A pre-commit checklist for AI-written code

AI coding agents are fast. They are also confident when they should not be. Before you commit a change an agent wrote, walk this list. It takes a few minutes. Skipping it is how API keys, missing auth checks and "tidied" files land on main.

1. Secrets and public env

• No API keys, tokens or passwords in source, comments or test fixtures.
• No secrets in NEXT_PUBLIC_, VITE_, REACT_APP_ or other client-exposed prefixes.
• .env files that hold secrets are gitignored; only .env.example with placeholders is tracked.

2. Auth and tenancy

• Every new or changed API route / server action checks the caller.
• Record access is scoped to the signed-in user (or their org). A working 200 for the wrong user is a bug, not a feature.
• Failed auth returns 401/403/404 as your project already does — do not invent a new pattern mid-PR.

3. Scope creep

• Diff only touches files needed for the request.
• No drive-by renames, reformats or "while I was here" refactors of working code.
• No new dependencies unless you asked for them (and you know the license).

4. Behaviour and tests

• You can explain the change in one or two sentences.
• Existing tests still run; new behaviour has a test if your repo expects one.
• The agent did not "fix" a failing test by deleting or skipping it.

5. Commands you actually ran

• Install / migrate / seed only if required — and you know what they did.
• Lint and the project's usual test command passed on your machine.
• App still boots locally for the path you changed.

6. Git hygiene

• Commit message describes the user-facing change, not "update files".
• No --force to shared branches, no rewriting published history, no committing node_modules or build artefacts.

A short version you can paste into AGENTS.md

## Before you say done
- No secrets in source or client env prefixes.
- Auth checked on every sensitive path; data scoped to the caller.
- Smallest diff; no unrelated refactors or new deps unless asked.
- Real tests run; do not skip or delete failing tests to go green.
- Report what you changed, what you ran, and what you did not verify.

That block is in the free vibe-coding-rules-starter (AGENTS.md plus a 10-point security checklist under checklists/). Copy it into your repo so the agent sees the bar before it claims finished.

If you want the fuller kit (stack packs, installer, more prompts), it lives on Etsy as the Vibe Coding Rules Kit. The checklist above is enough to stop most of the expensive mistakes on its own.

Habit that helps

Treat "the agent said it works" as a claim, not a result. Your pre-commit checklist is the review. Two minutes now beats an incident later.