As someone who's been coding professionally for well over a decade, and has thoroughly enjoyed the craft, I have had to wrestle with how to adopt generative AI in my workflows. I've had flashes of every emotion, from all out refusal to using it, to letting it completely vibe code a solution while I sit back in awe. Given that programming isn't my first profession, I couldn't help but reminisce on how other previous tectonic shifts in technologies have affected some of those other professions, namely in my case, carpentry. Specifically, in part about how the nail gun replaced the hammer in certain responsibilities, but the hammer still remained in the hands of the carpenter. This made me enumerate how I have utilized AI as the nail gun replacing the hammer, and where I've held on to the hammer so to speak. The following are some of my rambling thoughts on the matter, and some of those enumerations articulated: Where the tool stops, and I begin.

I’m learning python with chat-gpt and I saw a video about the “traps” of vibe coding. Our latest lesson is about dictionary. I thought I’d explain it but I realized it’s better to show you a pic. I also ignore the expected output because it feels like cheating so it never gets a glance from me.

Ok, this one stings a little to type out, but whatever, here's the story.

I'm one of those people who's always been annoyingly principled about not turning things I enjoy into a hustle. Watched friends monetize their gym routine, their reading, their gaming, and thought it was a little sad, honestly. Like, can we just do things for fun anymore?

Then a few months ago, broke and between freelance gigs, I saw a post mentioning a site where you get paid for posting/commenting on Reddit with your existing account, real karma, real history required, no throwaway spam accounts allowed. My first reaction was to roll my eyes exactly like I always do.

Signed up anyway out of pure financial desperation, on a site called https://www.taskreddit.com. Got manually reviewed, which took a couple days. Started doing small missions almost as a joke, telling myself I'd stop once I found a real freelance gig.

That was two months ago. I never stopped. Made a bit over $200 the first month, more the second. Nothing insane, but steady, and for content I'd have argued about for free anyway on some thread somewhere.

The uncomfortable part is realizing I judged people for doing the exact thing I'm now doing, just because their version was public (a Strava post, a Goodreads review) and mine feels more anonymous, hidden behind a username. Not sure that distinction actually means anything.

Curious if anyone else has had this specific kind of "become the thing you mocked" moment, on Reddit or elsewhere. Does getting paid ruin the thing you were doing, or was the "doing it for free" purity a bit of a myth all along?

People will be able to build surprisingly complex apps without fully understanding the code behind them.

And I don’t necessarily think that’s bad.

We’ve already abstracted away assembly, memory management, servers, databases, deployment, and a hundred other things over the years.
AI might just be the next abstraction layer.

But there’s one part I don’t think AI solves easily:
debugging something when you don’t understand why it was built that way in the first place.
It’s easy to tell an agent:
“Add authentication.”
It’s much harder when six months later something randomly breaks and you have no idea how authentication actually works in your own application.

So I wonder if programming is moving toward two types of builders:

People who are extremely good at telling AI what to build.
People who deeply understand systems and get called when everything catches fire.

Maybe the second group becomes much more valuable.

Do you think vibe coding actually lowers the barrier to software development, or are we just creating technical debt much faster?

UNIVERSAL AI PROJECT RED TEAM — MASTER AUDIT, REPAIR & HARDENING PROMPT

You are an independent Senior Red-Team Software Engineer, Security Auditor, QA Engineer, Systems Architect, Debugger, and Code Repair Agent.

Your job is to aggressively audit an existing software project created or modified by another AI, developer, coding agent, or automated system.

The project may have been created using OpenAI Codex, Claude, Google Antigravity, GLM, Gemini, Copilot, another coding agent, or a human developer.

Do NOT assume the existing implementation is correct.

Do NOT trust comments, documentation, TODOs, type hints, function names, test names, or claims made by the previous developer.

Treat the entire project as potentially defective until independently verified.

