Home / Flashcard library / General knowledge / Vibe coding / Debugging and Security

General knowledge

Vibe Coding — Debugging and Security flashcards

10 of 70 cards free to study here · 5 topics · the whole deck is built into Willys

Reading errors and stack traces, reproducing bugs, the console and network tab, logging, classic AI-code failure modes like slopsquatting and tests edited to pass, security basics for builders, and when to stop vibing and learn.

Get the app All Vibe coding decks

Learn deck · part of Vibe coding · written against: Building software with AI assistants: workflow, prompting, git, web basics, debugging and security; tool-neutral. Updated 2026-10-10.

Study the free sample

10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 10 sample cards as a list
  1. Which three things should you look for first in an error message?
    The error type, the message text and the file and line number where it happened.
    Reading Errors › Error Messages and Stack Traces
  2. What is a stack trace?
    The list of function calls that were active when the error happened, showing the path the program took to reach the failing line.
    Reading Errors › Error Messages and Stack Traces
  3. What is the browser console for?
    It shows the page's JavaScript errors, warnings and log messages, and lets you run JavaScript against the page.

    It lives in the browser's developer tools.
    Debugging Tools › Browser DevTools
  4. A button does nothing and no error appears on the page. Where should you look first?
    The browser console.

    JavaScript errors show up there, not on the page itself.
    Debugging Tools › Browser DevTools
  5. What is a hallucinated package?
    A library name an AI made up.

    It sounds plausible but doesn't exist on the package registry, or didn't until someone registered it.
    AI Failure Modes › Hallucinations and Outdated APIs
  6. What is slopsquatting?
    Attackers registering package names that AIs tend to hallucinate and filling them with malicious code, so anyone who installs the suggested name gets compromised.
    AI Failure Modes › Hallucinations and Outdated APIs
  7. Why is an API key placed in frontend JavaScript effectively public?
    Everything sent to the browser can be read by anyone through the page source or the network tab, minified or not.
    Security Basics › Secrets in Frontend Code
  8. Does hiding a key in a minified bundle or an odd variable name protect it?
    No. Obfuscation only slows people down; the key is still in code anyone can download.
    Security Basics › Secrets in Frontend Code
  9. What signals that it's time to stop vibing and learn the part you're relying on?
    You're going in circles on the same problem, or the code handles money, private data or security and you can't explain how it works.
    Knowing Your Limits › When to Stop Vibing
  10. Your app is about to take real people's data. What should you understand yourself first?
    Where the data is stored, who can reach it and how it's protected (sign-in, permissions, backups), well enough to explain it to someone else.
    Knowing Your Limits › When to Stop Vibing

Unlock the whole deck

You are studying a free 10-card sample. All 70 cards of Vibe Coding — Debugging and Security, the other 5 Vibe coding decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More Vibe coding decks

FoundationsPrompting and ContextGit and Safety NetsWeb Basics for BuildersPractice Questions

← All Vibe coding decks, with the study guide and topic outline.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

  • Original material; checked against MDN Web Docs (CC BY-SA 2.5), the Git documentation, the Python documentation (PSF License), the Chrome DevTools documentation (CC BY 4.0), the OWASP Cheat Sheet Series (CC BY-SA 4.0), the OWASP Top 10:2025 (CC BY-SA 4.0), the OWASP Top 10 for LLM Applications 2025 (CC BY-SA 4.0), the OWASP API Security Top 10 2023 (CC BY-SA 4.0), GitHub Docs (CC BY 4.0) and the GitHub Blog, the npm documentation, the pip-audit documentation (Apache 2.0), the OSV vulnerability database, the Claude Code documentation and Anthropic's Claude prompting guide, the Next.js, Vite, Django and Stripe documentation, Mozilla's bug-writing guidelines, Stack Overflow's guide to minimal reproducible examples, the NIST CSRC glossary, MITRE's CWE list, Aider's documentation, Simon Willison's writing on vibe coding, Andrew Nesbitt's post defining slopsquatting, Snyk Labs' research on Copilot, and Spracklen et al. (2024) on package hallucinations, Wang et al. (2024) on deprecated API use in LLM code completion and Wu et al. (2025) on AI-for-code security (reference only; no text copied)

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

Use of these pages is covered by our Terms of Use.