A series
Stuff Vibe Coders Should Know About
The things AI-built apps get wrong, one at a time: what each is, how vibe-coded apps get it, a 60-second check, the fix as a prompt to your agent, and how Portfall handles it.
0 of 250 published so far.
Season 1: Security basics
- SQL Injection
- XSS
- CSRF
- CORS
- SSRF
- IDOR
- Path Traversal
- Mass Assignment
- Clickjacking
- Content Security Policy
- Security Headers
- Input Validation
- Server-Side Authorization
- Row-Level Security
- Least Privilege
- RBAC
- Secrets Management
- .env in .gitignore
- API Key Rotation
- Secret Scanning
- Hashing vs Encryption
- Password Salting
- bcrypt & Argon2
- JWT Expiry
- Refresh Tokens
- OAuth 2.0
- OpenID Connect
- Session Fixation
- MFA
- Brute Force Protection
- Account Enumeration
- Timing Attacks
- File Upload Validation
- Webhook Signature Verification
- TLS Certificate Expiry
- HSTS
- Encryption at Rest
- Dependency Vulnerabilities
- Supply Chain Attacks
- Threat Modeling
Season 2: Databases
- Indexes
- EXPLAIN ANALYZE
- N+1 Queries
- Full Table Scans
- Connection Pooling
- Database Migrations
- Down Migrations
- Transactions
- ACID
- Isolation Levels
- Deadlocks
- Optimistic Locking
- Pessimistic Locking
- Normalization
- Denormalization
- Foreign Keys
- Unique Constraints
- Cascading Deletes
- Soft Deletes
- UUIDs vs Auto-Increment
- Cursor-Based Pagination
- Full-Text Search
- Read Replicas
- Replication Lag
- Sharding
- Partitioning
- Hot Partitions
- Postgres VACUUM
- Materialized Views
- Backups
- Testing Your Restores
- Point-in-Time Recovery
- Change Data Capture
- Outbox Pattern
- ORM Lazy Loading
Season 3: Distributed systems
- CAP Theorem
- Eventual Consistency
- Strong Consistency
- Raft Consensus
- Leader Election
- Split Brain
- Quorums
- Clock Skew
- Distributed Locks
- Consistent Hashing
- Bloom Filters
- Two-Phase Commit
- CQRS
- Event Sourcing
- Race Conditions
- Backpressure
- Load Shedding
- Bulkheads
- Jitter
- Retry Storms
- Cascading Failures
- Thundering Herd
- Cache Invalidation
- Cache Hit Ratio
- TTLs
- Cache Warming
- Write-Through vs Write-Back
- Redis Eviction Policies
- CDNs
- Cache-Control Headers
- ETags
- Dead Letter Queues
- Poison Messages
- At-Least-Once Delivery
- Exactly-Once Semantics
- Message Ordering
- Kafka Consumer Groups
Season 4: Networks and APIs
- DNS
- DNS Propagation
- HTTP Status Codes
- HTTP Method Semantics
- Keep-Alive
- HTTP/2
- WebSockets
- Server-Sent Events
- Long Polling
- gRPC
- Protocol Buffers
- API Versioning
- OpenAPI Specs
- Backward Compatibility
- Request Size Limits
- Compression
- Latency vs Throughput
- Egress Fees
Season 5: Infrastructure and operations
- VPCs
- Subnets
- NAT Gateways
- Firewalls
- Security Groups
- Service Mesh
- Ingress Controllers
- Health Checks
- Liveness vs Readiness Probes
- Graceful Shutdown
- Connection Draining
- Stateless Services
- Failover
- Multi-Region
- Availability Zones
- Single Points of Failure
- Disaster Recovery
- RTO & RPO
- SLAs
- SLOs
- Error Budgets
- Incident Response
- On-Call
- Runbooks
- Postmortems
- Chaos Engineering
- Graceful Degradation
- Autoscaling
- Horizontal vs Vertical Scaling
- Cold Starts
- Capacity Planning
- Load Testing
- Memory Leaks
- OOM Killer
- Structured Logging
- Log Levels
- Log Rotation
Season 6: Testing and correctness
- Unit Tests
- Integration Tests
- End-to-End Tests
- Contract Testing
- Flaky Tests
- Mocking
- Regression Tests
- Smoke Tests
- Property-Based Testing
- Fuzzing
- Error Handling
- Edge Cases
- Off-by-One Errors
- Floating Point Math
- Storing Money as Floats
- Time Zones
- Daylight Saving Time
- Unicode
- Character Encoding
- Thread Safety
- Event Loop Blocking
- Unhandled Promise Rejections
- Integer Overflow
- Garbage Collection
- Schema Validation
- Debouncing
- Big O Notation
- Technical Debt
- Dead Code
- Merge Conflicts
Season 7: Compliance and business
- GDPR
- PII Handling
- Audit Logs
- Data Residency
- SOC 2
- PCI DSS
- Cookie Consent
- Software Licenses
- SPF, DKIM & DMARC
- Email Bounce Handling
- Chargebacks
- Bot Protection
Season 8: Building with AI
- Prompt Injection
- Hallucinated Packages
- Real-time streaming
- Context Windows
- Evals
- Model Version Pinning
- Reading the maxed LOC Diff