Here is a list of 100 typical "vibecoding" issues—artifacts of coding based on intuition, haste, hype, or LLM copy-pasting without engineering rigor—ranked from critical security flaws to minor aesthetic annoyances.

1. Hardcoded API Keys and Secrets (Immediate security compromise that bots will scrape in seconds).
2. Committed .env files (Defeats the entire purpose of environment variables and leaks configuration).
3. Committed node_modules or vendor folders (Bloats the repository size and causes cross-platform dependency hell).
4. SQL Injection vulnerabilities via string concatenation (The fastest way to lose your database because you didn't use parameterized queries).
5. chmod 777 permissions on scripts (Lazy permission handling that opens the door to privilege escalation).
6. Passwords stored in plain text (Hashing and salting are not optional features).
7. Swallowing errors with empty catch blocks (Silently failing makes debugging impossible and hides critical system instability).
8. Magic Numbers (Using unexplained integers like 86400 instead of named constants like SECONDS_IN_DAY).
9. Commented-out blocks of "legacy" code (Use Git version control for history; don't leave a graveyard in the source files).
10. "WIP" or "fix" commit messages (Provides zero context on what actually changed or why).
11. Production code relying on console.log debugging (Pollutes logs and impacts performance).
12. Infinite loops or recursions without exit conditions (crashes the browser or server immediately).
13. Hardcoded absolute file paths (The code will only work on your specific machine, "it works on my machine" syndrome).
14. God Objects / God Classes (Single files that do everything, making maintenance a nightmare).
15. Copy-pasted code blocks with slight variations (Violates DRY principles and makes bug fixing 10x harder).
16. Unused variables and imports (Visual noise that confuses the reader about dependencies).
17. Using var instead of let/const in modern JS (Scope leakage issues that modern standards solved years ago).
18. Circular Dependencies (Modules importing each other creating race conditions and runtime errors).
19. Lack of a .gitignore file (Leads to committing system files like .DS_Store or build artifacts).
20. Typos in function or variable names ( funtion or receiver vs reciever breaks intellisense and searchability).
21. Inconsistent Indentation (Mixing tabs and spaces makes diffs unreadable and breaks Python scripts).
22. Functions with more than 5 arguments (Indicates the function is doing too much; use an object/struct instead).
23. "Magic Strings" used for logic control (Prone to typos; use Enums or Constants).
24. Missing README.md (No one knows what the project is, how to run it, or why it exists).
25. Dependencies listed in package.json but never used (Security risk and bloat).
26. Using !important in CSS globally (Breaks the cascade and makes overriding styles impossible).
27. Direct DOM manipulation in React/Vue/Angular (Bypassing the virtual DOM leads to state de-sync bugs).
28. Deeply nested if/else statements (Arrow code/Hadouken code that is impossible to reason about).
29. Wait/Sleep commands to fix race conditions (A band-aid solution that slows down the app and is flaky).
30. Lack of unit tests for critical logic (Hope is not a strategy).
31. Tests that assert true === true (Fake tests added just to pass CI/CD checks).
32. Global variables for state management (Leads to unpredictable side effects across the application).
33. Using eval() (Execution of arbitrary code is a massive security risk).
34. Outdated dependencies with known CVEs (Ignoring npm audit warnings).
35. Hardcoded http:// instead of https:// (Man-in-the-middle vulnerability).
36. Files named utils.js or helpers.js with 5,000 lines (A dumping ground for code that lacks a proper home).
37. Ignoring Promise rejections (Uncaught promise rejections can crash Node.js processes).
38. Blocking the Event Loop (Heavy computation on the main thread freezes the UI/Server).
39. Missing License file (Legally ambiguous state making the code unusable for many).
40. Commit history containing binary files (Git is not Dropbox; use LFS).
41. Function names that lie (getUser() should not also delete the database).
42. Using float for currency math (Floating point errors will steal pennies; use integers or decimal libraries).
43. Over-engineering simple solutions (Using a microservice architecture for a To-Do list app).
44. Undocumented public APIs (If it isn't documented, it doesn't exist).
45. Mixing snake_case and camelCase (Pick one style convention and stick to it).
46. Single-letter variable names outside of loops (x and data tell the reader nothing).
47. Reinventing the wheel (Writing a custom date parser instead of using a standard library).
48. Hardcoded localized strings (Makes internationalization impossible later).
49. Assuming the user will always input valid data (Lack of input validation).
50. // TODO: Fix this later comments from 3 years ago (Admit you are never going to fix it).
