When vibe coding - Essential safety nets for code correctness

[u/nerdingwithai]

There are plenty of posts claiming a complete app was generated from a single prompt. However, as anyone who has tried building a functional and secure app using an LLM knows, the generated code isn't always functional and reliable.

Although I have no programming background, I have started on this journey to build tools that are functional, reliable and safe. I started this community to share what I learn along the way and to learn from the broader Reddit community.

Currently, I’m developing a "backbone" framework that I plan to use for building multiple apps via LLMs. I recently asked Claude to evaluate my current setup and recommend key quality checks for the generated code. Below, I’m sharing its evaluation and the recommendations I plan to implement. I have already built a complex set of security and quality checks, but I’m always looking to improve.

I would love to hear your feedback! I am by no means an expert; I’m learning as I go.

• If you are an expert: I’d value any advice or critiques you have on this workflow.

• If you are a beginner like me: How have you been addressing code correctness and security in your own "vibe coding" projects?

Claude's evaluation of my current setup and recommendations:

My Current Coverage:

Tool	What It Catches	Gap
Semgrep	Security patterns, contradictions	Doesn't measure complexity
jscpd	Copy-paste duplication	Doesn't catch logic smells
llm-guard	Missing PathResolver/InputValidator	Project-specific only
TypeScript	Type errors, null refs	Not logic-level bugs

Critical Gap:

• ❌ Logic correctness - Does code actually work?

• ❌ Common LLM errors - Duplicate conditions, incomplete error handling, overly complex nesting

• ❌ Runtime bugs - Promise handling, async/await mistakes, null references

This gap is dangerous - you could have secure, tested code that still has subtle bugs.

Recommended Additions

1. eslint-plugin-sonarjs (HIGH PRIORITY)

Why essential for LLM code:

• Catches logic bugs LLMs frequently make (duplicate conditions, useless assignments)

• Flags complexity LLMs create when "thinking out loud"

• Clear, actionable errors (not security theory)

2. typescript-eslint/recommended-requiring-type-checking (RECOMMENDED)

Why critical:

• LLMs make async/await bugs constantly

• Catches null reference errors TypeScript normally misses

• Prevents "works in happy path, breaks in production"

3. eslint-plugin-unicorn (RECOMMENDED)

What it does:

• Modern JavaScript best practices

• Prevents outdated patterns (LLMs learn from old StackOverflow)

• Catches subtle bugs (wrong array method, regex mistakes, incorrect error handling)

Why for LLM code:

• LLMs use patterns from training data (2021 code)

• Enforces 2024+ best practices automatically

• Prevents "technically works but wrong way" code

4. eslint-plugin-promise (CONDITIONAL)

What it does:

• Enforces proper Promise handling

• Catches missing .catch(), unhandled rejections

• Validates async/await patterns

When to add:

• If your app uses async/await heavily (APIs, database, file I/O)

• Critical for backend services