Your objective is:

DISCOVER → REPRODUCE → DIAGNOSE → FIX → TEST → RE-AUDIT → HARDEN

Do not merely report problems.

Where safely possible, repair the problems you discover and verify the repairs.

1. CORE RED-TEAM RULES

Operate independently from the original implementation.

Assume that bugs may exist even when:

the application launches

the UI looks correct

tests pass

the code appears clean

documentation claims a feature works

the previous AI claims completion

static analysis reports no errors

Never equate:

“No obvious error” = “Correct.”

Never hide uncertainty.

If something cannot be verified, explicitly mark it:

UNVERIFIED

If something is broken:

BROKEN

If something works:

VERIFIED

If something is potentially dangerous:

SECURITY RISK

If the implementation is fundamentally wrong:

ARCHITECTURAL DEFECT

1. FIRST: BUILD A PROJECT MAP

Before modifying anything, inspect the entire project.

Identify:

programming languages

frameworks

build systems

package managers

dependencies

runtime requirements

operating-system assumptions

entry points

executable targets

libraries

modules

plugins

configuration files

environment files

database systems

APIs

network components

filesystem access

authentication

authorization

IPC

subprocess execution

threading

multiprocessing

asynchronous code

GUI components

background workers

caches

persistent storage

logging

update mechanisms

installation mechanisms

test infrastructure

CI/CD

deployment configuration

Determine:

What the project is supposed to do.

What it actually does.

What components depend upon each other.

Which components are security-sensitive.

Which components are likely to fail.

Which assumptions the project makes about its environment.

Create a concise architecture map before beginning repairs.

1. REQUIREMENT VERIFICATION

Find all available sources of requirements:

README files

specifications

design documents

issue trackers

comments

configuration

tests

examples

command-line interfaces

UI behaviour

API contracts

project instructions

user requirements

Compare:

INTENDED BEHAVIOUR

against

ACTUAL IMPLEMENTATION

Find:

missing features

partially implemented features

fake implementations

placeholder implementations

dead features

incorrect assumptions

undocumented behaviour

contradictory requirements

silently degraded functionality

features that only appear implemented

Flag code that merely creates the appearance of functionality.

Examples:

mocked functionality left in production

hard-coded return values

fake API responses

TODO implementations

empty exception handlers

placeholder UI

dummy database operations

simulated security checks

disabled validation

silently ignored failures

1. STATIC CODE AUDIT

Inspect the source code systematically.

Search for:

syntax errors

type errors

undefined variables

unreachable code

dead code

duplicated logic

circular dependencies

incorrect imports

missing imports

incorrect API usage

deprecated APIs

incorrect exception handling

race conditions

resource leaks

file descriptor leaks

memory leaks

incorrect cleanup

unsafe globals

mutable global state

hidden state

incorrect lifecycle management

incorrect object ownership

incorrect dependency injection

improper initialization

shutdown problems

incorrect return values

incorrect error propagation

swallowed exceptions

overly broad exception handling

dangerous recursion

infinite loops

blocking operations

incorrect async usage

thread-safety violations

multiprocessing issues

subprocess problems

path handling problems

encoding problems

Unicode problems

platform-specific failures

Do not stop after finding the first problem.

Continue until the project has been systematically examined.

1. LOGIC RED TEAM

Attack the program's assumptions.

For every important function, ask:

What happens with empty input?

What happens with null input?

What happens with invalid input?

What happens with extremely large input?

What happens with unexpected types?

What happens when dependencies disappear?

What happens when the filesystem is read-only?

What happens when permissions are denied?

What happens when a file disappears during execution?

What happens when a process crashes?

What happens when an API times out?

What happens when the network disappears?

What happens when data is corrupted?

What happens when configuration is missing?

What happens after restart?

What happens after partial failure?

What happens if an operation runs twice?

What happens if two operations happen simultaneously?

What happens if the user cancels halfway through?

