What were the critical flaws. And would you have not written them yourself?

This makes me think: apparently we can't just make agents write secure code, so there's a separate step to scan for vulnerabilities.

What else could be currently lumped into the "coding" task, done poorly and perhaps also requiring another step? Performance?

So you scanned it with your own vibe-coded security app?