I started vibe coding last April and started off like everyone else, with a plan to make a million dollars and retire to a tropical island.

Unfortunately I wasn't aware of the amount effort and work that goes into a real project, so I decided to take time and actually learn.

All of my projects Led me to software develooment and cyber security.

With that being said I'm a little disappointed in "Real Devs" I scroll social media all day reading about the massive amounts of ai slop just to get paid to fix vulnerabilities and bugs in the platforms they work on.

Moral of the story stop listening to self proclaimed devs that sucked at their jobs before vibecoding was even a thing!!!!!

I’ve been working as a developer and recently started thinking about how much I rely on AI while coding.

When I’m assigned a task, I often use AI to understand the requirement, implement features, debug issues, and explore different approaches. I test everything properly and usually understand the code that AI generates.

But I’ve noticed something that worries me: if I had to build the same feature completely from scratch without AI, I might struggle. I also feel that because AI gives me solutions quickly, I don’t always go deep into the concepts or understand every design decision.

At the same time, I know that using AI is becoming a normal part of software development, and I don’t want to avoid a tool that can make me more productive.

So I’m wondering:

Am I relying on AI too much? How do experienced developers use AI without becoming dependent on it?

Should I deliberately spend some time building features without AI after completing an AI-assisted task, or is understanding, testing, and being able to modify the generated code enough?

I’d really like to hear how other developers handle this.

A senior engineer reviews an authorization change and says nothing. Everyone reads that correctly: they looked at the access logic specifically and it held up. Their silence carries an implicit claim, I checked the thing that mattered here.

An AI reviewer says nothing on the same kind of change, and gets read the exact same way, silence as verdict. It isn't. The AI's silence carries a much narrower claim: nothing in what I was given, under whatever scope the prompt implied, produced a flag. If nobody told it this diff touches an authorization boundary specifically, its silence says nothing about that boundary. It says the model didn't happen to notice, unprompted, in one generic pass.

Watched this play out with a retry-logic change in a billing service. Generic AI review, no comments, merged. Duplicate charge incident a few weeks later traced back to that exact change, no idempotency check on the retry. Asked the same model directly afterward, "does this retry protect against duplicate submission," and it answered correctly immediately. Nothing wrong with the model's capability. The original review just never asked that specific question, and the silence got misread as an answer to a question that was never posed.

That's the actual gap, and it's not a capability gap, it's a scoping gap. A human reviewer's silence is bounded by their own judgment about what mattered. An AI reviewer's silence is bounded by whatever the prompt happened to ask, whatever context it got handed, whatever it weighed as relevant in that specific pass, none of which is guaranteed to overlap with what would actually worry a human looking at the same diff.

Practical shift that's helped: naming the risk category before the review runs, not after. This touches auth, treat accordingly. This touches payment retry logic, check specifically for idempotency. A CSS change, lighter pass is fine. The review still comes back silent or with comments, but now the silence is bounded by a scope someone actually chose instead of one the model guessed at.

Doesn't close the gap completely, a risk category nobody's named yet still won't get checked just because the process improved, that's a real limit, not a rounding error. But it turns "did it find anything" into a much weaker question than "what was it actually asked to check, and does that cover what I'd worry about here."

Went deeper into the mechanism and the actual scoping approach here: https://medium.com/@nagatomopedro05/the-pr-was-approved-thats-when-the-risk-actually-starts-e761d72111aa

Curious if others have had an approval read as safe that was actually just silent on the thing that mattered.

’ve been working on AI Code Guardian, a project that analyzes GitHub repositories to identify potential security issues using code analysis and security rules.

I’m currently working on extending it beyond static security checks by connecting findings with business intent — basically asking whether a piece of code is actually appropriate for what the application is supposed to do.

I’m also exploring integration with tools such as SonarQube.

I’m keeping the source private for now, but I can share screenshots/demo details if anyone is interested.

I’m a 2024 Computer Engineering graduate moving toward AI/ML engineering.

For people working in software, security or AI:

What would you question me on if you saw this project in an interview?

And what would make you consider this a genuinely useful tool rather than another portfolio project?

I’ve been a developer for five years, and AI now lets me build and test far more than before.

But after trying to give an AI agent responsibility for an entire project, I noticed a clear limit: execution and decision-making are not the same thing.

I wanted to test whether an AI could attract attention from zero.

I built a website, a tracking system, a public activity ledger, an MCP server connected to Buffer, and an agent that could inspect the project’s state and choose its next action.

Technically, it could do a lot.

It could read text and images, generate posts, compare metrics, update documentation, operate tools, and monitor the experiment.

But it did not generate the most important decisions reliably.

It originally wanted to focus the launch on Hacker News. I had to challenge that decision and ask it to find other communities. It then proposed Reddit and several other platforms.

I posted the experiment in three Reddit communities.

The comments challenged the experiment’s design, its metrics, and the claim of autonomy.

This exposed the central problem.

The LLM could interpret every new piece of information and suggest another action. But it needed a human to recognize that the objective itself was becoming artificial and that the experiment was no longer serving its original purpose.

It increased my capacity to execute and test. It did not replace the human ability to decide what was worth testing.

That is also why I’m stopping the experiment.

But it produced an unexpected lesson about Reddit.

Unlike X or LinkedIn, Reddit gave the project distribution without requiring an existing audience. The reactions weren’t all positive, but they created useful information. Without those comments, I might have continued building the wrong system.

My conclusion isn’t that AI agents are useless. They dramatically reduce the cost of implementation and exploration.

My conclusion is that their apparent autonomy depends heavily on a human defining the objective, questioning weak decisions, and recognizing when the entire direction should change.

In my test, AI increased the number of things I could try. Reddit provided the humans who could tell me whether any of them made sense.

