The 10-Minute Security Check

End-of-lesson check

15 questions · take it digitally for instant feedback at tendril.neural-forge.io/learn/quiz/end-vibecoder-security-checklist-lite

1. A developer asks an AI to 'make this app secure.' What does the lesson recommend doing first?

   1. Run multiple AI tools simultaneously to compare results
   2. Ask the AI to generate a comprehensive security report
   3. Skip the planning phase since AI handles security automatically
   4. Define the specific security job before selecting a tool or prompt

2. When reviewing AI-generated code, what does 'smallest useful scope' refer to?

   1. Completing the smallest security task that provides meaningful protection
   2. Using the minimum number of security tools available
   3. Writing the shortest possible code regardless of functionality
   4. Limiting the app to only one user at a time

3. Why should security testing be done 'as a user, not as a fan of the tool'?

   1. AI tools only work when complimented during the development process
   2. Developers should never test their own code for security issues
   3. Users have more technical knowledge than developers about security
   4. Testing as a user reveals how the app behaves when someone tries to abuse it, not just when it works correctly

4. Which three areas does the lesson specifically list as part of a pre-deployment security check?

   1. User interface, database speed, and API documentation
   2. File uploads, admin routes, and network latency
   3. Authentication, database policies, and color scheme
   4. Authentication, secrets management, and file uploads

5. What is the 'diff' that should be inspected during security review?

   1. The difference between the app's current and previous versions
   2. The network traffic difference between local and production
   3. The difference between the AI's training data and actual code
   4. The visual difference between light and dark mode

6. What does it mean for a deployed feature to be 'observable'?

   1. The feature has a visible user interface
   2. The feature responds quickly to user requests
   3. The feature generates logs that show who accessed what and when
   4. The feature can be seen by all users on the internet

7. What does the lesson mean by saying a security change should be 'reversible'?

   1. The change automatically reverts after 24 hours
   2. The change requires no user action to implement
   3. The change only affects temporary data
   4. The change can be undone if it breaks functionality or introduces vulnerabilities

8. Why are admin routes particularly risky in web applications?

   1. They provide privileged access that regular users should never reach
   2. They consume more server resources than regular routes
   3. They are visually ugly and hurt user experience
   4. They cannot be cached by browsers

9. What problem does rate limiting primarily prevent?

   1. Slow page loading times
   2. Database storage limits being reached
   3. Automated attacks that overwhelm services with requests
   4. Users from accidentally submitting forms twice

10. When reviewing database policies, what should be the primary concern?

    1. Whether users can access only the data they're authorized to see
    2. The color of the database management interface
    3. Database speed and query optimization
    4. How many tables the database contains

11. In the context of AI-generated apps, why are 'secrets' a security concern?

    1. AI always generates ugly secret URLs
    2. AI cannot keep secrets from users
    3. Secrets slow down application performance
    4. Secrets like API keys and database passwords can be accidentally included in code that gets shared

12. What security risk is unique to file upload features in web applications?

    1. File uploads always crash the database
    2. Uploaded files are automatically visible to everyone
    3. Users might upload executable code that runs on the server
    4. Uploaded files cannot be downloaded

13. What is the 'failure path' in security testing?

    1. The route users take when the website is down
    2. The process of deleting user accounts
    3. What happens when a user tries to access something they shouldn't
    4. The code path that runs when the application crashes

14. Why should public pages be checked for security issues even though anyone can see them?

    1. Public pages cannot have security issues
    2. They might contain hidden admin links or exposed debugging information
    3. Public pages are not important for security
    4. Security testing on public pages wastes time

15. What does it mean that 'AI optimizes for it works unless you ask for it cannot be abused'?

    1. AI automatically blocks all potential attacks
    2. AI can only work with paid security tools
    3. AI deliberately creates insecure code
    4. AI defaults to making functional code, not secure code — security must be explicitly requested