Phase 3: Reading & Reviewing AI Code · 30 min · Any vibe coding tool with code view

Spotting Red Flags in AI Output

The AI writes code that works. It doesn't always write code that's safe. Learn the difference.

Hiring signal: What changes when you use this: you can catch security issues in AI-generated code before they become incidents — which means you ship apps that don't get hacked.

What you will learn

Spot hardcoded secrets and API keys in AI-generated code
Recognize swallowed errors (empty catch blocks)
Identify magic numbers and suspicious 'trust me' comments
Flag disabled security features and overly complex solutions

Your Mission

Audit AI-generated code for 6 specific red flags and document findings with specific code locations. Output: red_flag_audit.md.

You need: Any AI-built project with a code view.

Time: 25 minutes.

Step 1: Learn the 6 Red Flags (10 min)

Red Flag 1: Hardcoded Secrets

const API_KEY = 'sk-1234567890abcdef'

Anyone who can see the code has your key. Should be: const API_KEY = process.env.API_KEY

Red Flag 2: Swallowed Errors

catch (error) {
  // silently ignore
}

When something fails, the app continues as if nothing happened. Users see blank screens with no error message.

Red Flag 3: Magic Numbers

setTimeout(reloadData, 86400000)

What is 86400000? Should be: const ONE_DAY_IN_MS = 24 * 60 * 60 * 1000

Red Flag 4: Suspicious Comments

// Don't worry about this, it works
// TODO: fix this later
// Hack: but it works

These mark code the AI wasn't confident about. Breadcrumbs to future bugs.

Red Flag 5: Disabled Security

app.use(cors({ origin: '*' }))
// Skip auth check for testing

CORS disabled, auth commented out — often added "for testing" and never re-enabled.

Red Flag 6: Overly Complex Solutions A 200-line function for something that should be 20 lines. Three nested loops where one would do.

The Autonoma study
Autonoma's analysis of vibe coding failures found that the most common issues weren't AI hallucinations — they were silent security problems: hardcoded secrets, disabled security features, and swallowed errors. The apps worked. They just weren't safe.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Step 2: Open Your Project's Code (2 min), Step 3: Scan for Each Red Flag (10 min), Red Flag Audit, Step 4: Double-Check (3 min), You're Done — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.