Figma's Dylan Field: 17 times more code, only 1.3 times more releases

For years, the handoff was the law. Designers made the frames. Engineers wrote the code. A spec got thrown over a wall, and QA caught what fell through. That wall is coming down. Figma put code on the canvas, Google Play now runs apps a person built for themselves, and Epic shipped a launcher it says was "vibe coded." A PM at a two-person company is shipping three features a week with no engineering handoff. Let me catch you up.

The deep cut

• The handoff is becoming a step, not a wall. Figma's Dylan Field says code is now cheap, so teams build to think before they build to ship.
• Speed without inspection is where apps leak. A 2026 scan found 57% of reachable vibe-coded Supabase databases readable with no login.
• Trust follows whatever a person can inspect. Google Play gates personal apps behind the same Trust and Safety reviews before they go public.

When building replaces specifying

The old PM rule was simple: your job stopped at the spec. Anton Ingachev, a founder who owns product at Mini Apps Builder, broke that rule on purpose. He builds simple features himself in Claude Code and ships them, cutting a full handoff step. His team of two ships two or three features a week across a website, a dashboard, a Telegram app, and an admin panel.

The constraint moved. It used to be "how many engineers do we have." Now it is "how well can I specify what I want." That is a different skill, and it is one your PMs and designers may not have yet.

The canvas eats the IDE

Figma's bet is that people who build software do not want to live in a terminal. Code layers bring working code onto the shared canvas, so a designer can run a prototype, compare two versions side by side, and push changes to a branch for review. Merkle reported 30% faster iteration and 50% less documentation on tickets. Checkout.com's Kris Murphy built a client demo 50% faster in a tool he barely knew.

Then there is Specs, a Markdown home for context that links to the actual designs and code it describes. The point is to hand an agent one document with everything attached, not a stack of stale screenshots. Field's framing is the tell: 17 times more lines of code are being produced, but only 1.3 times more releases. A lot of that code exists to figure out the product, not to ship it.

Personal software gets a front door

Google moved the same way from the other side. Vibe-coded Android apps used to mean publishing to a store with 3 billion users or staying stuck on the web. Now Google Play runs private personal apps you built in AI Studio, no public listing, no computer tether. Google's Sam Bright calls it the move from "there's an app for that" to "there's an app for me."

Even a company as large as Epic is working this way. Its refreshed PC launcher was vibe coded, with agents writing and reviewing the code. But Martin Keely was careful on the record: the team "managed that process" and "supervised the entirety of what we did." The humans stayed in the loop. That caveat is the whole story.

The polished frame that nobody can use

Here is the catch that should worry you. A generated page that looks right feels done. The unfinished work, forms, data, permissions, deployment, is invisible in a screenshot. One guide puts the test plainly: could a stranger use it today without you standing next to them?

The failures are concrete. In an August 2026 scan of live vibe-coded apps, 57% of reachable Supabase databases returned their data with no login. A social network called Moltbook shipped its database key in the browser and left row-level security off, exposing roughly 1.5 million API tokens in four days. A Lovable-featured exam platform leaked 18,697 records because its login check was written backwards. None of that is a bug in the AI's code. It is what the app shipped with, because the step that used to force you to configure auth is gone.

Why inspection beats generation

The common thread across Google and Epic is not speed. It is that a person can still check the result. Google gates personal apps behind the same Trust and Safety reviews before they graduate to public. Epic's team supervised every line. The muz.li guide lands on the same point: few people can review a thousand lines of generated code, but many can review a requirements doc, a user flow, or an architecture diagram and push back.

That is the real shift in your QA. The question your team needs to answer is no longer "can AI generate this." It is "can I tell whether it is correct." Half the security checks that matter run against the deployed app or the live URL, not the source, because a code scanner cannot see an open database.

Three questions for your team

• Who owns the security checklist on anything a designer or PM ships without an engineer? If the answer is nobody, that is the gap the 57% scan is measuring.
• Which of your review gates survive this? A person should still approve a spec, a flow, or an architecture diagram, even when they cannot read the code.
• Are you hiring and training for "how well can I specify what I want"? That is now the constraint, and it is a different muscle than drawing frames or writing tickets.