Vibe coding flashcards

What's in it

Every deck follows the course outline, with tags you can study or suspend topic by topic. Open a deck to study its free sample right here.

Study guide

Topics covered

The decks follow the order of the course outline. Numbers are cards per topic.

• What Vibe Coding Is 11
  • Origins and Meaning 6
  • What It Is Not 5
• Where It Fits 14
  • Good Fits 5
  • Risky Territory 9
• The Build Loop 23
  • Describe and Generate 6
  • Run Read Refine 8
  • Small Steps 9
• Reading the Output 11
  • Why You Still Read 11
• Project Basics 21
  • Files and Folders 7
  • Dependencies 8
  • Choosing Boring Tech 6
• Writing a Spec 14
  • Goal and Users 5
  • Constraints and Done-When 9
• Giving Good Input 11
  • Examples 4
  • Errors Verbatim 7
• Plans Tests and Rules 20
  • Plan First 8
  • Asking for Tests 7
  • Project Rules Files 5
• Managing Context 14
  • Focused Context 5
  • Stuck Loops and Resets 9
• Reviewing AI Output 14
  • Reviewing Diffs 7
  • Asking for Explanations 7
• Git Basics 26
  • Repositories and Commits 15
  • Inspecting Changes 7
  • Ignoring Files 4
• Branches and Undo 21
  • Branches 10
  • Undoing Changes 11
• Collaboration and CI 12
  • Pull Requests and Review 6
  • Continuous Integration 6
• Secrets and Configuration 18
  • Environment Variables 10
  • Leaked Secrets 8
• Backups 5
  • Backup Habits 5
• How the Web Fits Together 19
  • HTML CSS and JavaScript 6
  • The DOM 6
  • Frontend and Backend 7
• HTTP 20
  • Requests and Methods 7
  • Status Codes 13
• Data and APIs 23
  • JSON 4
  • APIs and Keys 11
  • CORS 8
• Databases 10
  • Tables and Documents 7
  • Migrations 3
• Going Live 14
  • Localhost and Deploying 5
  • Hosting 3
  • DNS and HTTPS 6
• Reading Errors 19
  • Error Messages and Stack Traces 13
  • Reproducing Bugs 6
• Debugging Tools 15
  • Browser DevTools 8
  • Logging and Rubber Ducking 7
• AI Failure Modes 19
  • Hallucinations and Outdated APIs 9
  • Wrong Fixes and Lost Code 10
• Security Basics 24
  • Secrets in Frontend Code 4
  • Injection and XSS 8
  • Access Control and Rate Limits 6
  • Dependencies and Least Privilege 6
• Knowing Your Limits 5
  • When to Stop Vibing 5

A study plan

• 15 new cards a day covers everything in a month, leaving the last weeks for review.
• 8 new cards a day covers everything in two months, leaving the last weeks for review.
• 5 new cards a day covers everything in three months, leaving the last weeks for review.

Willys schedules reviews for you (FSRS spaced repetition), so the daily number above is only for new cards; reviews of what you have learned come back on their own. Study a topic's cards right after you meet it in class, suspend topics you have not reached yet, and use the app's quiz mode in the final two weeks.

How to get these decks

1. Install Willys on your iPhone, iPad or Mac — App Store. 14-day free trial, then $14.99 a year.
2. In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
3. Study. The exam comes in as its own collapsible folder, every card scheduled by FSRS spaced repetition. Nothing you already have is changed.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