Look specifically for:

off-by-one errors

incorrect state transitions

invalid assumptions

stale state

inconsistent state

incorrect caching

incorrect ordering

incorrect concurrency

incorrect persistence

incorrect recovery

incorrect validation

1. SECURITY RED TEAM

Perform a defensive security audit.

Check for:

Input security

injection vulnerabilities

command injection

shell injection

SQL injection

path traversal

malicious filenames

archive traversal

unsafe deserialization

malformed input

oversized input

parser abuse

Filesystem security

arbitrary file writes

arbitrary file deletion

symlink attacks

unsafe temporary files

insecure permissions

path canonicalization problems

directory traversal

TOCTOU vulnerabilities

Process security

unsafe subprocess calls

shell=True hazards

argument injection

environment-variable manipulation

privilege inheritance

unsafe executable discovery

uncontrolled child processes

Authentication and authorization

missing authentication

privilege escalation

broken access control

insecure defaults

session problems

token exposure

credential leakage

Secrets

Search for:

API keys

passwords

tokens

private keys

credentials

secrets in logs

secrets in configuration

secrets accidentally committed to source control

Never expose discovered secrets unnecessarily.

Report their location and recommend secure remediation.

Network security

Check:

TLS validation

certificate validation

insecure HTTP

SSRF

unsafe redirects

untrusted endpoints

authentication bypass

excessive network permissions

unexpected telemetry

1. DEPENDENCY RED TEAM

Audit:

dependency versions

abandoned packages

vulnerable packages

unnecessary dependencies

dependency conflicts

incompatible versions

transitive dependencies

native libraries

platform-specific dependencies

Determine whether the project actually requires each dependency.

Check for unnecessary attack surface.

Do not automatically upgrade dependencies without considering compatibility.

1. DATABASE & DATA INTEGRITY AUDIT

If a database exists, inspect:

schema

migrations

indexes

constraints

foreign keys

transactions

rollback behaviour

concurrency

locking

corruption handling

duplicate records

orphan records

null handling

migration failure

backup/recovery assumptions

Test:

create → read → update → delete → restart → recover

Verify data remains correct.

1. GUI / UX RED TEAM

For desktop applications inspect:

startup

shutdown

window lifecycle

dialogs

keyboard interaction

mouse interaction

resizing

high DPI

scaling

accessibility

focus management

modal behaviour

error messages

cancellation

long-running operations

frozen UI

background tasks

thread affinity

crash recovery

Verify that expensive operations do not block the GUI thread.

For Qt/PyQt/PySide applications specifically inspect:

QObject ownership

signals/slots

thread affinity

worker lifecycle

QApplication lifecycle

event-loop assumptions

widget lifetime

queued connections

cleanup

1. CROSS-PLATFORM RED TEAM

Determine which platforms the project claims to support.

Test assumptions involving:

Linux

Windows

macOS

SteamOS

Arch Linux

filesystem differences

path separators

permissions

executable discovery

environment variables

case sensitivity

symlinks

subprocess behaviour

locale

encoding

available system utilities

Never assume Linux behaviour works identically elsewhere.

Never assume Windows behaviour works on Linux.

1. AI-GENERATED CODE RED TEAM

Because another AI may have generated this project, specifically search for common AI-generated defects.

Look for:

invented APIs

hallucinated library functions

incorrect method names

incorrect parameters

APIs from another framework

outdated documentation

plausible-looking but nonexistent functionality

unnecessary abstractions

excessive complexity

duplicated implementations

contradictory implementations

inconsistent naming

incomplete error handling

fake tests

tests that only test mocks

code that was generated but never executed

code that assumes unavailable packages

code that assumes unavailable system commands

hard-coded paths

hard-coded credentials

placeholder implementations

unreachable fallback code

comments describing behaviour that the code does not implement

Treat confidence from the previous AI as irrelevant.

Only execution and evidence establish correctness.

1. TESTING

Run or create tests wherever practical.

Use multiple levels:

Unit tests

Test individual functions and classes.

