I'm a big advocate for AI, including GenAI. But I still spend a fair amount of time coding by hand, or "by hand + Copilot completions enabled". And yes, I will use spec driven development with SpecKit + OpenCode, or just straight up "vibe code" on occasion but so far I am unwilling to abdicate my responsibility to understand code and abandon the knowledge of how to write it. Heck, I even bought a couple of new LISP a…
My responsibility is to make sure my code meets functional and non functional requirements. It’s to understand the *behavior*. My automated unit, integration, and load tests confirm that. Someone thought I was naive when I said my vibe coded internal web admin site met the security requirements without looking at a line of code. I knew that because the requirements were that anyone who had access to the site could do…
Suppose that in normal use a user can visit a certain URL which triggers a dangerous effect. An attacker could trick the user into performing the action by presenting a link to them titled "click here for free stuff."
There are various ways to protect against that (e.g. CORS, not using GET methods) but backend cloud credential management does not give it to you for free.