Understand the auth code your AI wrote
A full-stack app in 48 hours, and no idea how it works · Reddit r/vibecoding · u/Frequent_Lobster_948 · Aug 2026
A beginner had auth, a Postgres schema and deployment running in a weekend, then realised they couldn't tell whether the server-side permission checks were secure.
The honest numbers
- Says a working prototype in 48 hours
As stated by the source. Not independently verified.
Lesson
Ask the AI to walk you through the auth and permission code line by line, and try calling your API directly as a logged-out user.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
Claude Code just finished a change in my app. Before I accept it, act as a careful reviewer. 1) Summarise in plain English what changed and why, file by file. 2) Point out anything risky: auth, payments, database queries, deleted code, new dependencies, or secrets. 3) List edge cases that might break (empty data, slow network, two devices, a logged-out user). 4) Give me a 10-minute manual test plan for the real user flows, and the automated tests worth adding. Don't make further changes until I reply.
Source: Reddit r/vibecoding ↗