The model did not breakbreak your app.It left things outleft things out

Keys and secrets

Six of the twenty are about credentials because that is where our own code bit hardest and where the numbers in the research are worst: 41 percent of 100 audited vibe-coded apps had an exposed key.

1. 01

   Keys go in headers, never in URLs

   hit in our code

   A URL is not a private channel

2. 02

   A pasted secret is a burned secret

   hit in our code

   Chat transcripts persist outside your security boundary

3. 03

   The public prefix means public

   research, sourced

   NEXT_PUBLIC_ and VITE_ are build instructions

4. 04

   Rotate first, then rewrite history. Deleting the file does nothing

   both

   A commit that removes a secret leaves it in every prior commit, every clone, every fork, and GitHub's cached views of deleted forks

5. 05

   One key per system, scoped, with a spend cap

   both

   A shared key turns one leak into several rotations and one outage into several

6. 06

   IDs can ship. Keys cannot. Know which is which

   both

   A GA4 measurement ID, a Meta Pixel ID, a Supabase publishable key are designed to sit in the browser

The limit that limits nothing

The backend equivalent of the omission thesis: the code has a rate limit, a dedupe, a retry, and each one is shaped like the real thing without doing the real thing's job.

1. 07

   A read-then-write counter on an eventually consistent store is not a rate limit

   hit in our code

   Cloudflare KV, and most edge key-value stores, take up to about 60 seconds to propagate a write

2. 08

   A dedupe key carries the intent, not just the identity

   hit in our code

   Deduplication keyed on the email alone means the second thing a person does is treated as a repeat of the first

3. 09

   Every write that can be retried must be idempotent

   both

   Platforms retry on your behalf: Stripe redelivers a webhook for up to three days, Slack resends if you do not answer in three seconds, Vercel can fire the same cron twice or start a second instance while the first runs

4. 10

   Retries are capped and backed off, and every outbound call times out

   research, sourced

   Three layers each retrying three times is 27 requests for one failure

5. 11

   A form that echoes visitor text inside your signed email is a phishing relay

   hit in our code

   If a contact endpoint accepts a recipient and a message, and sends a branded, DKIM-signed email containing that message, anyone can send anything to anyone from your domain

Database

Our stack has no Supabase, so these four are from the research and from the one place our own agents touched production. They are here because the most common backend under vibe-coded apps is Supabase, and 83 percent of its exposures are one setting.

1. 12

   RLS enabled is not RLS working

   research, sourced

   Row-level security is two things: a switch per table, and a policy per command

2. 13

   The admin key is not a fix for a policy error

   research, sourced

   When a policy blocks a query, the fastest thing that makes the error go away is the service-role key, which bypasses every policy

3. 14

   The coding agent never holds production credentials

   both

   An agent with a production database URL will, sooner or later, run a migration, a cleanup, or a "fix" against it

4. 15

   Backups the app cannot reach, and one restore you have actually done

   both

   The free plan has no backups

Agents and checks

The five that came out of our own pipeline more than the research. They are the ones nobody in the vibe-coding lane is saying, because you have to have run a night of agents to learn them.

1. 16

   Never let the thing check itself

   hit in our code

   The model that wrote the code, or the tool that produced the measurement, will confirm its own output when asked

2. 17

   Scope the tool, not the prompt. Permissions come from keys, not instructions

   hit in our code

   "Do not deploy" in a prompt is a request

3. 18

   Untrusted text going into a prompt is untrusted code going into an interpreter

   both

   A model with private data, untrusted input, and any way to send something outward can be made to send the private data outward

4. 19

   Parallel agents get one worktree each and one owner per file

   hit in our code

   Two agents editing the same checkout write over each other, and neither reports an error because each one's write succeeded

5. 20

   Verify the output, not the report. Especially before a delete

   hit in our code

   Exit codes, summaries, and "9 files matched" are reports

Also true

True, and everyone says it. Filed so the list is complete.

• Contrast, labels, alt text, real buttons. 83.9 percent of the top million home pages fail contrast; plain-prompt LLM UIs fail keyboard access 80 percent of the time, accessibility-prompted ones 0 percent. Test with the mouse unplugged.
• Size the images, do not lazy-load the hero. 62 percent of mobile pages ship an unsized image; only 48 percent pass Core Web Vitals.
• Disable the button on submit, redirect after post, idempotency key. Double orders from double clicks.
• Platform limits the model never mentions. Vercel 4.5 MB body and 300 seconds, Workers 10 ms CPU on free, Supabase Edge 150 seconds. Presigned direct uploads and queues for anything long.
• App Store bounces: no in-app delete account, Google-only sign-in, a web page in a shell, privacy labels that do not match the SDKs, no terms link on subscriptions.
• Money as a float, sequential IDs in URLs, customer data in logs. numeric or cents as integers, UUIDs, log ids not rows.
• Slopsquatting. Models invent package names; some are registrable. npm view PKG time.created before you install what the model suggested, and ignore-scripts on.

Twenty so far. New ones go to email first