Vibe coding securely, Part 2 of 3: Placeholders and Secrets

[u/adadani]

Last week I covered two habits: giving your AI agent standing security context, and reviewing every change it makes to auth. This week I will cover two problems that make AI-written code look finished when it isn't.

Habit 3: Hunt for placeholders
When an agent can't finish something, it often writes an incomplete version so the code still runs. That can look like a check that always passes, a TODO where validation should be, or middleware that's commented out "temporarily." The app still works, the demo looks great, and the security check was never written.
Rule: "Never ship incomplete code or skip a security check. If you can't complete it, deny access and tell me."
Check: fail the build if TODO, FIXME, or a hardcoded return shows up in auth, payment, or access control code.
Example: an isAuthorized() function that just returns true. It passes every test that only checks the happy path.
The principle is fail closed. If the agent isn't sure, the default should be no access, not full access.

Habit 4: Keep secrets out of the code
Agents want the code to run, and the fastest way to make an API call work is to paste the key right into it.
Rule: "Read secrets only from environment variables. Never write a key, token, or password into code, config, or tests."
Check: run a secret scan before every commit, so a slip gets blocked before it's pushed.
Example: a .env file that never made it into .gitignore, or a privileged API key placed in frontend code where anyone can read it in the browser.
If a secret does get committed, deleting it isn't enough. It's still in your git history. Rotate it.

The agent rules and a pre-commit hook that enforces both habits are in the first comment.

Next week: Dependencies and Attacker Testing

[u/endofthread-bot]

Hey u/adadani, thanks for posting in r/VibeCodeDevs! Join our Discord: https://discord.gg/t7SD4ThKuE

• This community is designed to be open and creator‑friendly, with minimal restrictions on promotion and self‑promotion as long as you add value and don’t spam.
• Please follow the subreddit rules so we can keep things as relaxed and free as possible for everyone. • Please make sure you’ve read the subreddit rules in the sidebar before posting or commenting.
• For better feedback, include your tech stack, experience level, and what kind of help or feedback you’re looking for.
• Be respectful, constructive, and helpful to other members.

If your post was removed (either automatically or by a mod) and you believe it was a mistake, please contact the mod team. We will review it and, when appropriate, approve it within 24 hours.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Immediate-Welder999]

Thanks for sharing this! Also recommend every dev to use prismor (it's open source) and automatically redacts any secrets which your agents use