Case Study: Building a CMS in 10 Days and Stuck for 2 Months

This case study analyzes a startup founder who successfully built a custom CMS using AI prompts in 10 days, only to spend the next 2 months trapped in a cycle of database lockups, security vulnerabilities, and file upload errors. While AI tools write excellent code blocks, they lack systemic architectural foresight. Spending dozens of hours debugging base infrastructure features represents a massive business opportunity cost that highlights the boundary of prompt-driven software engineering.

Background: The 10-Day Triumph

The subject of this study is a business founder launching an online education blog. To avoid licensing fees, the founder decides to write a custom PHP CMS from scratch using Claude and Cursor.

The initial phase was a success. By prompting the AI daily, the founder generated a database schema, user logins, an admin panel, and rich-text editor pages. By day 10, the application compiled perfectly on localhost, confirming the illusion of control described in why-non-techies-easily-fall-for-illusion-of-control-in-vibe-coding.

The Reality: 2 Months of Infrastructure Bottlenecks

The issues began immediately upon deployment to a public server:

1. The Media Pipeline Collapse (Week 2): Authors uploaded raw 5MB images. The AI-generated code did not compress uploads or generate thumbnails. The server disk filled up within a week, dropping page speeds. The founder spent 15 hours prompting AI to integrate image libraries and database adapters, losing business focus.
2. The Session Hijacking Vulnerability (Week 4): A basic security audit revealed that the session cookies were unencrypted and lacked HttpOnly flags. The founder spent 20 hours studying session security and prompting the AI to write custom session validation middleware.
3. The Database Transaction Conflict (Week 7): When two authors saved drafts simultaneously, the AI-generated code overwrote changes because it lacked database transaction control. Refactoring the database relationships took three weeks of back-and-forth prompting.

Cost Analysis: Custom Build vs. Opportunity Cost

Key Lessons & Decision Checklist

• Avoid Platform Reconstruction: Do not use prompt-driven AI to rebuild standard platforms from scratch if time-to-market is critical. Re-routing database tables and session cookies represents a massive opportunity cost.
• Modular Extensions Only: Invest in a stable ready-made CMS core, and use AI agents solely to write isolated custom features, as examined in case-study-using-existing-source-and-customizing-in-2-days.

Frequently Asked Questions (FAQs)

Why didn't the AI automatically include security and image compression?

AI generates code based on local context. If a prompt requests "an upload script," the AI provides a clean script that uploads files. It does not automatically assume the system requires image compression or session auditing unless specifically instructed.

How should a non-technical builder evaluate opportunity cost?

Value your time based on the revenue-generating tasks you could perform instead of debugging. Spending 100 hours fixing basic infrastructure issues is far more expensive than licensing a mature, standardized commercial engine.

Conclusion & Recommendation

[!NOTE] Buy stability, not code. This case study demonstrates that coding is not the bottleneck; maintenance is. Do not waste your valuable time trying to prompt your way to a custom infrastructure engine. Invest in a stable, ready-to-run software core, and leverage AI agents to customize branding and add extensions.