verifying AI output against intent.
You can prompt an AI tool and get something that looks like a working app. You ship MVPs. You feel the flow. You are in the right place, and you are one bad ship away from the story of someone shipping an Electronic Health Record system without knowing what HIPAA was. That is a real pattern, not a hypothetical.
What you need to learn:
PreFlight enters here. This is the tier where PreFlight becomes a daily tool. Scan your projects. See what is broken. Read the explanations. The findings are the curriculum at this tier. Each one is a rung-climbing moment.
Resources: The Missing Semester of Your CS Education, free MIT course on the tools (shell, git, debugging) no one teaches you. "Git: the simple guide," short, free, enough to get started. Vercel's deployment docs, free, ship something today. OWASP Top 10 (2025) overview, free, read once at a conceptual level.
Checkpoint: You have crossed L1 when you can ship a working app to the internet that does one thing well, read AI output and catch at least one thing that is wrong before you accept it, run your project through PreFlight and understand what the findings mean, and use git to recover from a mistake without panicking.
Time investment: 40 to 80 hours of building real things with AI assistance.
Don't fall here: L1 is real, and L1 is a hobby, not a career anymore. The field has moved on. If you want this to be how you make money, you have to keep climbing. The "shipped an app that lost a customer's data" stories all stop here. If your project will handle other people's data, money, or trust, do not ship it from L1.
Where you stand: Reaching off the floor toward the structural levels above it.
Essence: Verification becoming a habit.
Trusted with: Small-to-medium features under review. SaaS products, tools that handle other people's data, anything with auth, anything that processes money, with appropriate review.
The wall: Thinking AI tools handle the security and reliability layer. They do not.
The leap: Owning failure modes, not just happy paths.
You read and modify AI code with confidence. You decompose features into prompts and verify each piece. You use git, basic tests, a debugger. You know the common vulnerability classes by name and category.
What you need to learn:
PreFlight role at L2. PreFlight is now catching things you partially recognize. The findings should mostly make sense. When they do not, you research, learn, and move up. Auth-config probe, secrets in code, deserialization findings, these are the daily safety net.
Resources: The Pragmatic Programmer (Hunt & Thomas), paid, every chapter is a tier-climbing tool. OWASP Cheat Sheets, free, reference by topic. Web Security Academy by PortSwigger, free, hands-on, the OWASP Top 10 made tactile. The Twelve-Factor App, free, short, every word matters.
Checkpoint: You have crossed L2 when you can ship a SaaS feature with auth that you would let a friend pay to use, read a stack trace and identify the actual problem in under five minutes, explain why a specific PreFlight finding matters without looking it up, and recover from a deployed bug under pressure without breaking other things.
Time investment: 200 to 500 hours of shipping real things and dealing with real failures.
Don't fall here: The failure mode at L2 is overconfidence. You can ship things. You forget that "I can ship this" and "this should be shipped" are different sentences. Healthcare, finance, regulated domains, do not ship there from L2. Get to L3 first.
Where you stand: Standing on the structural levels. Where most working professionals sit.
Essence: Trusted unsupervised.
Trusted with: Whole features and services end to end. Real businesses. Most domains. The work clients pay four figures a day for.
The wall: Thinking in features instead of systems.
The leap: Boundaries, invariants, and what not to build.
You own whole features and services end to end. You design schemas and APIs. You threat-model. You manage dependencies and CI. You review AI output the way a senior reviews a fast junior. You direct agents with specs and acceptance criteria. You can be left alone with a problem. This is the first tier where the market reliably pays you for what you do. CS grads with degrees still tend to land here, just from a different on-ramp.
What you need to learn:
Resources: A Philosophy of Software Design (Ousterhout), paid, short, on complexity as the enemy. Designing Data-Intensive Applications (Kleppmann), paid, the database and systems book, read cover to cover at this tier. Software Engineering at Google, free, practices of engineering at scale. The Architecture of Open Source Applications, free, real systems explained by their builders. "Worse is Better" (Gabriel), free essay on simplicity as architecture.
Checkpoint: You have crossed L3 when you can be handed a problem you have never seen and design a system to solve it within a week, get paid to be trusted unsupervised, look at a codebase you did not write and propose three changes that would improve it with reasoning, and build something that survives contact with real users without you watching it every minute.
Time investment: 2,000 to 5,000 hours. This is where most "senior engineers" sit regardless of how they got there.
Don't fall here: The failure mode at L3 is thinking you have arrived because you can ship complex things. The next tier is about knowing what not to build. That is a different muscle.
Where you stand: Reaching toward the ceiling. The structural design tier.
Essence: Judgment as infrastructure.
Trusted with: Defining what "done and safe" means so people below can ship safely and fast.
The wall: Operating solo.
The leap: Force multiplied through other people building inside the constraints you designed.
You design systems, not features. You define the shapes, the boundaries, the invariants, the data model, the security architecture, the trade-offs. You orchestrate fleets of agents inside guardrails you built. Your multiplier is constraint design: you define what "done and safe" looks like so people below you can ship safely and fast. This is where agentic engineering, Karpathy's named successor to vibe coding, fully lives. Multi-agent stack orchestration (Cursor with Claude Code is the common professional stack as of 2026; LangGraph, AutoGen, CrewAI for the more ambitious work) is L4 territory.
