Andrei_dev

6 ms·

1.
by Andrei_dev 6mo ago
I look at other people's code a lot. The security issues are always boring, that's the thing. API keys sitting in the client bundle, auth middleware missing half the routes. Not clever exploits, just nobody actually reading what t
2.
by Andrei_dev 6mo ago
Half this list is bad attribution. LiteLLM was a supply chain attack — stolen PyPI credentials, nothing to do with vibe coding. The Amazon outage number comes from a vendor blog pushing their own product. Nobody else reported it. But the &q
3.
by Andrei_dev 6mo ago
Exactly. "Tests pass" and "code is secure" are just different things. AI code makes that gap worse. I run static analysis on mixed human/AI codebases. The AI parts pass tests fine but they'll have stuff any SAS
4.
by Andrei_dev 6mo ago
They exist. Go look at any "I built this in a weekend with Cursor" post — there are hundreds. The problem is most of them ship broken and stay broken. Auth that doesn't actually check anything, API keys in the frontend, falls
5.
by Andrei_dev 6mo ago
Sandboxes yes, but who even added the dependency? Half the projects I see have requirements.txt written by Copilot. AI says "add litellm", dev clicks accept, nobody even pins versions. Then we talk about containment like anyone ac
6.
by Andrei_dev 6mo ago
Our security scanning runs on GitHub Actions — every PR gets checked before merge. When GitHub goes down, the security gate goes down with it. PRs pile up, devs get impatient, start merging without waiting for checks. That's exactly wh
7.
by Andrei_dev 6mo ago
250K lines in a month — okay, but what does review actually look like at that volume? I've been poking at security issues in AI-generated repos and it's the same thing: more generation means less review. Not just logic — checking
8.
by Andrei_dev 6mo ago
Yeah, this tracks. Developers who actually read what the AI spits out catch the obvious mistakes. The ones who just tab-complete their way through a whole project don't. And where it bites you isn't where you'd expect — logic
9.
by Andrei_dev 6mo ago
The testing angle keeps coming up but it's sort of missing the point. I spent a few weeks poking through public repos built with AI tools — about 100 projects. 41% had secrets sitting raw in the source. Not in env files. In the code it
10.
by Andrei_dev 6mo ago
The version control angle is interesting. One thing worth thinking about — SOUL.md and SKILL.md are essentially prompt injections by design. They define what the agent does. If the ecosystem grows to where people fork and share agent repos,
11.
by Andrei_dev 6mo ago
Had basically the same thing happen. Posted in a side project sub, spam filter nuked it because new account. And in other subs now, anything that mentions AI gets hit with "vibecoded slop" automatically. Doesn't matter if you
12.
by Andrei_dev 6mo ago
So I launched a dev tool last week. Figured I'd share what actually happened across different channels because most "launch retrospectives" are written by people who already had an audience. My Dev.to article got 42 reads and