Phase 3: Reading & Reviewing AI Code · 25 min · Any vibe coding tool with code view
Objective
Your mission
Audit AI-generated code for 6 specific red flags and document findings with specific code locations. Output: red_flag_audit.md.
You need: Any AI-built project with a code view.
Time: 25 minutes.
Step 1: learn the 6 red flags (10 min)
Red Flag 1: Hardcoded Secrets
const API_KEY = 'sk-1234567890abcdef'
Anyone who can see the code has your key. Should be: const API_KEY = process.env.API_KEY
Red Flag 2: Swallowed Errors
catch (error) {
// silently ignore
}
When something fails, the app continues as if nothing happened. Users see blank screens with no error message.
Red Flag 3: Magic Numbers
setTimeout(reloadData, 86400000)
What is 86400000? Should be: const ONE_DAY_IN_MS = 24 * 60 * 60 * 1000
Red Flag 4: Suspicious Comments
// Don't worry about this, it works
// TODO: fix this later
// Hack: but it works
These mark code the AI wasn't confident about. Breadcrumbs to future bugs.
Red Flag 5: Disabled Security
app.use(cors({ origin: '*' }))
// Skip auth check for testing
CORS disabled, auth commented out — often added "for testing" and never re-enabled.
Red Flag 6: Overly Complex Solutions A 200-line function for something that should be 20 lines. Three nested loops where one would do.
The Autonoma study
Autonoma's analysis of vibe coding failures found that the most common issues weren't AI hallucinations — they were silent security problems: hardcoded secrets, disabled security features, and swallowed errors. The apps worked. They just weren't safe.
Step 2: open your project's code (2 min)
Open a project you've built with AI. Find the code view.
Step 3: scan for each red flag (10 min)
Go through the code looking for each of the 6 red flags. For each one you find, note the code snippet and location.
Write in your file:
## Red Flag Audit
### 1. Hardcoded Secrets
Found? [yes/no]
If yes: [code snippet + file/section]
What I'd ask the AI to change: [specific correction]
### 2. Swallowed Errors
Found? [yes/no]
If yes: [code snippet + file/section]
What I'd ask the AI to change: [specific correction]
### 3. Magic Numbers
Found? [yes/no]
If yes: [code snippet + file/section]
What I'd ask the AI to change: [specific correction]
### 4. Suspicious Comments
Found? [yes/no]
If yes: [code snippet + file/section]
What I'd ask the AI to change: [specific correction]
### 5. Disabled Security Features
Found? [yes/no]
If yes: [code snippet + file/section]
What I'd ask the AI to change: [specific correction]
### 6. Overly Complex Solutions
Found? [yes/no]
If yes: [code snippet + file/section]
What I'd ask the AI to change: [specific correction]
Step 4: double-check (3 min)
If you found none, check again. Red flags are easy to miss on the first pass. Scan specifically for: string literals that look like keys/tokens, empty catch blocks, and comments with "TODO" or "hack."
Which line in AI output is a red flag even though the app works?
A swallowed error hides failures: the app looks fine while something breaks underneath. Hardcoded secrets and disabled security are the other silent problems.