Phase 8: Security, Privacy, and Judgment Traps · 25 min · Any vibe coding tool

When AI Leads You Astray

The AI is confident even when it's wrong. Learn to recognize when it's leading you down a dangerous path.

Real-world application: What changes when you use this: you can recognize when AI suggestions are wrong or dangerous — which means you don't ship bad code.

What you will learn

Recognize when the AI suggests disabling security 'for simplicity'
Catch when the AI suggests hardcoding values 'for now'
Identify when the AI invents APIs or libraries that don't exist (hallucination)
Spot deprecated or insecure patterns in AI suggestions
Push back effectively with targeted questions

Objective

Your mission

Audit your AI-generated code for 5 misleading patterns and use the push-back toolkit to fix them. Output: ai_astray_audit.md.

You need: An app built with AI assistance.

Time: 25 minutes.

Step 1: learn the 5 misleading patterns (5 min)

Confidence ≠ correctness
AI tools generate text that sounds confident. The same confidence that makes the AI say "I've implemented the auth flow" (correct) makes it say "I've disabled RLS for simplicity" (dangerous). There's no confidence dial — the AI is always confident. Your job is to evaluate the suggestion, not the confidence.

The 5 patterns:

Disabling security "for simplicity" — "I've disabled RLS. You can enable it later."
Hardcoding values "for now" — "I've hardcoded the key. Move it to env vars later."
Skipping tests "to save time" — "I've skipped tests. Add them later."
Hallucinating APIs — Function names that sound right but don't exist
Deprecated/insecure patterns — eval(), innerHTML, Math.random() for crypto

The push-back toolkit:

"Is this secure?"
"Is this production-ready?"
"Is this a deprecated pattern?"
"Does this API/function actually exist?"
"What could go wrong with this approach?"

Step 2: check pattern 1 — security disabled "for simplicity" (3 min)

Search for signs of disabled security:

grep -ri "disabled" src/
grep -ri "for simplicity" src/
grep -ri "for now" src/
grep -ri "can enable later" src/

Also check Supabase Dashboard → check if any tables have RLS disabled.

Write in your file:

### Pattern 1: Security Disabled "For Simplicity"
Evidence found: [list or "none"]
Push-back used: [e.g., "Is this secure? Don't disable RLS"]
Fix applied: [what you did]

Step 3: check pattern 2 — hardcoded values "for now" (3 min)

grep -r "sk_" src/
grep -r "eyJ" src/
grep -r "hardcoded" src/
grep -r "for now" src/

Write in your file:

### Pattern 2: Hardcoded Values "For Now"
Evidence found: [list or "none"]
Push-back used: [e.g., "Move to env var now, not later"]
Fix applied: [what you did]

Step 4: check pattern 3 — tests skipped (2 min)

grep -r "skip" src/ --include="*.test.*"
grep -r "todo" src/ --include="*.test.*"
ls src/**/*.test.* 2>/dev/null || echo "No test files found"

Write in your file:

### Pattern 3: Tests Skipped
Test files exist: [yes/no]
Tests skipped or TODO: [list or "none"]
Push-back used: [e.g., "Write a basic test for the main flow"]
Fix applied: [what you did]

Step 5: check pattern 4 — hallucinated APIs (5 min)

Look for function calls that might not exist. Check any unfamiliar imports or function names against official docs.

Common hallucination signs:

Function names that sound right but don't exist
Import paths that look correct but are wrong
Configuration options that don't exist in the library

For any suspicious API, check the official documentation:

Supabase: supabase.com/docs/reference/javascript
React: react.dev
Other libraries: check their official docs

Write in your file:

### Pattern 4: Hallucinated APIs
Suspicious APIs found: [list or "none"]
Verified against docs: [list results — exists/doesn't exist]
Push-back used: [e.g., "Does this API exist? Check the docs"]
Fix applied: [what you did]

Step 6: check pattern 5 — deprecated/insecure patterns (5 min)

grep -r "eval(" src/
grep -r "innerHTML" src/
grep -r "document.write" src/
grep -r "Math.random" src/
grep -r "localStorage.*token" src/

Dangerous patterns to watch for:

eval() — use JSON.parse() instead
innerHTML with user content — use textContent (XSS risk)
document.write() — deprecated, XSS risk
Math.random() for crypto — use crypto.getRandomValues()
Tokens in localStorage — XSS risk, use httpOnly cookies if possible

Write in your file:

### Pattern 5: Deprecated/Insecure Patterns
Patterns found: [list or "none"]
Push-back used: [e.g., "Is this a deprecated pattern?"]
Fix applied: [what you did]

Step 7: summary (2 min)

Write in your file:

## Summary
Total patterns found: [number]
Total fixed: [number]
Push-back prompts used: [list]
Key learning: [1-2 sentences on what you discovered about AI confidence]

The AI says, confidently, "I've disabled RLS for simplicity; you can enable it later." How should you treat it?

The AI is equally confident when right and wrong. Judge the suggestion, not the tone: "Is this secure? Don't disable RLS."

Key Terms & Next

You're done

Save your ai_astray_audit.md. You now have a habit of questioning AI suggestions — not because the AI is always wrong, but because confidence ≠ correctness.

That's the whole lesson. Now do the lab.

Its hands-on lab, and the lessons after it, open with a free account — the opening phases of 29 of 35 courses are free, no credit card.

Key terms in this lesson

Hallucination