• Original material; checked against Andrej Karpathy's post on X of 2 February 2025, Simon Willison's writing on vibe coding, Merriam-Webster, MDN Web Docs (CC BY-SA 2.5), the npm documentation, the pip documentation (MIT), the Python documentation (PSF License), GitHub Docs (CC BY 4.0), the Claude Code documentation, the OWASP Cheat Sheet Series (CC BY-SA 4.0), the OWASP Top 10:2025 (CC BY-SA 4.0), the GDPR (Regulation (EU) 2016/679), Stripe's integration security guide, The Twelve-Factor App, the Agile Alliance glossary, Mozilla's bug-writing guidelines, Basecamp's Shape Up, Google's Engineering Practices documentation and C++ Style Guide (CC BY 3.0), the Google Testing Blog, Martin Fowler's bliki, Russ Cox's "Our Software Dependency Problem" and Dan McKinley's "Choose Boring Technology"; reference only, no text copied
• Original material; checked against Anthropic's Claude prompting guide, its engineering article on context engineering and the Claude Code documentation, OpenAI's prompting guides and Codex AGENTS.md documentation, GitHub Docs (CC BY 4.0), the Cursor Rules documentation, the OWASP Cheat Sheet Series (CC BY-SA 4.0), Stack Overflow's guide to minimal reproducible examples, Mozilla's bug-writing guidelines, Microsoft Learn's C/C++ build-errors page (CC BY 4.0), Wang et al. (2024) on deprecated API use in LLM code completion (CC BY 4.0) and the Git documentation; reference only, no text copied
• Original material; checked against the Git documentation, Pro Git (2nd edition, CC BY-NC-SA 3.0), GitHub Docs (CC BY 4.0), GitLab Docs (CC BY-SA 4.0), MDN Web Docs (CC BY-SA 2.5), the OWASP Cheat Sheet Series (CC BY-SA 4.0), Google's Engineering Practices documentation (CC BY 3.0), The Twelve-Factor App (MIT), the Python documentation (PSF License), the npm documentation, the Node.js, ESLint and Laravel documentation (MIT), the dotenv README (BSD-2-Clause), US-CERT's Data Backup Options (2012) and NIST SP 800-34 Rev. 1 (US government work); reference only, no text copied
• Original material; checked against MDN Web Docs (CC BY-SA 2.5); IETF RFCs 9110 (HTTP), 6585, 5789, 3986 (URIs), 8259 (JSON), 1034 and 1035 (DNS), 6335 and 6761; the OWASP Cheat Sheet Series (CC BY-SA 4.0); PortSwigger's Web Security Academy; GitHub Docs (CC BY 4.0); Stripe Docs; the Vite documentation (MIT); the PostgreSQL (PostgreSQL License), MongoDB, Django and Ruby on Rails (CC BY-SA 4.0) documentation; The Twelve-Factor App; reference only, no text copied
• Original material; checked against MDN Web Docs (CC BY-SA 2.5), the Git documentation, the Python documentation (PSF License), the Chrome DevTools documentation (CC BY 4.0), the OWASP Cheat Sheet Series (CC BY-SA 4.0), the OWASP Top 10:2025 (CC BY-SA 4.0), the OWASP Top 10 for LLM Applications 2025 (CC BY-SA 4.0), the OWASP API Security Top 10 2023 (CC BY-SA 4.0), GitHub Docs (CC BY 4.0) and the GitHub Blog, the npm documentation, the pip-audit documentation (Apache 2.0), the OSV vulnerability database, the Claude Code documentation and Anthropic's Claude prompting guide, the Next.js, Vite, Django and Stripe documentation, Mozilla's bug-writing guidelines, Stack Overflow's guide to minimal reproducible examples, the NIST CSRC glossary, MITRE's CWE list, Aider's documentation, Simon Willison's writing on vibe coding, Andrew Nesbitt's post defining slopsquatting, Snyk Labs' research on Copilot, and Spracklen et al. (2024) on package hallucinations, Wang et al. (2024) on deprecated API use in LLM code completion and Wu et al. (2025) on AI-for-code security (reference only; no text copied)
• Checked against MDN Web Docs (CC BY-SA 2.5), the Git documentation, GitHub Docs (CC BY 4.0), the OWASP Cheat Sheet Series (CC BY-SA 4.0), RFC 9110 and RFC 6585, the Python documentation (PSF License), the Claude Code documentation, the Chrome DevTools documentation (CC BY 4.0), Google's Engineering Practices and C++ Style Guide (CC BY 3.0), PortSwigger's Web Security Academy and Simon Willison's writing on vibe coding (reference only; no text copied).
• Original questions written for this deck; no official, textbook or question-bank items were copied.

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

Use of these pages is covered by our Terms of Use.