Vibe Coding — Practice Questions flashcards

6 of 60 questions free to study here · 18 topics · the whole deck is built into Willys

Multiple-choice practice questions, one best answer each, on the AI build loop, prompts and context, git safety nets, secrets, HTTP status codes, APIs, CORS, reading errors and security basics.

Get the app All Vibe coding decks

Practice deck · part of Vibe coding · written against: Building software with AI assistants: workflow, prompting, git, web basics, debugging and security; tool-neutral. Updated 2026-10-10.

Study the free sample

6 questions from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 6 sample questions as a list

Your AI-built club website now needs members to sign up with an email and a password. What is the safest way to add accounts?

A) Store the passwords in a private spreadsheet the app reads
B) Have the AI encrypt passwords with a scheme it designs
C) Have the AI write its own password table and login check
D) Use an established authentication service or library

D) Use an established authentication service or library

An established authentication service or library typically handles password hashing, resets and common attacks that home-made code tends to get wrong. A password system the AI invents for you is exactly the hand-rolled approach to avoid.
Where It Fits › Risky Territory
Which is the most useful "done when" line for a shopping-list feature?

A) Done when the AI reports that the feature is fully complete
B) Done when the list feels smooth and modern to use every day
C) Done when the code looks clean, tidy and well organized
D) Done when I can add an item, reload the page and still see it

D) Done when I can add an item, reload the page and still see it

A good done-when statement is checkable: you can do it and see whether it worked. "Feels smooth" and "looks clean" can't be verified, and the AI saying it finished is a claim, not evidence.
Writing a Spec › Constraints and Done-When
You asked the AI to fix a typo in a heading. The diff shows that fix plus the removal of a 40-line function in another file. What should you do?

A) Reject the typo fix but keep the deletion of the old function
B) Accept it now and check later whether anything stopped working
C) Ask why the function was removed and reject it if it's unrelated
D) Accept it all, since the AI was probably cleaning up unused code

C) Ask why the function was removed and reject it if it's unrelated

Code deleted that you didn't ask to remove is a red flag in any diff, so ask about it before accepting and undo edits that have nothing to do with the request. Accepting first means you approve changes you haven't looked at.
Reviewing AI Output › Reviewing Diffs
Your app works on your laptop, but the deployed copy says the API key is missing. What is the most likely fix?

A) Commit the .env file so the hosting platform receives it
B) Rename the key's variable to something shorter and simpler
C) Paste the key directly into the frontend JavaScript code
D) Set the key in the hosting platform's environment settings

D) Set the key in the hosting platform's environment settings

Your .env file was rightly left out of git, so the deployed app never got it; set the variable in the hosting platform's settings instead. Committing .env would push your secret into the repository's history.
Secrets and Configuration › Environment Variables
The browser console shows Cannot read properties of undefined (reading 'name'). What does this usually mean?

A) The code used a value that didn't exist, like data not yet loaded
B) The browser blocked the script from running for security reasons
C) The word name is reserved in JavaScript and can't be used here
D) The page ran out of memory and needs to be reloaded to continue

A) The code used a value that didn't exist, like data not yet loaded

The code tried to read name from something that was undefined: a missing field, a misspelled property name or data that hadn't loaded. Trace back where that value should have come from.
Reading Errors › Error Messages and Stack Traces
The AI builds a database query as "SELECT * FROM users WHERE name = '" + name + "'". What should you ask for instead?

A) The same query, but run from the frontend code instead
B) A longer query that also checks the user's email
C) The same query with the name turned to lowercase
D) A parameterized query that sends the name separately

D) A parameterized query that sends the name separately

Gluing user input into SQL text lets crafted input change the query itself (SQL injection). A parameterized query sends the values separately, so input is always treated as data.
Security Basics › Injection and XSS

Unlock the whole deck

You are studying a free 6-question sample. All 60 questions of Vibe Coding — Practice Questions, the other 5 Vibe coding decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More Vibe coding decks

Foundations Prompting and Context Git and Safety Nets Web Basics for Builders Debugging and Security

← All Vibe coding decks, with the study guide and topic outline.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

Checked against MDN Web Docs (CC BY-SA 2.5), the Git documentation, GitHub Docs (CC BY 4.0), the OWASP Cheat Sheet Series (CC BY-SA 4.0), RFC 9110 and RFC 6585, the Python documentation (PSF License), the Claude Code documentation, the Chrome DevTools documentation (CC BY 4.0), Google's Engineering Practices and C++ Style Guide (CC BY 3.0), PortSwigger's Web Security Academy and Simon Willison's writing on vibe coding (reference only; no text copied).
Original questions written for this deck; no official, textbook or question-bank items were copied.

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

Use of these pages is covered by our Terms of Use.