25 signs your vibe-coded app is one deploy away from BREAKING in prod
security
1. api keys sitting in code "will move later"
2. auth routes have no rate limit
3. cors set to * just to make it work
4. same tokens used in dev, staging, prod
data
5. database structure changed but no migration files
6. backups enabled but never tested restore
7. big queries pulling full tables every time
8. server accepts whatever client sends
reliability
9. error handling = console.log and move on
10. logs only checked when something breaks
11. you learn the site is down from user messages
12. timezones handled differently in backend and frontend
13. frontend calling third-party APIs directly
deployment
14. no CI pipeline, everything manual
15. deploy steps written nowhere
16. no real staging, just testing on prod carefully
17. only one person knows how deployment works
18. env variables only exist on your laptop
codebase
19. one huge component running the whole screen
20. cleanup tasks keep getting postponed
21. feature flags managed by commenting code
22. no proper setup guide for new devs
product
23. no analytics, just guessing user behavior
24. no tests, just clicking around before release
25. every bug fix creates two new bugs
copy this into Claude Code:
"Audit my app against every item in this list.
For each issue:
- tell me if it exists
- explain the risk
- estimate impact on reliability, security, and maintainability
- provide exact fixes
- generate the code, configs, migrations, and setup steps required
Then create a prioritized action plan.
Start with issues that could cause outages, security vulnerabilities, data loss, or deployment failures.
Implement all fixes you can automatically and create PR-ready changes where possible."