Vibe Code Health Check

Hardcoded passwords, API keys, or tokens visible in your codebase or .env committed to git.

API routes accessible without login, or authentication that can be easily bypassed.

User inputs passed directly to database queries, API calls, or rendered as HTML without sanitization.

Raw user input concatenated into database queries instead of using parameterized queries or an ORM.

No try/catch blocks, unhandled promise rejections, or generic error messages that leak internal details.

Components doing too many things, deeply nested props drilling, or circular dependencies.

Lots of "any" types, missing interfaces, or plain JavaScript with no type safety.

Database queries, API calls, and complex logic inside React components instead of separate services.

Zero unit tests, integration tests, or end-to-end tests. Any change could break anything.

Manual deployments, no automated checks before deploy, no staging environment.

No Sentry, no logging service, no way to know when things break in production.

API endpoints can be hammered without limits, risking abuse and runaway costs.