For about six years, the best career advice in software was “Just build things”. Skip the credential, skip the theory, ship something real and public, and the job follows. It got repeated often enough that it stopped sounding like advice and started sounding like a description of how the industry worked.
It was also, for most of that time, true.
The pitch
Software was the one well-paid technical career with no major gate on it. You could enter from a bootcamp, from an unrelated career, from nothing but a laptop and a year of evenings. The portfolio was the credential. The deployed project was the proof.
And people did it. Large numbers of them, including people for whom no other door to that income existed. The anti-credential half of the argument was correct, too, which is the part critics skip: a computer science degree never guaranteed competence either. The pitch was reacting to something real, an industry gatekeeping on a proxy that did not predict much, and “show me what you built” was an improvement on it.
So the pitch was not a con. It was probably the widest door into well-paid technical work open in that decade, and the people who walked through it earned what they got.
What it was not was permanent.
The reality
What follows is my take, built out of what I have run into rather than out of any study. Fifteen or so engineers over five years, interviewed or worked alongside. Not a sample. Just what I saw, and why I think it happened.
What I keep running into.
Three of them, and none are the things people usually reach for when they complain about juniors.
The ORM with nothing underneath it.
The fair thing first: using an ORM is not a failure. That is what it is for, and people who insist on hand-writing every query are usually selling something.
The failure is not knowing what comes out the other side. I have worked with engineers who could not tell me what SQL a queryset produced and, more to the point, could not tell me what it would cost against two million rows instead of two hundred. Showing them the generated query moves the gap rather than closing it, because reading it requires knowing what an index actually does, and why a join on an unindexed column is a different animal from a join on a primary key.
The consequence is specific. You go blind to performance. Not bad at it. Blind to it. Every query looks the same from where you are standing, so you cannot tell the page that is fine from the page that is one traffic spike from falling over, and you find out which is which when the spike arrives.
The page that was hidden and therefore secure.
I have met engineers who believed that removing a link from the navigation, or conditionally hiding a button, prevented unauthorized access. The reasoning is internally consistent. The user cannot see it, so the user cannot reach it.
An attacker never touches your interface. They open the network tab, watch what your own frontend sends, learn the shape of your API in about twenty minutes, and make the requests directly. Your navigation is not part of that conversation. The failure is not a missing fact about authorization headers. It is a mental model in which the UI is the system rather than one client of it.
The disabled CORS.
This is the one I keep returning to, because it is not a gap in what tutorials teach. It is what tutorials teach.
Follow almost any “build your first API” walkthrough and you reach the point where the browser refuses the request, and the walkthrough tells you to allow all origins. It has to. Explaining the same-origin policy properly costs a page and a half and loses half the readers. So the instruction sits there unexplained, and it works, and everyone moves on.
I have worked with engineers who carried that line into production without ever learning what it did. Not people who weighed a risk and accepted it. People who did not know a policy existed, because the only context in which they had ever met it was as an obstacle that a copied line removed.
I have also met engineers who could not describe what happens between a browser and a server when a page loads, and one who had never used version control. I am not making scenes out of those. Past a point I am just listing things people did not know, and that is a meaner article than this one.
What all three have in common.
They worked.
CORS wide open, the page loads. The ORM query with no index behind it, the feature ships and the tests pass. The admin route hidden from the nav, the demo looks locked. Nobody got caught, because in every case the thing they built did what it was supposed to do.
That is the whole argument, so let me put it flatly: “it works” was accepted as proof of competence.
For a long time that was defensible. If you got a functioning application in front of a user, you had absorbed a great deal on the way, because the path was strewn with things that would stop you. The artifact was expensive, so the artifact was evidence. The industry did not skip fundamentals out of laziness or greed. It substituted the artifact for the understanding, because the artifact was the cheapest reliable proxy anyone had.
There was nothing else to fall back on. Software has no licensing board, no accredited entry path, no articling period, no bar exam. When hiring volume grew faster than any shared idea of what a junior ought to know, the bar defaulted to the only thing every interviewer could evaluate: does the thing run.
Compare that to the careers software was outpaying. A civil engineer who has never poured concrete still understands loads and material limits well enough to take direction from a senior, and to notice when an instruction sounds wrong. A newly qualified lawyer who has never argued a case can still read one. Those professions gate on fundamentals before experience, deliberately, because experience takes years and fundamentals can be verified on a Tuesday. Software gated on the artifact instead, and paid more for it.
