25 red flags hiding in your VIBE CODED app : Bookmark this before your next PR ! 1/ no .env.example file > new dev joins. cant run the app. nobody knows what env vars exist. 2/ API keys in git history > deleted from .env doesn't mean deleted from history. rotate those keys. 3/ no README with setup instructions > three steps to run locally that only you know. 4/ functions with 500+ lines > AI fills files. nobody splits them. untestable, unreadable, unmaintainable. 5/ catch blocks that swallow the error > silent failures. user sees nothing. you get no alerts. bug persists. 6/ hardcoded localhost URLs > breaks in staging. breaks in production. search "localhost" in the repo right now. 7/ no TypeScript or type definitions > you refactor one prop and nothing tells you about the 12 places it broke. 8/ console.log statements in production > performance overhead and sensitive data leaking into browser consoles. 9/ zero tests > you change one utility function and don't know what broke until a user tells you. 10/ missing loading and error states in the UI > API call takes 3 seconds. user sees blank screen and refreshes. request fires twice. 11/ dead code everywhere > AI generates functions. AI forgets them. nobody knows whats active. 12/ no linting or formatting config > every file has different indentation. code reviews become style arguments. 13/ mixed naming conventions > camelCase, snake_case, PascalCase. all from AI. all in the same repo. 14/ god components doing everything > 500-line React components handling state, data fetching, and UI simultaneously. 15/ DB queries directly in route handlers > business logic tangled with framework code. change one thing, you touch everything. 16/ secrets in committed config files > not .env. config.js or settings.json that didnt seem like a secret file. 17/ no CI/CD pipeline > deploy = "i hope nothing breaks." you find out in production. 18/ direct DOM manipulation inside React > mixing jQuery patterns with React. breaks silently on re-renders. 19/ state mutated directly > `state.items.push(item)` instead of a new array. causes unpredictable renders. 20/ memory leaks from uncleaned intervals > setInterval inside useEffect with no cleanup. fires after the component unmounts. 21/ blocking the event loop with sync operations > `fs[.]readFileSync` in a request handler. one request pauses all others. 22/ no pagination on list endpoints > fetch all 50,000 records to display 20. works fine in dev with 5 test rows. 23/ missing Content-Type headers on API responses > clients parse JSON as text. debugging nightmare across different clients. 24/ no error boundary in React > one uncaught error in a child component crashes the entire app. 25/ inconsistent API response shapes > some endpoints return `{data: {}}`. others return the object directly. good luck building a client.