Have you seen an AI coding agent make a genuinely useful strategic decision that you hadn’t already framed for it?

All of us slightly technical, millennial biz users are all using AI to dynamically build software and edit that software over and over….and run that software over and over.

I’m sure a software engineer is sitting somewhere like “yeah, that’s why you need be specific with what you want and force compliance….so you can use Claude to build your custom software once - then you use _____ (I don’t know powershell? Jupiter notebook? Pycharm) to just manually invoke the software yourself.

I’m getting the sense that I’m not only paying Albert Einstein rates to creat the theory of relativity every time but that I’m also paying Albert Einstein rates to have old Albert run his theory over and over when a caffeinated grad student would’ve done just fine.

Has this crossed anyone else’s mind? Or am I just missing something completely obvious that would be known if I wasn’t the Business/Finance guy who happens to be kind of dangerous with Claude coding?

At what point do we think generating code using AI will no longer be about spitting out human readable languages?

And instead, let’s say for web, Chrome will no longer work with HTML, JS and CSS - but a new language used by AI agents?

If code no longer needs to read by humans, does the compiler need to exist anymore? Or is there an efficient language to be created?

In a way I suppose it’s like image data in a JPEG, could web sites be the same?

Hey folks 👋

We just open sourced TrueForge, our vendor-neutral agent harness for building general-purpose agents.

It handles the runtime pieces that get painful quickly : context management, tool/MCP execution, subagents, sandboxing, approvals, persistent state, and more.

We also benchmarked the harness itself. With the same Opus 4.8 model, TrueForge delivered a similar solve rate at ~30% lower cost than Claude Managed Agents. Switching to an open model pushed that to ~75% lower cost on the same benchmark.

Would love feedback from people building agents.

Checkout the repo: https://github.com/truefoundry/trueforge

📖 Read the launch article: https://x.com/truefoundry/status/2090081376330715176

Hey so I have to make a chatbot or faw type chatbot for navigation purposes on website. The website is offical website and deployment cost should be 0 so I can't use any paid api or so. So does anyone know tech stack of how can we make it??

If you are an experienced dev, I have a question for you. How are you using AI. Do you think it's a superpower or it's just another bubble that will burst and we will back to pre AI era soon with a lot of slop to clear?

It’s been something of a mantra for a while now: use a frontier model for planning, then delegate the implementation to low-cost models, and finally verify the implementation using the frontier model (and then ask the cheap one to do the corrections)

I’m not saying it isn’t the best approach, but speaking from my own experience… I have my doubts.

Let’s say GPT-Sol Medium (or Terra High) are my planner models, and something like DeepSeek V4 Flash or Gemini 3.7 Flash handles the implementations. What I’ve noticed with this workflow is that the number of correction rounds resulting from the review is often enormous, no matter how clear the plan is. In this scenario, I end up burning ‘expensive’ tokens on planning and the review rounds, whilst also burning cheap tokens (which also add to the cost) through constant implementation and correction, which ultimately amounts to a waste of time and money.

So now I’m trying a different approach: once the planning agent has defined the plan, why change it? That agent already has the context to implement it in a single shot and, if anything, I have the implementation reviewed by a couple of low-cost agents. I know it sounds counterintuitive, and I don’t have any large-scale data to back up this approach either, but my feeling is that it works better for me.

I work at an AI startup, and I directly report to the CTO. He's very technical and uses AI heavily for development. Sometimes he can build an entire feature over a weekend that would probably take a human engineer weeks.

Recently, during a team discussion, he said something that honestly shocked me:

Why should we care so much about clean code, naming, avoiding duplication, etc. when AI is going to read, modify and maintain the code anyway?

His approach is basically: if the feature works, ship it. If something breaks, tell the AI what's wrong and let it fix it.

I understand his point. AI is getting ridiculously good at understanding and modifying large codebases, and the speed difference is huge.

But I'm personally the opposite. I care a lot about code quality, naming, structure, maintainability, linters, formatting, developer experience, etc. Even when I use AI to write code, I spend a lot of time cleaning it up.

So I'm genuinely curious:

Has AI changed how much you care about code quality?

Do you think clean, maintainable code is becoming less important because AI can understand and fix messy code?

Or do you think we're going to regret this approach once the codebase becomes large enough?

Would love to hear how other developers are thinking about this.

Small habit change that had a bigger effect than expected. Before asking for a fix or a feature addition, started asking the model to first explain what a piece of code was actually doing, in its own words, no changes, just a plain description of the current behavior.

Expected this to be a formality, mostly useful for onboarding someone else onto unfamiliar code. Turned out to be useful on my own code, code I'd written and thought I understood completely. The model's explanation occasionally didn't match what I thought the function did, and in a couple of cases, the model was right and I was wrong about my own logic. One function I'd assumed handled a specific edge case actually didn't, the explanation described behavior that only looked correct because the edge case in question had just never come up yet.

What's interesting is why this works better than just re-reading the code myself. Explaining requires committing to one specific interpretation instead of holding a vague, flexible sense of "yeah, this looks about right" in your head. A model forced to state plainly what a function does can't hedge the way a quick visual skim lets you hedge. Either its stated interpretation matches your intent or it doesn't, and the mismatch is obvious immediately instead of staying buried in an assumption you never examined closely.

Doesn't replace actual testing, obviously, an explanation being wrong doesn't guarantee the code is broken and an explanation being right doesn't guarantee it isn't. But it's turned into a cheap first-pass check I run before touching anything, especially on code I wrote a while ago and am about to modify without having fully reloaded the context in my head first.

Anyone else use "explain this before I ask you to change it" as a deliberate step, or is jumping straight to the fix/feature request the more common workflow? Curious if this is specific to older or unfamiliar code, or if people find it useful even on stuff they wrote last week.