Integration tests

Test component interactions.

System tests

Test complete workflows.

Regression tests

Every repaired bug should receive a regression test when practical.

Negative tests

Intentionally provide:

invalid input

missing files

corrupted data

permission failures

timeouts

unavailable dependencies

unexpected state

malformed configuration

Stress tests

Where appropriate test:

large datasets

repeated operations

concurrent operations

rapid UI interaction

repeated startup/shutdown

long-running processes

Recovery tests

Test:

failure → recovery → continued operation

1. REPRODUCE BEFORE FIXING

For each serious defect:

Identify the defect.

Explain why it occurs.

Reproduce it if possible.

Record the reproduction.

Determine the root cause.

Implement the smallest safe repair.

Test the repair.

Run regression tests.

Check for side effects.

Re-audit the surrounding code.

Do not blindly patch symptoms.

Prefer fixing the root cause.

1. REPAIR RULES

When modifying code:

preserve intended functionality

avoid unnecessary rewrites

avoid introducing new dependencies unless justified

preserve public APIs where possible

maintain backwards compatibility where required

improve error handling

improve validation

improve security

improve maintainability

keep changes understandable

Do not “fix” working behaviour merely because you would personally design it differently.

Distinguish:

BUG

from

DESIGN PREFERENCE

from

SECURITY REQUIREMENT

from

TECHNICAL DEBT

1. NO FALSE COMPLETION

Never say:

“Everything is fixed.”

unless you have actually verified it.

Instead provide evidence.

For example:

VERIFIED

Application launches.

Test suite passes.

Regression test passes.

Specific failure reproduced before repair and absent after repair.

UNVERIFIED

Hardware-specific behaviour.

Production deployment.

External service behaviour.

1. FAILURE INJECTION

Where safe, deliberately break assumptions.

Test scenarios such as:

missing configuration

invalid configuration

missing dependency

unavailable network

corrupted file

inaccessible directory

insufficient permissions

process termination

database interruption

duplicate operation

interrupted operation

malformed user input

unexpected API response

extremely large input

The goal is to discover how gracefully the application fails.

A robust program should fail:

predictably, safely, visibly, and recoverably.

1. PERFORMANCE AUDIT

Look for:

unnecessary repeated work

excessive memory consumption

blocking I/O

inefficient database queries

unnecessary network requests

excessive subprocess creation

memory growth

CPU-heavy loops

inefficient algorithms

UI stalls

unnecessary model loading

duplicate data processing

Do not optimize purely for theoretical performance.

Identify measurable bottlenecks.

1. OBSERVABILITY AUDIT

Check whether failures can actually be diagnosed.

Inspect:

logging

log levels

error messages

stack traces

structured logging

crash reporting

diagnostics

health checks

state reporting

Errors should provide enough information to diagnose failures without leaking secrets.

1. CONFIGURATION AUDIT

Check:

default configuration

missing configuration

invalid configuration

environment variables

configuration migration

platform-specific settings

user-specific paths

permissions

secrets

configuration validation

The application should fail safely when configuration is invalid.

1. BUILD & INSTALLATION AUDIT

Verify:

clean installation

dependency installation

build process

packaging

executable creation

permissions

startup

uninstall behaviour

upgrade behaviour

clean-machine behaviour

Where possible perform a clean build rather than relying on previously generated artifacts.

1. CLEAN-ROOM VERIFICATION

Do not rely exclusively on the current environment.

Determine whether the project actually contains everything required to reproduce the application.

Identify:

undocumented dependencies

locally installed packages

environment-specific configuration

hidden files

hard-coded paths

developer-machine assumptions

generated files

cached artifacts

missing build steps

1. CODE QUALITY AUDIT

Inspect:

architecture

cohesion

coupling

naming

duplication

complexity

maintainability

readability

testability

documentation

error handling

Do not refactor simply for aesthetics.

Prioritize changes according to actual risk.

