Exercise: Deploying AI-Generated and Vibe-Coded Apps Safely

function reviewGeneratedCode(code) {
  const findings = [];

  const keyPattern = /(sk-[a-zA-Z0-9]{20,}|api[_-]?key\s*[:=]\s*["'][^"']{10,}["'])/i;
  if (keyPattern.test(code)) {
    findings.push("Possible hardcoded API key found in code");
  }

  const callsExternalApi = /fetch\(|axios\.(get|post)/.test(code);
  const hasAuthCheck = /requireAuth|isAuthenticated|checkAuth|session\.user/.test(code);
  if (callsExternalApi && !hasAuthCheck) {
    findings.push("Route calls an external API but has no visible auth check");
  }

  const leaksStack = /res\.(send|json)\(\s*\{?\s*.*err(or)?\.stack/.test(code);
  if (leaksStack) {
    findings.push("Error handler sends the raw stack trace to the client");
  }

  const hasCatch = /catch\s*\(/.test(code);
  if (callsExternalApi && !hasCatch) {
    findings.push("External API call has no error handling");
  }

  const hasTimeout = /timeout|AbortController/i.test(code);
  if (callsExternalApi && !hasTimeout) {
    findings.push("External API call has no timeout configured");
  }

  return findings.length
    ? findings
    : ["No red flags found - safe to proceed to preview deploy"];
}

const riskySnippet = `
const OPENAI_KEY = "sk-abcdefghijklmnopqrstuvwx1234567890";

app.post("/api/chat", async (req, res) => {
  const response = await fetch("https://api.openai.com/v1/chat/completions", {
    headers: { Authorization: \`Bearer \${OPENAI_KEY}\` },
    method: "POST",
    body: JSON.stringify(req.body),
  });
  const data = await response.json();
  res.json(data);
});
`;

const cleanSnippet = `
app.post("/api/chat", requireAuth, async (req, res) => {
  const controller = new AbortController();
  const timeoutId = setTimeout(() => controller.abort(), 8000);
  try {
    const response = await fetch("https://api.openai.com/v1/chat/completions", {
      headers: { Authorization: \`Bearer \${process.env.OPENAI_API_KEY}\` },
      method: "POST",
      body: JSON.stringify(req.body),
      signal: controller.signal,
    });
    const data = await response.json();
    res.json(data);
  } catch (err) {
    res.status(500).json({ error: "Something went wrong. Please try again." });
  } finally {
    clearTimeout(timeoutId);
  }
});
`;

console.log("Risky snippet findings:");
console.log(reviewGeneratedCode(riskySnippet));

console.log("\nClean snippet findings:");
console.log(reviewGeneratedCode(cleanSnippet));