Home / Errors / Vibe coding (any tool)
Vibe coding (any tool) Errors: Every Documented Failure and Fix
Cross-tool failure patterns: leaked keys, missing auth, injection flaws, hallucinated packages, surprise bills.
The AI put your API key in the frontend: OpenAI, Stripe, or Supabase keys visible in the JS bundle
Treat the key as compromised right now: revoke and rotate it in the provider dashboard before touching code. Removing it from the ...
Involved · 1-3 hoursNo auth on your AI-generated API endpoints: anyone can call your backend
Assume every route is public until proven otherwise: hit each endpoint with curl, no cookies, no headers, and with another user's ...
Moderate · 1-3 hoursWhy is my OpenAI API bill so high? No rate limiting on your AI endpoints
First, cut off the bleeding: revoke exposed keys and set hard spend limits at the provider. Then add rate limiting at the edge (Ve...
Involved · 2-6 hours for a small codebaseSQL injection and XSS in AI-generated code
Assume the AI shipped injection holes: Veracode found 45% of AI-generated code samples introduce OWASP Top 10 vulnerabilities. Con...
Moderate · 30-90 minutesAccidentally committed an API key to GitHub
Rotate first, clean up second: the moment a secret hits a public commit, revoke and reissue it at the provider. Bots scrape fresh ...
Moderate · 15-45 minutes to vet; hours if compromisedSlopsquatting: the AI hallucinated an npm package and an attacker registered it
Treat any package name an AI suggested as unverified. Before installing, check it on npmjs.com or pypi.org: downloads, publish dat...
Involved · 1-4 hours if backups existThe AI agent deleted my code or database and there's no backup
Stop the agent immediately. Check every recovery source yourself: git history, the platform's backup and restore tooling, and data...
Easy · 30-60 minutesWildcard CORS: Access-Control-Allow-Origin * in your AI-generated backend
Replace app.use(cors()) and allow_origins=["*"] with an explicit origin allowlist read from an environment variable. Never combine...
The Vibe Oops briefing
One email when something ships to production that should not have. New incidents, new error guides, no filler.