Vibe code best practices checklist

Vibe coding best practice checklist.

To help anyone write secure, high-quality apps (even if you’re new to coding):

1. Don’t repeat yourself
→ Reuse shared logic to cut bugs and clutter.

2. Use small building blocks
→ Keep files focused and under 300–400 lines for easier testing.

3. Group files by feature
→ Store UI, service and tests together so updates are fast.

4. Validate all input
→ Check and sanitise every user value on both client and server.

5. Use safe database queries
→ Parameterised queries stop SQL/NoSQL injection.

6. Clean any output you render
→ Sanitize HTML/markdown to block cross-site scripting.

7. Hide secrets in env vars
→ Keep keys and tokens out of version control.

8. Force HTTPS everywhere
→ Encrypt all data in transit.

9. Guard private routes
→ Only logged-in users reach sensitive pages.

10. Check roles before actions
→ Verify user role or scope for each restricted operation.

11. Rate-limit sensitive endpoints
→ Limit login, sign-up and reset routes to foil brute-force attacks.

12. Set secure HTTP headers
→ Enable HSTS, CSP and other headers for extra browser protection.

13. Log errors with context
→ Capture request ID, user ID and stack trace for rapid debugging.

14. Catch async errors
→ Wrap async code so rejected promises don’t crash silently.

15. Give users friendly errors
→ Show clear messages but hide technical details.

16. Cache heavy work
→ Store results of expensive tasks with sensible expiries.

17. Memoise pure functions
→ Skip rerunning deterministic calculations during renders.

18. Paginate big lists
→ Send data in pages to save memory and bandwidth.

19. Load code only when needed
→ Split non-critical bundles and fetch on demand.

20. Clean up on unmount
→ Clear timers, listeners and aborted fetches to prevent leaks.

21. Wrap related DB steps in a transaction
→ Commit or roll back all steps as one atomic unit.

22. Index hot query fields
→ Add indexes to columns you filter or join on often.

23. Use a connection pool
→ Reuse a small set of open database connections.

24. Match HTTP verbs to actions
→ GET read, POST create, PUT/PATCH update, DELETE remove.

25. Version your API routes
→ Prefix with /v1, /v2 so upgrades don’t break old clients.

26. Return structured error objects
→ Send consistent JSON like { error: { code, message } }.

27. Choose clear names
→ Use descriptive identifiers, avoid cryptic abbreviations.

28. Write why comments
→ Briefly note intent behind non-obvious code.

29. Test the core logic
→ Unit-test business rules to catch regressions early.

30. Test whole flows
→ Integration tests confirm components work together.

(Full guide in first comment below)

https://gist.github.com/iannuttall/c957fbc7cf394105a4ff5f0ac8c1ac31