AI fluency test

You need a rate limiter on an API route in your Next.js app. Which prompt gives the most reliable result?

Add rate limiting to my API routes. Keep it simple and secureYou are a world-class senior security engineer with 20 years of experience. Write a production-grade, battle-tested rate limiter that is secure against all attacks and explain every line of the code with commentsWrite a rate limiter that keeps a Map in memory, allows 5 requests per minute per IP, and returns 429 when exceededAdd rate limiting to the route handler below. We deploy serverless, so state cannot live in process memory. Limit per IP and per user, return 429 with Retry-After, and tell me what this will not stop

The AI's fix makes a failing test pass. Before you accept it, which question matters most?

Does the fix match the style of the rest of the codebase, and does it use the same naming and structure the AI used earlier?Did it fix the cause, or special-case the test input so the test passes?Is the fix shorter than the old code, and does it avoid adding extra helper functions or new files?Does the AI explain the fix clearly, and does the explanation match what the code actually does, line by line?

You paste a 600-line file and ask the AI to 'clean it up'. What is the most likely failure?

It changes behavior while 'improving' things, so you cannot tell what changed or whether it still worksIt deletes the comments but keeps the codeIt refuses because the file is too longIt adds several new dependencies

How do you get consistent code style from the AI across many prompts?

Repeat 'follow best practices' in every promptDescribe your style in the first message of each new chat, with a short list of rules and one sample file, and ask it to confirm it understood themKeep a short rules file (stack, naming, patterns to use and avoid) and include it each time, or use your tool's project-rules featureLet the AI pick a style, then ask it to stay consistent

The AI keeps calling a function that does not exist in the library you use. Which change helps most?

Add 'do not hallucinate' to the promptAsk it to double-check that every function exists and to list the import path for each one, so you can see where it thinks they come fromPaste the relevant docs or type definitions and tell it to use only what is in themSwitch to the largest model available

AI code calls `JSON.parse(userInput)` inside a try/catch that returns an empty object on error. What is the main problem?

JSON.parse is slow on large inputsBad input is silently turned into 'valid but empty' data, which hides errors and causes wrong behavior latertry/catch cannot catch JSON errorsIt never checks the shape of the parsed data, so valid JSON of the wrong type can still break things

AI code sends 500 emails with `emails.forEach(async (e) => await send(e))`. What is the likely issue?

It fires all 500 sends at once, which may hit the provider's rate limit, and some sends may fail, so you would want to batch them with a small delay between groupsforEach is deprecated and will be removedThe emails go out one at a time, which is very slowforEach does not wait for async callbacks, so the code moves on at once, failures go unhandled, and all sends start together

The AI wrote a Next.js Server Action that deletes a post by id from form data. What must the action check?

That the user is signed in AND allowed to delete that specific post, since anyone can call the action directlyThat the delete button is hidden from non-ownersThat the id is a numberNothing else, because Next.js already checks that the request came from your site, which blocks forged requests from other websites, so the action does not need any more checks

AI code stores the user's access token in localStorage to keep them signed in. What is the most accurate concern?

The token is sent with every request and ends up in server logslocalStorage is encrypted by the browser, so there is no issueIt is acceptable as long as the token expires within a few minutes, because a stolen token that is only valid briefly gives an attacker very little time to use itAny XSS bug lets a script read it. An HttpOnly, Secure cookie keeps scripts from reading the token

The AI rewrites a slow database query and the new one is faster. What should you verify before shipping?

That the new query is shorterThat it returns the same rows on a few sample inputsThat it returns identical results on real data, including nulls and edge cases, and is faster at realistic size, checked with the query planThat the AI says the two queries are equivalent

AI generates an upload endpoint that saves files under the original filename from the user. What is the main risk?

Large files will fill the disk, and a single user could use up all the storage and take the service down, so set a size limit per file and a total quota per accountPath traversal and overwriting, since a name like ../../app/config can write outside the upload folder. Generate your own name and validate type and sizeFilenames with spaces will break linksBrowsers block files with unusual names

AI generates a login that says 'No account with this email' or 'Wrong password' separately. Why change it?

The two messages let attackers find which emails have accounts. Use one generic message and similar response timeTwo messages confuse usersIt only matters if you do not also rate limit loginsIt is mostly a user experience issue and matters only for banking apps

AI code shows user comments with `dangerouslySetInnerHTML` after removing `<script>` tags. Is it safe?

Yes, script tags are the only way to run code in HTMLYes, React escapes everything anywayMostly, if you also strip onerror and javascript: from the text and run the check again after each replacement, so tricks that rebuild a tag from pieces are removed tooNo. Other vectors exist, like event handlers on images. Use a well-maintained HTML sanitizer or avoid raw HTML

A teammate asks the AI for an SQL query built with string interpolation and says 'I only accept numbers from a dropdown'. Best answer?

That is fine, a dropdown restricts the valuesThat is fine if you convert the value to a Number first, because a Number cannot contain quotes or SQL keywords, so injection is not possible through itStill use parameterized queries, because the dropdown is only front-end and requests can be changed or sent directlyEscape the quotes in the value

AI 'fixes' a browser CORS error with `Access-Control-Allow-Origin: *` and `credentials: true`. What is the real issue?

It is fine for public read-only data, but the credentials part is the problem. Fix it by moving the credentials to a header the browser does not send automatically, and keep the origin list shortBrowsers reject that combination, and the common workaround of echoing back any Origin lets any site make signed-in requests as your usersIt will slow the API downCORS only matters for mobile apps

Your project has a security alert for a dependency the AI added. What is the sensible response?

Wait for the maintainer to fix it, since it is their problemDelete the lockfile and reinstallUpdate to the newest version in production straight away, without testing, because a patched release is almost always safer than an old one, and waiting only adds riskCheck whether the vulnerable code path is used in your app, then update or replace the package, run tests, and redeploy

You and the AI have gone back and forth ten times on a bug, and each fix breaks something else. What is the best reset?

Revert to the last working commit, write a failing test that captures the bug, then ask for a fix using only the relevant code and that testAsk it to rewrite the whole module so the problem disappears, because a clean rewrite removes the layers of patches that caused the new bugs and gives you one clear starting pointSwitch models and paste the whole conversationAdd logging everywhere and paste all the output

How should you use AI when you do not understand a stack trace?

Paste it and apply the first fix it suggestsAsk it to remove the error by catching itPaste the trace plus the code near the failing line, ask for likely causes ranked with a way to confirm each, and confirm before changing anythingSearch only the error message on the web and skip AI

Your AI-powered feature worked in testing but fails randomly in production. What is the best first move?

Raise the temperature to explore more answersMake the prompt longerSwitch to a bigger model, since larger models handle odd inputs more gracefully and fail less often on cases the prompt did not cover, and the extra cost is usually smallLog real failing inputs and outputs (handling sensitive data carefully), look for patterns, and add them as test cases before editing the prompt

You want AI to refactor a large function safely. Which workflow is best?

Ask for the refactor, run the app once, and merge if it loadsWrite tests that lock in the current behavior first, refactor in small steps, and run the tests after each stepAsk the AI to write the new version and its tests together in one goRefactor the risky parts by hand and let the AI do the rest, without tests

Vibe Coding & Prompt Engineering

Prompting for code

Reviewing AI code

Security

Workflow and debugging

Vibe Coding & Prompt Engineering

Prompting for code

Reviewing AI code

Security

Workflow and debugging