What building a school platform without a spec taught me about prompting AI correctly

TL;DR: I skipped writing a spec, shipped a cross-tenant security bug, and fixed it with one extra...