Vibe coder builds 20 Gemimi-guided safeguards for AI receptionist app

The author is upfront about not being an engineer, and that perspective shapes the whole account. The project was built for the 5th Agentic AI Hackathon with Google Cloud, where the app—an AI receptionist avatar that greets and sees off visitors on medical and corporate websites—was created entirely through vibe coding. The turning point came when 32 3D avatars vanished from the screen because an external service stopped, leaving the reception area empty. That scare, along with smaller incidents like a key written into the README and Cyrillic characters mixing into a key, pushed the author to treat security as something to build into the system rather than remember to do. Working with Gemini as a security advisor, the author ended up with 20 safeguards split between system design (#1–#16) and lessons from real mishaps (#17–#20). The through-line is a shift from relying on the AI's own judgment to placing deterministic code around it: blocking emergency inputs before they reach the LLM, forcing source citations to come from a registered list, and distinguishing permission errors from 'no data' so users are not misled. For a non-engineer, the final check is simpler—open the app on the same device and in the same way a user would, and look with your own eyes.