[peyton]

Kinda crazy but hopefully the future holds a Clippy-esque thing for people who don’t know to set up CI, checkpoints, reviews, environments, etc. that just takes care of all that.

It sorta should do this anyway given that the user intent probably wasn’t to dump everyone’s data into Firebase or whatever.

I personally would like this as well since it gets tiring specifying all the guardrails and double-checking myself. Using this stuff feels too much like developing a skill I shouldn’t need while not focusing on real user problems.

[grey-area]

This problem is unrelated to CI and dev practices etc, this is about trusting the output of generative AI without reading it, then using it to handle patient data.

Vibe coding is just a bad idea, unless you’re willing and able to vet the output, which most people doing it are not.

[dgb23]

Fully agentic development is neat for scripts and utilities that you wouldn‘t have the time to do otherwise, where you can treat it as intput/output and check both.

In these cases you don’t necessarily care too much about the code itself, as long as it looks reasonable at a glance.

[lonelyasacloud]

> Vibe coding is just a bad idea, unless you’re willing and able to vet the output, which most people doing it are not.

It says quite a lot about where we are with ai tooling that none of the big players have “no need to review, certified for market X” offerings yet.

[edwinjm]

It is related to CI and dev practices etc. A experienced developer using AI would add security/data protection, even when vibe coding.

[grey-area]

An experienced developer would not have created this mess nor 'vibe-coded' (i.e. used AI without checking), but this person probably didn't know what they didn't know and believed the AI when it confidently asserted this mess was the correct way to do this.

None of that is related to the practice of Continuous Integration.

[Shorel]

CI doesn't magically takes care of security, that's a naïve understanding of vulnerabilities.

Someone with the right mindset needs to be there providing guidance and architectural input.

And even then that's not enough. Something like a super extensive testing set like in SQLite is the best we can do.