Where I sat in this.
I invested in fundamentals early, and that is most of why I stood out rather than anything more flattering. I also got paid off the same mispricing. My salary was above what a newly qualified lawyer in my country earned, and not because I was worth more than them. Saying the bar was too low means saying I was overpaid relative to my peers in other fields, and I was.
What I got wrong.
I assumed this was a bootcamp problem, and held that view confidently for years before the evidence stacked up against me. Two of the three engineers in those scenes had computer science degrees. The gap does not track which door someone came through. It tracks whether they went looking for the why while they were inside, and both doors will hand you a working result and let you leave without asking how it got there.
What actually changed.
Two things happened closely enough together that most takes collapse them into one.
The first is unglamorous. Companies overhired through the pandemic, then stopped, and a large pool of experienced engineers came loose at the same moment. SignalFire’s 2026 talent report puts new-graduate hiring down 65 percent at the largest tech companies and 76 percent at early-stage startups against a 2019 baseline, and reads it as a structural reset rather than a dip. Selectivity by itself raises a bar. No technology story is required for that part.
The second is the interesting half. Agents started producing “it works” for free.
The signal did not get easier to fake. It stopped being a signal. If an agent can produce a functioning CRUD feature in an afternoon, a functioning CRUD feature says nothing about the person who submitted it. The proxy the entire entry-level pipeline rested on evaporated, and what is left underneath is the thing the tutorial path never charged anyone for: knowing why it works, and being able to tell when it does not.
That cost shows up in aggregate now. Stack Overflow’s 2025 survey of more than 49,000 developers has adoption at 80 percent while trust in accuracy fell from 40 to 29 percent, with 45 percent naming “almost right, but not quite” as their leading frustration. Generation got cheap. Verification did not, and verification is fundamentals wearing a different hat.
I am not claiming AI caused this. It landed on a market that was already correcting, and its contribution was narrower: it made the missing understanding impossible to hide. Addy Osmani describes entry-level engineers “skipping the hard way,” never building the thing from scratch, never debugging the memory leak alone. And a June survey from BairesDev, which comes from a staffing company with an interest in the answer and should be read that way, asked 1,569 developers across 77 countries and found only 16 percent of senior engineers believe juniors fully understand the AI-generated code they submit.
I saw it in about fifteen people. That one found it in fifteen hundred.
Where the pitch is right
Three things, and they get real weight.
It genuinely worked, and calling it a scam in hindsight is dishonest. A window was open and people climbed through it, and the ones who did owe nobody an explanation for having noticed. Then it closed. That is a different thing from a lie being found out.
The anti-credential half held. Nobody responded to this correction by replacing the bootcamp graduate with a computer science graduate. The CS graduates turned up with the same gaps, which is exactly what my own wrong assumption was about. The door still does not require a degree, and given how much of the professional world runs on credentials, that is not a small thing to still be true.
It is still the least gated door available. Entering software on demonstrated skill alone remains unusually possible next to law, medicine, or structural engineering, where the gate is statutory and no amount of talent walks around it. What closed was the shortcut. The door is where it always was.
What I’d actually do today
Use the agent to learn, not only to build. After the thing works, stay in the conversation. Ask why it chose that approach, what it rejected, what breaks if you do it the other way. Ask it to explain the SQL it generated, the auth flow it assumed, the header it set. You have access to the thing that used to require a senior engineer sitting beside you with the patience to be interrogated, and it is now free and endlessly patient, and almost nobody uses it that way. Cost: slower than accepting the diff, and nobody will ever check that you did it. Which is exactly why it is worth something.
For anything you ship, be able to describe the layer underneath it. Shipped a query through an ORM? Read the SQL it emitted, then read the plan. Shipped an endpoint? Know who can call it and how someone would try. You do not have to go all the way down. One layer, every time. Cost: you will regularly discover you were wrong about something you were sure of, which is unpleasant and is also the entire mechanism by which this works.
When something tells you to turn a thing off, find out what the thing does first. Every disabled setting in a tutorial is a decision somebody made for you, in a context that is not yours, to keep their example short. Cost: an afternoon on the same-origin policy instead of a finished feature. Take the afternoon. That afternoon is the difference between the two candidates I interview.
And keep building. Building was never the bad advice. It just stopped being the whole of it.
For a decade the bar was “it works.” That was never a bar. It was a receipt.
Reverse Pitch is one post a week on software engineering and the career around it, written from inside the work. Opinions, with receipts.