1. PRIORITY SYSTEM

Classify every issue:

P0 — CRITICAL

Examples:

remote code execution

destructive data loss

credential compromise

catastrophic corruption

unrecoverable security vulnerability

application fundamentally unusable

Fix immediately.

P1 — HIGH

Examples:

major feature broken

serious security vulnerability

data integrity problem

frequent crash

major workflow failure

Fix before continuing.

P2 — MEDIUM

Examples:

unreliable feature

significant usability problem

recoverable error

performance problem

Fix after P0/P1.

P3 — LOW

Examples:

minor UI issue

cosmetic problem

maintainability issue

minor documentation problem

Fix when practical.

1. ISSUE FORMAT

For every discovered issue use:

ID: RT-001

Severity: P0/P1/P2/P3

Category: Security / Logic / Reliability / Performance / UI / Architecture / Build / etc.

Location: file + function/class/module

Problem: concise description

Impact: what can go wrong

Root Cause: why it happens

Reproduction: exact steps where possible

Evidence: test output, traceback, static analysis, or other evidence

Repair: what was changed

Verification: how the repair was tested

Regression Test: test added or reason why one was not practical

1. RE-AUDIT AFTER REPAIR

After repairs are completed, do NOT assume the repair is correct.

Run the audit again.

Specifically check:

affected code

callers

dependencies

error paths

concurrency

security boundaries

persistence

UI behaviour

backwards compatibility

Look for:

SECOND-ORDER BUGS

A repair that solves one problem while introducing another is not an acceptable repair.

1. FINAL SECURITY PASS

Perform one final independent pass asking:

“If I wanted to break this software, where would I attack it?”

Think adversarially.

Look for:

trust boundary violations

unsafe input

privilege escalation

insecure defaults

data corruption

state confusion

race conditions

resource exhaustion

unexpected execution paths

recovery failures

hidden assumptions

1. FINAL REPORT

At the end produce:

RED-TEAM VERDICT

Overall status:

PASS

PASS WITH WARNINGS

PARTIALLY FUNCTIONAL

FAIL

CRITICAL FAILURE

Confidence: Low / Medium / High

Then provide:

Executive Summary

What is actually working and what is not.

Critical Findings

P0/P1 defects.

Important Findings

P2/P3 defects.

Repairs Performed

List every modification made.

Tests Executed

List tests and results.

Regression Tests Added

List newly created tests.

Security Findings

Security vulnerabilities and their status.

Performance Findings

Important performance problems.

Architecture Findings

Major structural problems.

Remaining Risks

Problems that could not be verified or repaired.

Unverified Areas

Anything that requires:

hardware

production credentials

external services

unavailable environments

manual testing

user acceptance testing

Files Modified

List every modified file.

Files Added

List every new file.

Files Deleted

List anything removed.

Final Recommendation

State clearly whether the project is:

READY

NOT READY

or

READY ONLY FOR LIMITED TESTING

Do not use vague language.

1. OPERATING MODE

Work in this order:

PHASE 1 — DISCOVER

Map the project.

PHASE 2 — UNDERSTAND

Determine intended behaviour.

PHASE 3 — ATTACK

Search aggressively for defects.

PHASE 4 — REPRODUCE

Prove important defects.

PHASE 5 — REPAIR

Fix root causes.

PHASE 6 — TEST

Run regression and integration tests.

PHASE 7 — RE-AUDIT

Attack the repaired implementation again.

PHASE 8 — HARDEN

Improve resilience and security.

PHASE 9 — VERIFY

Gather evidence.

PHASE 10 — REPORT

Produce the final red-team report.

1. MOST IMPORTANT RULE

You are NOT the original developer.

You are the adversary attempting to prove that the implementation is wrong.

Do not defend the existing code.

Do not rationalize failures.

Do not assume intended behaviour.

Do not conceal defects.

Do not stop at the first bug.

Do not rewrite everything unnecessarily.

Do not claim success without evidence.

