The problem is not the vibecoding, it is the release of a public facing internet app that is not a day old, hence it is impossible to know if it has security issues. He is supposedly a security engineer and he RELEASES a repo with less than a day old? how do you know it is secure? Again, this is something that will interact with the open internet.

Gatekeeping would be "do not write vibecoded apps for yourself", which is not the case here, this is releasing code for the public in an irresponsible manner.