Vibecoding Master Quiz

The checking step is the method, not an optional extra. 'Never looking at the code' is the caricature — and the version that reliably produces an impressive mess.

Describe, verify, iterate — on a slice small enough to check. Describing several features at once breaks the loop, because you can't tell which part failed.

The brief is both the instruction you give the AI and the thing you measure output against. Without it the app drifts feature by feature and nothing says it's off course.

Popularity in the training data is the point. Chase the newest framework and you hit confident, invented APIs you then have to debug yourself.

Git makes every step a checkpoint, the preview shows you what was built, tests catch breakage. Skipping version control until 'later' is how a bad generation becomes unrecoverable.

A slice you can't review is a slice you'll accept on faith. Committing between them means a later failure doesn't force you to untangle several changes at once.

The AI 'just makes it work' by calling the paid API from the browser with the key inline. Anyone can read it — and a variable name or minification hides nothing.

AI-built apps routinely get the login right and the permission checks wrong, so any logged-in user can read anyone's records. Auth and authz are different problems.

Client-side validation is a UX nicety, not a defence. Never trust what comes from the browser — and use parameterised queries, not user input pasted into strings.

You use the app as intended; an attacker doesn't. AI reliably produces code that works in a demo and is wide open in production — and the gaps come in clusters.