I look at other people's code a lot. The security issues are always boring, that's the thing. API keys sitting in the client bundle, auth middleware missing half the routes. Not clever exploits, just nobody actually…
Half this list is bad attribution. LiteLLM was a supply chain attack — stolen PyPI credentials, nothing to do with vibe coding. The Amazon outage number comes from a vendor blog pushing their own product. Nobody else…
[dead]
Exactly. "Tests pass" and "code is secure" are just different things. AI code makes that gap worse. I run static analysis on mixed human/AI codebases. The AI parts pass tests fine but they'll have stuff any SAST tool…
They exist. Go look at any "I built this in a weekend with Cursor" post — there are hundreds. The problem is most of them ship broken and stay broken. Auth that doesn't actually check anything, API keys in the frontend,…
Sandboxes yes, but who even added the dependency? Half the projects I see have requirements.txt written by Copilot. AI says "add litellm", dev clicks accept, nobody even pins versions. Then we talk about containment…
[flagged]
Our security scanning runs on GitHub Actions — every PR gets checked before merge. When GitHub goes down, the security gate goes down with it. PRs pile up, devs get impatient, start merging without waiting for checks.…
250K lines in a month — okay, but what does review actually look like at that volume? I've been poking at security issues in AI-generated repos and it's the same thing: more generation means less review. Not just logic…
The testing angle keeps coming up but it's sort of missing the point. I spent a few weeks poking through public repos built with AI tools — about 100 projects. 41% had secrets sitting raw in the source. Not in env…
The version control angle is interesting. One thing worth thinking about — SOUL.md and SKILL.md are essentially prompt injections by design. They define what the agent does. If the ecosystem grows to where people fork…
Had basically the same thing happen. Posted in a side project sub, spam filter nuked it because new account. And in other subs now, anything that mentions AI gets hit with "vibecoded slop" automatically. Doesn't matter…
So I launched a dev tool last week. Figured I'd share what actually happened across different channels because most "launch retrospectives" are written by people who already had an audience. My Dev.to article got 42…
I look at other people's code a lot. The security issues are always boring, that's the thing. API keys sitting in the client bundle, auth middleware missing half the routes. Not clever exploits, just nobody actually…
Half this list is bad attribution. LiteLLM was a supply chain attack — stolen PyPI credentials, nothing to do with vibe coding. The Amazon outage number comes from a vendor blog pushing their own product. Nobody else…
[dead]
Exactly. "Tests pass" and "code is secure" are just different things. AI code makes that gap worse. I run static analysis on mixed human/AI codebases. The AI parts pass tests fine but they'll have stuff any SAST tool…
They exist. Go look at any "I built this in a weekend with Cursor" post — there are hundreds. The problem is most of them ship broken and stay broken. Auth that doesn't actually check anything, API keys in the frontend,…
Sandboxes yes, but who even added the dependency? Half the projects I see have requirements.txt written by Copilot. AI says "add litellm", dev clicks accept, nobody even pins versions. Then we talk about containment…
[flagged]
Our security scanning runs on GitHub Actions — every PR gets checked before merge. When GitHub goes down, the security gate goes down with it. PRs pile up, devs get impatient, start merging without waiting for checks.…
[flagged]
[dead]
[dead]
[flagged]
250K lines in a month — okay, but what does review actually look like at that volume? I've been poking at security issues in AI-generated repos and it's the same thing: more generation means less review. Not just logic…
The testing angle keeps coming up but it's sort of missing the point. I spent a few weeks poking through public repos built with AI tools — about 100 projects. 41% had secrets sitting raw in the source. Not in env…
The version control angle is interesting. One thing worth thinking about — SOUL.md and SKILL.md are essentially prompt injections by design. They define what the agent does. If the ecosystem grows to where people fork…
Had basically the same thing happen. Posted in a side project sub, spam filter nuked it because new account. And in other subs now, anything that mentions AI gets hit with "vibecoded slop" automatically. Doesn't matter…
So I launched a dev tool last week. Figured I'd share what actually happened across different channels because most "launch retrospectives" are written by people who already had an audience. My Dev.to article got 42…