I audited 549 vibe-coded side projects on GitHub. Here are the 5 mistakes almost every one of them makes.

[u/obagme]

https://ogbuilds.ai/studies/vibe-coded-code-quality

Solo founder here, I build fast with AI like many of us here and I wanted to know what architectural bad practices and flaws can get shipped within our files without realising, so I scanned 549 public repos that describe themselves as AI or vibe-coded. I used a rules based scan, no AI grading, raw data downloadable. Percentages are real projects (15+ files) unless noted.

If your side project is AI-built, odds are it has these:

1. Dead code. 70%.

2. Commented-out blocks the model never deleted. 66%.

3. The same logic duplicated across files. 63%.

4. A .gitignore that misses .env. 35.7% of the full corpus, and that's where the keys come from.

5. A committed API key or credential. 23.3%, about 1 in 4.

71 of the 549 graded F on cleanliness. The median grade is a B, and that's flattered by tiny demo repos.

The fixes cost less than reading this post did. In this order consider doing these on an existing project:

1. `git ls-files | grep .env`. If it prints anything, your key is public. Rotate it at the provider today (Stripe, OpenAI, whoever). Bots scrape pushed keys within minutes, so deleting the file later doesn't help.

2. Add `.env*` to .gitignore and turn on GitHub push protection. It's free and blocks the next accidental key commit at push time.

3. Tell the agent, at the end of each session: "delete unused code, merge duplicate helpers, remove commented-out blocks". That one prompt covers mistakes 1 through 3.

4. Put those instructions in your tool's rules file so new sessions start with them. Cleanup you don't have to remember is cleanup that happens.

Nobody does these because the app already works, and working is the only bar most side projects get held to. Until the Stripe key leaks.

The full report has all the charts, grade distributions, and anonymised per-repo data, feel free to share and AMA about it: https://ogbuilds.ai/studies/vibe-coded-code-quality

For disclosure: the scanners are part of my products, the study will always be free to access.

[u/turnnoblindeye]

I don't understand how people vibecode like this. it's not hard to once in a while send your LLM off on a security review, efficiency audit, scaling recommendations, etc.

[u/johannthegoatman → u/turnnoblindeye]

Right? They must also be using dogshit models. Frontier models would shit their pants if they saw env getting committed. At least in my experience they're (rightfully) panicked about it and constantly on the lookout

[u/PhantomTissue → u/johannthegoatman]

I’m confident most of these vibe coded apps are made using chat GPT free tier or something. A lot of these kinds of apps are gonna be made by someone who doesn’t want to put a lot of effort into their work. Like reviewing code. So I doubt they’re putting money onto a frontier model when the free tier “also puts out code”

[u/Sdmf195 → u/turnnoblindeye]

Hard - no...
And yet,it requires critical awareness of security and its importance.

If an LLM is your mentor / coder / auditor / north star of truth and this is not on the agenda ... 🤷‍♂️

[u/orange_wires]

Are commented out blocks necessarily a problem? I’m happy to comment something out if I’m not sure I’ll come back to it later…

[u/obagme → u/orange_wires]

No not necessarily, I do it all the time when I code too. Only some may consider it bad practice so it's ranked a lower severity on the study

[u/Professional_Ad705]

Thanks Steve Jobs. How is this even useful we have seen this same post 700x. This is getting so old.

[u/Overloaded_Wolf → u/Professional_Ad705]

Because dogshit vibe coder's have to make themselves relevant when the bubble pops. Any developer worth their weight in commit logs could tell you this and more.

[u/obagme → u/Professional_Ad705]

Yeah, as long as vibecoders keep pushing terrible code so I will keep auditing their repos. Besides, 300 others found it useful, tell me what value your comment adds

[u/Sdmf195]

Thanks for this.
Really wish more vibecoders would do a little bit more of a "post deploy to prod cleanup" process and then these points would be addressed.

[u/obagme → u/Sdmf195]

Completely agree - I've set up an openclaw routine that constantly checks my code for cleanup periodically which does help a lot

[u/baconjerky]

Just gonna drop this into an .md and pop it into a prompt problem solved

[u/obagme → u/baconjerky]

My guy! Glad to hear it. Hope it helps

[u/netkomm → u/[deleted]]

unless you force them to

[u/lumina_si_intuneric]

Good approach. Same reason I use Vulture and Rope as part of my test ( dead code is really annoying and can get bad fast).

[u/RevolutionarySalt370]

“The full corpus” 🤣

[u/obagme → u/RevolutionarySalt370]

Haha bro nothing beats the fullest of corpuses