The Escape tech scan in October 2025 looked at 5,600 apps built with AI coding tools and found more than 400 exposed secrets: API keys, access tokens, credentials sitting in plain sight. Every one of those apps loaded, logged people in, and did what the prompt asked. The failure lived in the part nobody prompted for. That pattern has quietly become the pattern in outbound too.
The same build, the same blind spot
Describe a mailing app to an AI tool and by evening you have a dashboard, a sequence builder, a contact importer, and a warm-up tab. It looks like software. It demos well. You connect a domain, upload a list, hit start, and mail goes out.
What the prompt did not ask for is everything that happens after a mailbox provider decides it does not like you.
Deferrals have no obvious screen
A deferral is not a bounce. The message is not rejected, it is asked to come back later. Gmail and Microsoft both use deferrals to slow a sender down before escalating. A tool that treats a deferral as a failure, or ignores it, or retries immediately, is making the escalation worse. There is no dashboard tile that says the account is being throttled and here is what the system is doing about it. The builder never asked for that tile.
Sending rates differ by destination
You cannot send to a corporate gateway at the same pace you send to Gmail. You cannot treat Microsoft the same as a small regional provider. Ramp schedules, per-provider caps, and daily ceilings are things a deliverability engineer builds on purpose. They are also things that do not appear in a generated codebase unless someone asked, in detail, with numbers.
Some addresses were never people
Purchased lists, scraped lists, and stale lists all carry trap addresses, the ones that exist to catch senders who clean nothing. A trap hit tells the provider your list quality is poor. Verification before send, plus ongoing hygiene, is what keeps those addresses from receiving anything at all.
Complaint rate has a ceiling
Since February 2024, Gmail and Yahoo have required bulk senders to keep spam complaints under 0.3%. That number is a hard line. A tool that does not watch it in near real time will keep sending straight past it, and the first notification you get is a drop in deliverability. The original framing of this problem is worth reading in full here.
Where the cost lands
When a vibe-coded app leaks an API key, the person who built it pays. That is their incident and their invoice.
When an outbound tool gets sending wrong, you pay. Your domain lands in spam folders. Your sender reputation takes months to rebuild, and there is no shortcut back. The dashboard looks fine the entire time. Sends get logged, sequences keep running, and replies simply stop arriving. Most teams figure it out two weeks late, by noticing that nobody is answering.
What handling it properly looks like
The parts nobody prompts for are the parts that need to be handled deliberately, at the infrastructure layer, before the first campaign goes out.
Mailheight runs every account on a dedicated sending server we own and operate. That matters for one specific reason: you are not sharing IP reputation with a stranger who sent a bad campaign last Tuesday. Verification runs before send, so trap addresses and dead inboxes get filtered rather than mailed. Deliverability controls sit on the server side, which means deferrals, rate limits, and provider-specific pacing are handled by the system instead of by a sequence step someone forgot to configure.
Practically, that means the following are already covered before you upload a list:
- Mailbox providers and their individual pacing rules
- Deferral detection and backoff behaviour
- Verification and list hygiene ahead of the send
- Complaint monitoring against the 0.3% threshold
The question to ask about any outbound tool
Ask what happens when Gmail starts deferring your mail. If the answer is vague, the tool was built for the demo, not for the send. The 5,600 apps in that October scan all worked. They just worked in the way that leaves the failure sitting outside the frame, waiting for someone else to notice.