What you need to learn:
Resources: The Mythical Man-Month (Brooks), paid, on coordination and complexity, written in 1975, still right. "No Silver Bullet" (Brooks), free essay, essential vs. accidental complexity. "The Cathedral and the Bazaar" (Raymond), free, open source as architecture. The Morning Paper, free, summarized CS papers, the canon made accessible. Hillel Wayne's writing, free, formal methods and engineering rigor. Will Larson's "Staff Engineer," paid, the L3-to-L4 transition mapped explicitly.
Checkpoint: You have crossed L4 when you can design a system other people can build inside without you in the room, make a constraint decision that others adopt because it makes their work better, teach someone something that becomes part of how they think, and recognize when a problem is one the canon already solved.
Time investment: Ongoing. This is a posture, not a destination.
Don't fall here: The failure mode at L4 is staying solo. If your constraint design never has other people building inside it, you are operationally still L3 doing L4-shaped work. Reach requires you to share, document, and accept that others will build inside your guardrails differently than you would.
Where you stand: At the ceiling. The people who design the platforms others build on.
Essence: Taste, depth, and judgment under uncertainty.
Trusted with: Direction. Patterns. The judgment calls that define what comes next.
The wall: None you are aware of. The next wall gets invented by whoever reaches it after you.
The leap: Not a leap. A posture you sustain.
You set direction. You invent patterns others adopt. You can parachute into any level and operate. You multiply everyone around you. You know the 60-year canon deeply enough to tell timeless from fashionable, and to know exactly what AI changed and what it did not. This tier is not about knowing more. It is about knowing what is worth knowing in any given moment.
Who lives here. Two distinct paths converge at L5.
Builders: Carmack, Torvalds, Knuth, Ritchie. The people who shipped the tools the rest of us build on. They design platforms, write the books, set the patterns.
Researchers: Karpathy, Hinton, Sutskever. The people who advance what is possible at the frontier. They write the papers, train the models, name the new things.
These are different careers with different skill stacks. Builders ship infrastructure. Researchers ship knowledge. Both belong at the ceiling. Do not confuse one path for the other when you choose which to walk.
Resources: L5 has no curriculum. The signal that you are climbing toward it is that you have stopped looking for one and started reading whatever you are curious about, in whatever order makes sense, while building whatever you cannot stop thinking about. The reading list at this level is the one you assemble for yourself based on the problems you are working on.
Timeless, true since the 1960s, AI does not touch it: decomposition, abstraction and information hiding, naming, data structures, invariants, testing and feedback loops, version control, programs are written for people to read, simplicity is a feature, security is not bolt-on, and you do not understand it until you can debug it and explain it.
What AI changed: the bottleneck moved from "can you write it" to "can you specify it, verify it, and own it." Generation is commodity. The scarce skills are decomposition, verification, architecture, and taste. The ladder is now steeper at the top and gentler at the bottom. The through-line at every rung is verification. That is the spine of the whole roadmap.
Where the field is going, regardless of where you personally stand on the ladder:
Manual Programming (human writes every instruction) to Assisted Programming (AI accelerates human coding) to Intent-Based Development (human describes systems) to Autonomous Engineering (AI agents implement, refactor, test, deploy) to Cognitive Architecture Design (humans design goals, constraints, evaluation systems, and world models while AI handles implementation).
We are currently somewhere between Assisted and Intent-Based, with leading-edge teams already operating in Autonomous Engineering territory. The climb up this ladder is not optional. The industry is moving up it whether individual practitioners do or not. PreFlight exists because the climb has security gaps the industry has not closed yet.
1990s: L3 in 10 to 20 years. Information was scarce. Tooling was primitive. AI did not exist.
2026: a motivated person can reach L2 in months, L3 in 1 to 2 years, L4 in 3 to 5 years. The condition: build continuously, use AI correctly, study systems deeply, avoid tutorial addiction.
The ladder compressed because the floor rose. Climbing past the floor still takes work.
Three things matter more than any specific resource or tier.
Ship things. The map is a guide to what to learn next. You learn by building, not by reading. If you are between tiers, you are shipping things slightly above your current safety. That is the climb.
Community is the accelerant. The fastest climbers are not the ones with the best reading list. They are the ones in a room with people one rung above them, shipping in public, getting told the truth about their code. Find that room. Be useful in it. Do not be a leech.
Free rooms worth being in:
Honesty. Self-assess without flinching. Over-claiming costs you trust. Under-claiming costs you opportunities. Knowing the difference and naming it accurately is itself part of the climb.
Built by Johnathan Scott Viruet. I am somewhere between L3 and L4, climbing without a CS degree, shipping production AI systems mostly solo. This map is the one I wish I had had. PreFlight is the tool I built for the L1 to L2 transition, because that is where I watched the most people fall. The rest of this map is what I am building toward: PreFlight Learn as the climbing infrastructure for vibe coders becoming engineers.
Find me: midatlantic.ai · preflight.midatlantic.ai · Vibe Coding is Life on Facebook