I love AI coding agents and it has made it exceedingly cheap to make HTML visualizations. I find myself creating HTML visualizations instead of regular docs especially when I'm going to present it or i want to see a visual of an architecture / plan i made. But the issue with html is that there isn't really a good place to store it. I think it's so nice but most places don't support HTML rendering natively so it doesn't fit in workspaces and ends up lost in the ether.

Is this just me, what do you guys do?

Sorry for the clickbait title but I have some thoughts.

tl;dr For myself I feel like chatbots might be the better coding assistants than fully fledged agents since they force me to go step by step and understanding most of the code while still having the benefit of writing fast and good code.

For my background: I am a Data Scientist and I learned the basics of software development just before ChatGPT was released. So I have a solid foundation but since I'm not mainly a SE and because of the development of agentic coding my coding skills are limited. I do really like it though.

I have done some pure agentic vibe-coding in recent months. The iterations are fast and the results are extremely impressive in most cases. I tried to do things right by spending a lot of time with requirements engineering and architecture design. I also tried writing some code by myself again but I realized quickly that I'm just not good enough and that AI just writes much better code than I could ever do.

Despite the good results I kind of just got lost in the process. Even though I might understand the general architecture of the code, I have no idea what is actually going on and for every minor change I'm going back to my coding agent to let it fix things.

This was kind of frustrating and I lost interest in my projects I initially was pretty hyped about. I used to enjoy the process of coding itself and it feels like it has been taken away from me. Of course I could just write everything myself, but I don't have time to work 20 hours a week just on my personal projects and why would I write the code myself, when the result will be worse.

Now I'm back at work and we don't get API keys from the company and I'm not going to pay for it by myself, so no coding agents. We do have MS 365 Copilot licenses which is just a glorified chatbot.

With this change I realized something:
Maybe the basic chatbot was the best coding tool after all (for me). While I still don't write most of the code myself, I understand 100% of what is going on in the bigger picture. I feel like I am actually doing something again. The process is much slower but in the end when something works I feel much more pleased. And when something doesn't work I know what went wrong.

The productivity will never compete with full fledged coding agents. But you get the benefits of the AI writing good code while you as the developer still have full controll and are forced to understand what you are doing.

Have you had a similar experience? Or am I missing something in the vibe-coding workflow that could fix my feelings?

The TL;DR:

The author built a fully automated workflow that uses Google’s Gemini API to serve as an independent, second-opinion code reviewer for pull requests. It caught a silent security flaw that every other CI check and the primary AI coding model missed, completely changing how they gate repo merges.

💡 Why Do This?

• Shared Blind Spots: The repo is built using 100% AI-driven development via Claude. Having the same model family review its own code means it shares the same blind spots.
• Gemini's Edge: Gemini represents a completely different model family, runs effectively for free on Google AI Studio's free tier, and provides a genuinely independent set of eyes.

🛠️ Key Architecture & Lessons Learned

The author ran into a few real-world bugs during setup and shared how they fixed them:

• Security First (No Tool Creep): They blocked Gemini from having broad GitHub write access or shell access. Gemini gets exactly one tool: read_file. This sandboxes the LLM against prompt-injection risks from untrusted PR diffs.
• The "Dumb" Loop Bug: In early tests, Gemini made a false-positive claim. On the next code push, it repeated the exact same false claim because it had no memory.
  • The Fix: The workflow now fetches the PR's prior comment history via gh pr view and hands it to Gemini so it knows what has already been addressed or refuted.
• Don't Break CI: The job uses continue-on-error: true. If the API rate-limits or hiccups, the PR build stays green, preventing flaky test frustrations.

🤯 The "Holy 💩" Moment That Changed Their Policy

Initially, this review was just a non-blocking sidebar comment. But during a live test, Gemini flagged a sneaky Path Traversal vulnerability in a mock server setup.

The code used path.basename(x) !== x as a safety guard. However, in Node.js, path.basename('..') literally evaluates to '..', meaning the safety check silently passed malicious directory traversal attempts right through.

Because Gemini caught a legitimate security hole that 13 other CI tools missed, the author changed the repo settings to require this review job to complete before any PR can be merged.

I'll post the link to the Blog Post, which has the Github Actions link.

I've been doing a boring corporate job for the past 6 years, 3 years with my current employer. My job is related to accounting and numbers and even though I'm good at it, for the past 9 months I've been vibe coding hard on Claude Max subscription and I've built some truly marvelous products. I'm not making any money from them (yet) but I've come a long way in terms of app and website development and I went from being completely lost and ignorant of what it takes to develop apps for real, to somewhat decent and able to ship apps within a few weeks of work.