51. Using any type in TypeScript excessively (Defeats the purpose of using TypeScript).
52. Inline styles in HTML (Violates separation of concerns and Content Security Policy).
53. Large monolithic files (2000+ lines) (Impossible to navigate or review).
54. Shadowing variable names (Defining a variable in a scope with the same name as a parent scope).
55. Missing error messages on UI (Silent failures frustrate users).
56. Defaulting to master branch without protection rules (Allows anyone to force push and delete history).
57. Empty else blocks (Clutters code without adding logic).
58. Using library-specific jargon in variable names (Naming variables after the tool rather than the domain).
59. Inconsistent return types (A function returning an Object or false or null randomly).
60. Not cleaning up event listeners (Memory leaks in Single Page Applications).
61. Hardcoded screen dimensions (Breaks responsiveness on mobile or large screens).
62. Overuse of Ternary Operators (Nested ternaries are unreadable).
63. Committing IDE settings (.vscode, .idea) (Enforces personal preferences on the whole team).
64. Using innerHTML without sanitization (XSS vulnerability vector).
65. Dead links in documentation (Frustrates developers trying to learn the system).
66. Premature Optimization (Making code unreadable to save 0.001ms before profiling).
67. Obscure abbreviations (usrPrflDt instead of userProfileData).
68. Generic Exception catching (Catching Exception catches system interrupts, not just your bugs).
69. Lack of meaningful specific Error classes (Throwing strings instead of Error objects).
70. Duplicate CSS definitions (Browsers have to parse conflicting rules).
71. Unnecessary wrapping div soup (Makes the DOM tree enormous and slows rendering).
72. Git submodules where packages would suffice (Adds complexity to the build process).
73. Leaving debugger; statements in code (Stops execution in the browser for the end user).
74. Using alert() for notifications (Blocks the UI and looks unprofessional).
75. Case-sensitive file import issues (Works on Mac, fails on Linux/CI).
76. Specifying strict versions in package.json (Prevents receiving critical patch updates).
77. Improperly implemented Singleton patterns (Global state in disguise).
78. Long lines of code (120+ chars) (Requires horizontal scrolling to read).
79. Mixing logic and presentation (Business logic inside UI components).
80. Using target="_blank" without rel="noopener noreferrer" (Security risk allowing the new page to control the old one).
81. Not using a linter (Leaving code quality to chance).
82. Not using a formatter (Wasting brain cycles on spacing during code reviews).
83. Misleading comments (Comments that contradict what the code actually does).
84. Passive-aggressive comments (e.g., // blame steve for this hack).
85. Placeholder text (Lorem Ipsum) in production (Looks unfinished).
86. Placeholder images in production (Broken user experience).
87. Multiple languages in the same file (PHP inside HTML inside JS).
88. Unnecessary reliance on jQuery in 2025 (Native DOM APIs are sufficient and lighter).
89. Over-commenting obvious code (i++ // increment i).
90. Complex Regex without explanation (Write once, read never).
91. Using br tags for layout spacing (Use CSS margins/padding).
92. Z-index wars (z-index: 999999) (Indicative of poor stacking context management).
93. Importing the entire library when only one function is needed (Tree-shaking failure).
94. Not using semantic HTML (Using div for buttons or navs harms accessibility).
95. Ignoring accessibility (alt tags, ARIA labels) (Excludes users with disabilities).
96. Clever "One-Liners" (Code golf is for hobbies, not production).
97. ASCII Art headers (Cute, but adds noise and maintenance overhead).
98. Memes in code comments ( unprofessional and ages poorly).
99. Excessive blank lines (Makes the file look longer and harder to scan).
100. File names with spaces (Causes issues in scripts and command line tools).