Vibe Code Fix

LLMs love inventing npm packages and module paths that sound real. Run the code once — a ModuleNotFoundError is the cheapest bug you'll ever catch.

The AI may call `client.users.getByEmail()` when the real method is `client.getUserByEmail()`. These slip past TypeScript if the client is typed loosely.

AI training data is a blur of versions. It may write React 18 hooks against React 19, or pre-v4 Tailwind syntax in a v4 project.

When you paste a file back and ask for a change, the AI sometimes deletes unrelated functions, comments, or error-handling branches it didn't think were important.

AI-generated code is prone to near-duplicates: two validation functions that look identical but differ by one character. One gets fixed, the other rots.

AI eagerly inlines `OPENAI_API_KEY` or database passwords into React components. Anyone can open devtools and steal them.

A surprisingly common pattern: the frontend hides the Delete button, but the `/api/delete` route has zero auth check. Anyone with the URL can call it.

AI loves template literals. `` `SELECT * FROM users WHERE email = '${email}'` `` is a SQL injection waiting for its first apostrophe.

The AI 'fixes' a file upload error by making the S3 bucket public. Now your user uploads are indexed by Google.

To make the frontend 'just work', the AI opens CORS to the whole world. Now any site can hit your API with the user's cookies.

`console.log(req.body)` includes the login form. Your log provider now has a plaintext password store.

AI writes the happy path first. `.map()` on an array that might be undefined, `.toLowerCase()` on a value that might be null — classic production crash.

`items.slice(page * pageSize, (page + 1) * pageSize)` vs `items.slice(page * pageSize, page * pageSize + pageSize)` — both 'look right', one is wrong depending on whether page is 0- or 1-indexed.

`new Date().toISOString()` is fine. `new Date('2026-04-10')` parses as UTC on the server and local time in the browser — a classic off-by-one-day bug.

Your OpenAI call, your email provider, your payments API — they all rate-limit. The AI rarely writes retry-with-backoff, so the first burst of traffic looks like a total outage.

Button click → nothing visible for 2 seconds → user clicks again → duplicate submission. A missing loading state is a data corruption bug dressed up as a UX bug.

The AI wrote `try { ... } catch (e) { console.error(e); }`. The error shows up in devtools. The user sees nothing happen and assumes the app is broken.

The classic: loop over users, query each user's posts inside the loop. 50 users = 51 queries. The AI writes this constantly because it's the simplest-looking code.

React component recomputes a filtered sorted list on every keystroke. At 10 items it's invisible. At 1,000 it freezes the page.

AI imports `lodash` for one function, `moment` instead of `date-fns`, or pulls in a massive icon library when you needed one icon.

Server route reads a 50MB file synchronously before responding. Each request blocks every other request on the same worker.

Vibe-coded apps usually have zero tests. You don't need 100% coverage on day one — but one end-to-end test that proves the core flow works means you'll catch it the moment you break it.

Deploy succeeds, server starts, first request crashes because `STRIPE_SECRET_KEY` is undefined. You find out from a user.

Without error tracking, your first signal that prod is on fire is a tweet. Free tier of Sentry or Highlight takes 5 minutes to set up.

The AI created a `.env` with your real keys, you added it to git, pushed to a public repo. GitHub's secret scanner usually catches this — but only after a bot has already grabbed it.