Vibe coder or product engineer interview questions

As asked

You used an AI coding agent to build a settings page and API route in a day. What checks do you perform before you ship it?

Sample answer outline

The candidate should treat AI output as untrusted code that can still be useful. Run the app, read the diff, check data flow, auth, validation, loading states, empty states, errors, accessibility, and telemetry. Tests should cover the contract between UI and API, plus the riskiest edge cases the agent may have missed. Strong answers mention dependency review, secret handling, permission boundaries, and manual product review against the intended user workflow. The main tripwire is shipping because the page looks right once, without understanding what was generated.

Expect these follow-ups

• What kinds of bugs do coding agents most often introduce?
• How do you keep velocity without turning review into a full rewrite?
• What would make you throw away the generated code?

As asked

You are building a product dashboard in Next.js 14 with the App Router. Walk me through how you decide which components to keep as Server Components versus mark with 'use client', and what concrete problems arise when you get that boundary wrong.

Sample answer outline

Server Components run only on the server, so they can directly access databases and secrets without exposing them to the client bundle, but they cannot hold state or attach event listeners. The boundary mistake that bites most people is importing a 'use client' component from a Server Component that passes non-serializable props like functions or class instances, which throws a serialization error at runtime. A strong answer mentions that context providers must be Client Components, that you can pass Server Component output as children to a Client Component wrapper, and that mixing them carelessly inflates the JS bundle with code that did not need to ship.

Expect these follow-ups

• How does streaming with Suspense change your data-fetching strategy in the App Router?
• If a Server Component needs to share state with a Client Component, what are your options?

As asked

You have a Next.js page that lists 50 blog posts and each post shows its author name. You are using Prisma and your server logs show 51 queries on every page load. Walk me through exactly what is happening and how you fix it without switching ORMs.

Sample answer outline

The N+1 happens because the code fetches posts in one query and then, inside a loop, fires a separate findUnique for each post's author. The fix is to add an include or select on the initial findMany so Prisma does a JOIN or a batched second query and assembles the result in memory. A strong answer also mentions Prisma's fluent relation queries, the difference between include and select for shaping the payload, and enabling Prisma query logging or using prisma.$on to surface slow queries in development.

Expect these follow-ups

• How would you verify the fix actually reduced query count in production without adding a full APM tool?

As asked

You are adding an AI chat feature to your product. The LLM API supports streaming. Walk me through the full stack implementation from the API call to the user seeing tokens appear in real time, including how you handle errors mid-stream.

Sample answer outline

On the server you call the LLM with stream:true, pipe the response as a ReadableStream through a Next.js Route Handler with the correct content-type of text/event-stream, and flush chunks as SSE events. On the client you use the Fetch API with a ReadableStream reader or the Vercel AI SDK's useChat hook which handles reconnection and parsing. Error handling mid-stream is the tricky part: if the stream closes with an error event you need to surface that in the UI rather than silently stopping, and you should add a timeout so a stalled stream does not block the user indefinitely. A strong answer also mentions storing partial completions for resumability if the user refreshes.

Expect these follow-ups

• How would you rate-limit streaming endpoints to prevent abuse without killing legitimate long sessions?

As asked

Your team ships multiple times a day. Walk me through how you use feature flags to decouple deployment from release, and what flag hygiene problems build up over time when the team moves fast.

Sample answer outline

Feature flags let you merge code to main and deploy it dark while controlling who sees the feature by percentage rollout, user segment, or internal email. This means you can catch issues in production with real traffic before a full release. The hygiene problems are flag debt: old flags that were never cleaned up clutter conditional logic across the codebase, and nested flags create combinatorial test complexity. A strong answer names a tool like LaunchDarkly, Unleash, or even a simple database-backed flag store, discusses flag expiry conventions, and mentions that flags should be the outermost wrapping not buried deep in business logic.

Expect these follow-ups

• How do you test a feature that is behind a flag? Do you test both branches?

As asked

You are building auth for a new product. Walk me through the concrete tradeoffs between storing session state in a server-side store with a cookie versus using stateless JWTs, and when each breaks in production.

Sample answer outline

Server-side sessions are easy to revoke instantly by deleting the session record, but require a shared store like Redis when running multiple serverless instances so they are not truly stateless. JWTs are self-contained and scale without a shared store, but revoking a JWT before expiry requires a denylist which brings back the shared store you were trying to avoid. Short-lived access tokens plus refresh token rotation is the common production pattern: the access JWT expires in 15 minutes so you limit exposure, and the refresh token in an HttpOnly cookie can be revoked server-side. A strong answer also covers storing JWTs in HttpOnly cookies rather than localStorage to prevent XSS token theft.

Expect these follow-ups

• How does NextAuth.js handle token rotation and session invalidation under the hood?