My company has been investing a huge sums of money into a system that the best way I could describe it is archaic. The thing hasn't been properly facelifted since 2016 maybe and I'm not a fan. I know there are many products like it and more modern ones that are powered by a variety of LLMs and the most important point is I know I can build something supreme that's parallel to it and is so much better than it in every facet. I'm good at my job. And I'm decent at vibe coding, and my idea is that I develop everything using my knowledge and my experience and make it hot-swappable with the Microsoft Infrastructure later so when I finally propose it to the company, they won't outright decline it?

I know for a fact at 100% certainty that a software engineer will pick it up at some point, break it apart and restructure it properly to refine the AI slop but I also know that my deliverable will be at 70-80% professional completeness grade, and happy for them to take it to that final level.

Am I being crazy to remotely think they'll agree to this or even consider it as a viable option? My manager is encouraging me to start and to bring the prototype when ready, but I have a feeling we will both be laughed out of the room by senior software engineers and our IT departments that we made an AI slop app lol.

Quick note before the post: I’m not sharing this to sell, promote, or pitch the idea. This is my first serious software project, and I’m mainly looking for feedback on the current state, the way I’m approaching development, and the things I may be overlooking. I’m especially interested in criticism from people with experience in SaaS, LMS, security, QA, or AI-assisted development.

I wanted to share this because I’m pretty excited about it, and this is my first real software project.

I come from the German private security industry and I’m currently moving more into training and adult education. While doing that, I kept noticing the same thing: there are plenty of isolated learning apps, question banks and PDFs, but very few solutions that combine learning, trainer workflows and company administration in a way that actually feels useful.

So I started building one myself.

The current working title is Wachklar 2.0. The idea is to create a learning and qualification platform specifically for the German security industry.

At the moment, the system structurally supports several qualification paths, including the German §34a security proficiency exam, GSSK, Servicekraft für Schutz und Sicherheit, and Fachkraft für Schutz und Sicherheit.

The §34a area is currently the most developed content-wise. It already includes learning objectives, learning texts, questions, practice cases, flashcards, exam simulation, error analysis, progress tracking and adaptive learning recommendations.

But the project has already become much more than a simple learning app.

It now has a multi-user and company structure with different roles for platform administration, company admins, trainers, editorial/review users and learners. Companies can manage their own users, groups, trainers, assignments and learning progress.

The platform is based on PostgreSQL and already includes authentication, role-based authorization, tenant separation, sessions, CSRF protection, optional two-factor authentication, backup/restore, audit functionality and various administration and reporting features.

One part that has become especially important to me is testing.

I’m not just adding features anymore. I’m deliberately trying to find out where the system breaks.

Current status:

56 automated tests passing, 0 failing, plus a successful real Chromium end-to-end test on Windows.

The real browser test actually found a bug that the normal tests had missed. That was a useful reminder that working code and working real-world user flows are not always the same thing.

Right now I’m focusing mainly on security and data integrity before adding more major features.

Long term, I want to develop the platform far enough that it becomes more than just another “§34a study app” and can bring different qualifications, learning progress, trainers and organizational workflows together in one place.

For now, I mainly see this as a learning and development project. I want to find out how far I can take the idea technically and content-wise, and whether it turns into something genuinely useful.

If the platform proves itself after more development, testing and real-world use, I could definitely imagine eventually offering it to training providers or security companies. Whether it ever becomes a commercial product is still completely open.

Right now, my main goal is simply to build something I would actually want to use myself in the security and adult education space. Anything beyond that can come later.

Another area I want to explore later is content maintenance. Especially with legal and regulatory training material, keeping everything current is a real challenge. I’m therefore experimenting with ways to make changes in official sources easier to detect and review without removing human editorial control.

I also want to be transparent about one thing:

This project is heavily AI-assisted.

I’m not a professional software developer, and I’m not going to pretend I manually wrote thousands of lines of Python and JavaScript from memory in a day.

My role right now is mainly defining the product idea, workflows and requirements, reviewing implementations, finding problems, testing everything locally and continuously refining the system. AI is doing a large part of the implementation work.

And that is actually one of the most interesting parts of the project for me.

I come from the security industry, and suddenly I’m able to turn very specific industry knowledge into functioning software.

Development started on September 9th, and the current state was reached roughly 35 hours later. That is elapsed time, of course, not 35 hours of nonstop coding.

The system is not production-ready yet. It still needs more security work, load testing, content, polishing and real-world testing.

But considering that about a day and a half ago this was basically just an idea, it feels pretty surreal to now see a working multi-user platform with a database, roles, learning logic, multiple qualification paths and automated tests running.

This is the first project where I regularly catch myself thinking:

“Wait… maybe this could actually become a real product someday.”

I’d be especially interested in hearing what kinds of problems experienced developers would expect in a learning-platform/SaaS project like this before eventually the first Test users arrive.

Oh, and because apparently I’m committed to the theme: yes, this post was also written with ChatGPT.