Viewing profile — Andrei_dev

I look at other people's code a lot. The security issues are always boring, that's the thing. API keys sitting in the client bundle, auth middleware missing half the routes. Not cl…

Half this list is bad attribution. LiteLLM was a supply chain attack — stolen PyPI credentials, nothing to do with vibe coding. The Amazon outage number comes from a vendor blog pu…

[dead]

Exactly. "Tests pass" and "code is secure" are just different things. AI code makes that gap worse. I run static analysis on mixed human/AI codebases. The AI parts pass tests fine …

They exist. Go look at any "I built this in a weekend with Cursor" post — there are hundreds. The problem is most of them ship broken and stay broken. Auth that doesn't actually ch…

Sandboxes yes, but who even added the dependency? Half the projects I see have requirements.txt written by Copilot. AI says "add litellm", dev clicks accept, nobody even pins versi…

[flagged]

Our security scanning runs on GitHub Actions — every PR gets checked before merge. When GitHub goes down, the security gate goes down with it. PRs pile up, devs get impatient, star…

[flagged]

[dead]

[dead]

[flagged]

250K lines in a month — okay, but what does review actually look like at that volume? I've been poking at security issues in AI-generated repos and it's the same thing: more genera…

Yeah, this tracks. Developers who actually read what the AI spits out catch the obvious mistakes. The ones who just tab-complete their way through a whole project don't. And where …

The testing angle keeps coming up but it's sort of missing the point. I spent a few weeks poking through public repos built with AI tools — about 100 projects. 41% had secrets sitt…

The version control angle is interesting. One thing worth thinking about — SOUL.md and SKILL.md are essentially prompt injections by design. They define what the agent does. If the…

Had basically the same thing happen. Posted in a side project sub, spam filter nuked it because new account. And in other subs now, anything that mentions AI gets hit with "vibecod…

So I launched a dev tool last week. Figured I'd share what actually happened across different channels because most "launch retrospectives" are written by people who already had an…