Quality Gates & Security - Vibe Coding, Shipped Right

What You'll Learn

Automate consistency with a linter and formatter
Keep secrets out of code with .env and environment variables
Recognize the security holes AI assistants most often write
Add input validation — the cheapest, highest-value guard
Turn these checks into an automatic gate before code lands
Hands-on lab: add lint + format, fix a real security issue, and scan dependencies

Prerequisites: Module 6 — a tested snippet vault. This module leans on the DevOps Lab for the deeper security toolchain.

Linting & Formatting

AI writes code in whatever style it feels like this minute. A linter (ESLint) catches likely bugs and bad patterns; a formatter (Prettier) makes every file look identical. Together they end style debates and surface real mistakes automatically.

Tool	Catches
ESLint	Unused variables, unsafe patterns, likely bugs, banned APIs.
Prettier	Formatting — spacing, quotes, line length — applied uniformly.
Type checks (tsc)	Type mismatches before the code even runs.

One command, clean code

Wire up npm run lint and npm run format. Now "is this clean?" is a command, not an opinion — and the AI's output gets normalized to your standard every time.

Secrets Stay Out of Code

Security hole #1 in AI code: a hard-coded API key or password, cheerfully committed. Secrets belong in environment variables, loaded from a .env file that is never committed (your .gitignore from Module 4 already blocks it).

# .env  (gitignored — never committed)
DATABASE_URL=postgres://localhost/snippets
API_TOKEN=super-secret-value

# .env.example  (committed — documents the shape, no real values)
DATABASE_URL=
API_TOKEN=

Committed once = leaked forever

If a secret ever lands in a commit, it's in the Git history even after you delete it — assume it's compromised and rotate it. This is why the .env habit and secret scanning matter before you push, not after.

Holes AI Loves to Write

Assistants optimize for "makes the feature work," not "is safe." These are the usual suspects — learn to spot them in every diff:

Hole	Fix
No input validation (trusts anything the client sends)	Validate & sanitize every input at the API boundary.
SQL/command injection from string-built queries	Use parameterized queries / the ORM, never string concatenation.
Hard-coded secrets	Environment variables (above).
Over-permissive CORS (`*`) or missing auth checks	Restrict origins; verify permissions on every protected route.
Leaking internals in error messages	Return generic errors to clients; log details server-side.

Go deeper in the DevOps Lab

The full DevSecOps toolchain — dependency scanning, SAST, container scanning — is covered in the DevOps Lab. Here we build the habits and add the essentials to the vault.

Make It a Gate

A check you have to remember to run is a check you'll forget. Turn lint, format, tests, and secret scanning into an automatic gate — ideally a pre-commit hook now, and a CI check in Module 9 — so nothing substandard can land.

# the gate, as one script
npm run lint      # style + likely bugs
npm run format    # consistent formatting
npm test          # behavior still correct
npm audit         # known-vulnerable dependencies

Human review is still a gate

Automation catches the mechanical stuff; your diff review (Module 4) catches intent and logic. Keep both. The AI proposes; the gates and you dispose.

Practical Lab: Add the Gates, Fix a Hole

You'll add linting and formatting, move any secret to .env, add input validation to the create endpoint, and scan dependencies — fixing at least one real issue.

What you need

Your tested snippet-vault repo from Module 6.

1

Branch and add lint + format

git checkout -b feature/quality-gates

Ask the assistant to set up ESLint + Prettier with npm run lint and npm run format. Run them; review and commit the config and any auto-fixes.

2

Move secrets to .env

Find any hard-coded config (URLs, tokens). Move them to .env (gitignored) and add a committed .env.example. Confirm .env is not tracked: git status should never show it.

3

Add input validation

Add validation to POST /snippets: title required (non-empty, max 200),
language required, code max length. Reject invalid input with 400 and a
clear message. Add tests for the new validation rules.

Review the diff; run the tests; commit.

4

Scan dependencies

npm audit

Fix what's safely fixable (npm audit fix), and note anything left. Run your tests again to be sure nothing broke.

5

Merge and reflect

git add .
git commit -m "Add lint/format, env secrets, input validation"
git checkout main && git merge feature/quality-gates

In REFLECTION.md: which security hole did you actually find and fix, and where was a secret or unvalidated input hiding? Commit it.

What to hand in

Your snippet-vault repo. Self-check:

npm run lint passes; formatting is consistent
No secrets in code; .env is gitignored, .env.example committed
POST /snippets validates input, with tests
REFLECTION.md names the hole you fixed

Mini Glossary

Term	Plain meaning
Linter	A tool that flags likely bugs and bad patterns in code.
Formatter	A tool that rewrites code into one consistent style.
Environment variable	Config supplied outside the code, e.g. from `.env`.
Injection	Attacker input that becomes executable query/command.
Quality gate	An automatic check that must pass before code lands.

Recap & What's Next

You now have

Automated quality gates — lint, format, validation, secret hygiene, dependency scanning — plus a real fix to a real hole. Your AI-written code is now not just working and tested, but clean and safe.

Next up: Module 8 — Containerizing the App. We package the vault so it runs identically anywhere — killing "works on my machine" — with Docker and Compose, bridging straight into the DevOps Lab.