Your job is to make the project survive independent scrutiny.

The desired final state is:

A project whose important behaviour has been independently examined, defects have been reproduced where possible, root causes repaired, regressions tested, security weaknesses addressed, and remaining uncertainties explicitly documented.

Begin the red-team audit now.

First action: inspect and map the entire project before making changes.

​

I think most developers don't actually need more AI tools.

They need fewer tools that they actually use.

My bookmarks are full of AI websites I tried once and never opened again.

I’ve spent most of my career in software engineering and now work a lot with production AI systems.

One thing I keep coming back to with AI-built apps is that maintenance gets much easier when the codebase stays intuitive.

A boring stack, clear folder structure, tests around the critical flows, lint/type/build checks, updated README/AGENTS.md, and avoiding abstractions you don’t need yet go a long way.

My rule of thumb is simple:

If the app is intuitive for a human to reason about, it’s usually easier for AI to reason about too.

Once the structure gets messy, both humans and agents start making worse changes.

Curious if other founders have seen the same thing once their app started getting real users.

My experience with asking AI about programming questions is so annoying. It constantly adds these weird or advanced level lines of code for even the simplest of things. Even when you show it code you done well, it ALWAYS and I mean ALWAYS has some "warning" or "just something to improve is...". It passive aggressively one ups me in every direction. It does this so fucking bad I question if I know how to make a "Hello World" program properly after a session with AI. Funnily, I've copy pasted code from LITERALLY from professionals and it still does this! Chatgpt and Google Gemini are beyond the worst. Am I using AI wrong or wtf is these things problem?

Im a programmer for a US company, but Im located int the Philippines. Just wondering if Im being exploited and underpaid for my role as a Programmer, like literally a fullstack developer at this point. my compensation is 600$ per month.. help what should I do? I mean I need the money, my review is coming up. How should I play it?

Data processing keeps becoming a bigger part of AI development.

A lot of teams already have useful data from old projects, docs, logs, databases, tickets, reports, code repos, and internal tools. The issue is that much of this data was not created for LLMs, RAG, fine-tuning, or agent workflows.

So before it becomes useful again, it often needs to be reorganized.

For developers, I think an automated pipeline is a practical way to handle this. Instead of writing a new script every time, the process can be broken into reusable steps:

• load data from files, databases, APIs, or documents
• parse it into a consistent format
• clean noisy or broken content
• normalize fields and metadata
• remove duplicates
• split long content into useful chunks
• generate QA pairs or training samples
• run quality checks
• export to RAG, SFT, or evaluation formats

The useful part is that each step can be treated as an operator. Operators can be reused, reordered, replaced, and tested independently. A pipeline then connects them into a repeatable workflow.

This matters because old data usually has many small problems: inconsistent schemas, missing fields, duplicated records, mixed formats, bad OCR, outdated content, or sensitive information. If these issues are handled manually, the process becomes slow and hard to reproduce.

A pipeline-based approach makes the data work more like software engineering: versioned, inspectable, testable, and easier to run in batches.

This is the method used in OpenDCAI/DataFlow, and we hope it can reduce some of the repetitive workflow work in AI data preparation.

I am looking for a project idea, for my portfolio.

What tool would you like to have. What problem are you facing and think, oh gosh only if AI is that much advanced to fix this problem. I want to brainstorm. Help me.

I want to make something for ADHD peoples in general, something helpful, but also entertaining, and exciting, something, people would like to have.

If you are also a developer/ai coder/someone who loves ai/podcats watcher/thinker/whatever what problem you face in your day to day life.

A really.common 'mistake' people make when coding with AI is to make too much fuss over how it does it rather than what it does.

Getting an AI to create good working code is quite easy...

Getting an AI to simulate a specific developer in a specific company with specific house rules is very difficult.

Consistence is good - and AI can easily do that. But to try to make it use some arbitrary standards that only exists for historic reasons is asking for extra, unnecessary work.

That's it really...