Steven Hernandez

Make your AI show receipts. 🔔 12 agent rules that kill fake "done"s, silent rewrites & leaked API keys — for Cursor, Claude Code & friends. Free rule ↓

[Steven Hernandez @vibereceipts]

tested my verify-claims rule on myself

told my agent: re-verify your last "done"

it went quiet

then admitted the login flow was never actually run

that admission is the product

[Steven Hernandez @vibereceipts]

@yourMOMSsidelad good catch — "deleting the file ≠ deleting the secret" is the lesson nobody learns twice.

adding the git-history check to the rule. thanks for sharpening it

[Steven Hernandez @vibereceipts]

the most common vibe-coded security bug isn't exotic

it's the API key your agent wrote into a file to "quickly test"

it's still there. in main. on a live deploy

my rule: never write secrets into files, scan every diff before "done", treat pasted keys as leaked

[Steven Hernandez @vibereceipts]

https://t.co/5Br75EFYmF

[Steven Hernandez @vibereceipts]

the rule repo: https://t.co/5Br75EFYmF
install verify-claims in your agent, then say:
"follow the rule — now re-verify your last 'done'"

watch it squirm

[Steven Hernandez @vibereceipts]

your AI coding agent said "done, everything works"

you: can you prove it?
it: ...

that gap — between confident claims and
unverifiable output — is where vibe-coded
projects die.

I wrote 12 rules that close it. first one's free: