Most beginners who learn full stack JavaScript today do not get stuck on syntax, because AI tools write the syntax. They get stuck on where the code runs, who can call it, and what the free plans allow.

The five mistakes below all sit in that gap. Each one is easy to make when AI writes most of your code. Each one is also easy to avoid once you know it exists.

Mistake 1: Putting a secret key where the browser can see it

In a Next.js app, any environment variable whose name starts with NEXT_PUBLIC_ is copied into the JavaScript that goes to every visitor. Variables without that prefix stay on the server.

So if an AI tool suggests renaming SUPABASE_SECRET_KEY to NEXT_PUBLIC_SUPABASE_SECRET_KEY to make an error go away, say no. The error will go away, and your secret will be public.

Supabase is clear about this. Its secret key should never go in a browser, a shipped app or source control. Its publishable key is safe to show, because it only reaches what Row Level Security allows.

What to do instead: before every deploy, search your project for NEXT_PUBLIC_ and read each name. If a name contains SECRET, SERVICE or PASSWORD, stop and move it back to the server.

Mistake 2: Checking login on the page, not in the action

A page can send logged-out users to the login screen. Beginners then think everything on that page is protected. It is not.

A Next.js Server Action can be called by a direct POST request, not only through your form. The Next.js data security guide says a login check on the page does not reach the actions inside it. Each action must check the user again.

Being logged in is also not enough. The action must check that this user owns the record. If it does not, a logged-in user can change the ID in a request and delete someone else's post.

What to do instead: in every action that changes data, check the user first and the owner second. If you use Prisma, this matters even more. Supabase's row-level rules do not apply to Prisma queries, so your own code is the only check.

Mistake 3: Accepting AI code you cannot read

AI tools can give you a working screen in minutes. The trouble starts when the screen works on your laptop and breaks for a real user.

A common case is a missing await. Without it, the next line runs before the database has answered. The bug often shows up somewhere else, which makes it slow to trace.

You do not need to write JavaScript from memory to catch this. You need to read it: variables, functions, async and await, imports and props. Read them well enough to say what each line of an AI change does.

What to do instead: before you accept a change, read the diff and say what changed in plain words. If you cannot, ask the AI to explain that part. Then check its answer against the official docs.

Mistake 4: Deleting a leaked key and thinking it is gone

New projects made with create-next-app add .env files to .gitignore, so Git skips them. Beginners undo this protection when they paste a key straight into code and push it to GitHub.

Deleting the key in the next commit does not remove it from the older commits. GitHub's own guide says the first step is to revoke or rotate the secret. That means making a new key and turning off the old one.

What to do instead: run git status before every commit and read the list of files. If a key ever reaches GitHub, rotate it the same day. That goes for a Supabase key and for a Khalti or eSewa sandbox key too.

Mistake 5: Not reading the rules of the free plans

The free plans of Vercel and Supabase are good enough to learn on and to show your work. They come with two rules that beginners miss.

First, Vercel's Hobby plan is for personal, non-commercial use only. Its fair use guidelines call it commercial when you are paid to create, update or host the site, or when the site takes payments. So a site you build for a shop in Kathmandu needs a paid plan or another host. That cost belongs in your quote.

Second, Supabase pauses a free project that shows low activity over seven days. It sends a warning email about a week before. A paused project can be restored, but an employer who opens your demo on the wrong day sees a broken app.

What to do instead: use your demo app, or open the project in the Supabase dashboard, at least once a week. Do it again the week before you send your CV anywhere.

What can I do tonight to start?

Apply for your free personal .com.np domain. The registry's guide says a personal domain must be based only on your name, as written on your citizenship, passport, driving licence or other listed ID. Approval is not instant, so start now. It will be ready when you have an app to put on it.

Then read the Auditing list at the end of the Next.js data security guide. It is short, and it is a checklist for the same kind of mistakes as numbers 1 and 2.

How we teach these five points

Saarathi Academy in Old Baneshwor, Kathmandu teaches all five inside Full Stack Development with Vibe Coding. Week 2 spends about three hours on reading JavaScript and TypeScript, including async and await. Week 3 adds a check for the logged-in user on every Prisma query. Week 5 is a security checklist every build must pass before it goes live on your own domain. Week 6 covers scoping and quoting a small client build, with hosting in the quote.

Classes run in person and online, with up to 10 students in the classroom per batch. The full week-by-week plan is in the syllabus, and the rest is on the course page.