Vibe-Coding 101: Secure Your Applications (Part 2)

"Vibe-coding" feels great until you get an invoice for $5,000 because a bot found your API key. In Part 1, we covered secrets and authentication. In Part 2, we’re looking at the "invisible" holes that AI often overlooks: your repository settings, your dependencies, and your traffic limits.

1. Master the .gitignore

Bots are scanning GitHub and GitLab 24/7, specifically looking for `.env` files. If you push your secrets to a public repository, they are compromised within seconds.

• The Risk: When you ask an AI to "set up a project structure," it might create the files for you, but it won't always remind you to ignore them. It’s easy to `git add .` and accidentally upload your production database password.
• The Solution: Your `.gitignore` file is your first line of defense. Ensure `.env`, `nodemodules`, and `.DSStore` are always listed. Before every commit, run `git status` to see exactly what is being staged.

2. Don’t Let AI Give You "Legacy" Problems

AI models have a knowledge cutoff. If you ask an AI to "install a library for image processing," it might suggest a package that was popular three months ago but is now full of unpatched security vulnerabilities.