"I've fixed the login!" says the AI. Maybe. The diff, the list of exactly what changed, is how you check instead of hoping.
The AI said: "I fixed the login bug"
Read what it did before you say thanks. Tap the changed lines. There are 3 you should ask about — found 0.
Red lines were removed, green lines were added. You don't need to know the language — read each green line as a sentence and ask "what does this do, and did I want it?"
You don't have to write code to vibe code. You do have to read it, and reading a change well takes three questions, not a degree.
Tap the changed lines in the diff above. You're not judging whether the code is elegant; you're checking three things any careful person can spot, no syntax knowledge required.
The review ask matters too
Two review prompts on the same change, answered by Claude, via Claude Code (26 Sep 2026). Verbatim, trimmed with ….
does this login code look ok?
Yes, this looks like a reasonable login handler — it checks the password and returns a session. …worseA reassuring answer that tells you nothing you can act on.
list every line that logs, sends, or stores user data, and flag anything a user shouldn't see
1. Line 3 logs `password` to the console — a secret in plain text; remove it.
2. Line 7 stores the session token — fine, but set it HttpOnly.
…betterNow it audits instead of reassures — and finds the logged password.
What changed: “Looks ok?” invites a yes. “List every place this touches user data” invites an audit. Ask for the audit.
The three questions, in order: (1) Does it touch secrets? A password or key printed to a log is the classic AI slip, see API keys in the browser. (2) Did it do more than you asked? Extra "helpful" changes are where surprises hide. (3) Did it change what data is saved or shown, and to whom?
Try it with the rules off. In the diff reader above, find the line that prints a password to the log. It's the single most common thing an AI adds “to help debug” that must never ship.
Check yourself
0/4 got itSaved on this device only. No account, no streaks.
Next in talking to it well: When to start over vs fix.
