---
title: "Vibe code best practices checklist | Ian Nuttall"
description: "Coding best practices"
canonical: "https://ian.is/post/coding-best-practices"
language: "en"
---

# Vibe code best practices checklist

Jun 2025 / 47,714 views / [via X](https://x.com/iannuttall/status/1929494458455797857)

Vibe coding best practice checklist.

To help anyone write secure, high-quality apps (even if you’re new to coding):

1\. Don’t repeat yourself
→ Reuse shared logic to cut bugs and clutter.

2\. Use small building blocks
→ Keep files focused and under 300–400 lines for easier testing.

3\. Group files by feature
→ Store UI, service and tests together so updates are fast.

4\. Validate all input
→ Check and sanitise every user value on both client and server.

5\. Use safe database queries
→ Parameterised queries stop SQL/NoSQL injection.

6\. Clean any output you render
→ Sanitize HTML/markdown to block cross-site scripting.

7\. Hide secrets in env vars
→ Keep keys and tokens out of version control.

8\. Force HTTPS everywhere
→ Encrypt all data in transit.

9\. Guard private routes
→ Only logged-in users reach sensitive pages.

10\. Check roles before actions
→ Verify user role or scope for each restricted operation.

11\. Rate-limit sensitive endpoints
→ Limit login, sign-up and reset routes to foil brute-force attacks.

12\. Set secure HTTP headers
→ Enable HSTS, CSP and other headers for extra browser protection.

13\. Log errors with context
→ Capture request ID, user ID and stack trace for rapid debugging.

14\. Catch async errors
→ Wrap async code so rejected promises don’t crash silently.

15\. Give users friendly errors
→ Show clear messages but hide technical details.

16\. Cache heavy work
→ Store results of expensive tasks with sensible expiries.

17\. Memoise pure functions
→ Skip rerunning deterministic calculations during renders.

18\. Paginate big lists
→ Send data in pages to save memory and bandwidth.

19\. Load code only when needed
→ Split non-critical bundles and fetch on demand.

20\. Clean up on unmount
→ Clear timers, listeners and aborted fetches to prevent leaks.

21\. Wrap related DB steps in a transaction
→ Commit or roll back all steps as one atomic unit.

22\. Index hot query fields
→ Add indexes to columns you filter or join on often.

23\. Use a connection pool
→ Reuse a small set of open database connections.

24\. Match HTTP verbs to actions
→ GET read, POST create, PUT/PATCH update, DELETE remove.

25\. Version your API routes
→ Prefix with /v1, /v2 so upgrades don’t break old clients.

26\. Return structured error objects
→ Send consistent JSON like { error: { code, message } }.

27\. Choose clear names
→ Use descriptive identifiers, avoid cryptic abbreviations.

28\. Write why comments
→ Briefly note intent behind non-obvious code.

29\. Test the core logic
→ Unit-test business rules to catch regressions early.

30\. Test whole flows
→ Integration tests confirm components work together.

(Full guide in first comment below)

![Image from the original X post](https://ian.is/media/tweets/1929494458455797857/1929494458455797857/be03ded87cfbdae00b33b884242f31e6cefa9a43d29cf4342feca58708e81b41.jpg)

[https://gist.github.com/iannuttall/c957fbc7cf394105a4ff5f0ac8c1ac31](https://gist.github.com/iannuttall/c957fbc7cf394105a4ff5f0ac8c1ac31)

## Ian's List

Join 15k\+ subscribers