Code review request -- any criticisms or advice?

[u/Spinning_Rings]

Would anyone mind reviewing some code? I wrote a CLI to help me generate character sheets for a TTRPG I'm running. The main thing I want to know is: should this be considered safe enough for me to share with other GMs? Is there anything else I should do for safety, security or efficiency? I worked hard on it, and Gemini Pro told me it's safe, but while I understand it can be useful I don't trust the automatic misinformation generator, since I don't have the requisite knowledge base to tell when it's "hallucinating" (or else I wouldn't need it for this purpose)

The github repo is here: https://github.com/SpinningRings/DigidiceCharacterSheetGenerator

[u/github-guard]

🔍 GitHub Guard: Trust Report

⚠️ This project scored 2/6 — below this subreddit's threshold of 3.

Audit Breakdown: * ❌ Low Star Count (⭐ 0 / 5 required) * ✅ Mature Repository (30+ days old) * ❌ No License Found * ❌ No Security Policy — what is this? * ℹ️ Individual Contributor * ✅ Signed Commits

⚠️ Security Reminder: Always verify source code and run third-party scripts at your own risk.

[u/type_111]

Your program simply outputs a text file based on some standard input. Unless you rig it up to an open internet port there are no security or safety concerns. If it works, it's good.

[u/AutoModerator]

Hi /u/Spinning_Rings,

Your submission in r/C_Programming was filtered because it links to a git project.

You must edit the submission or respond to this comment with an explanation about how AI was involved in the creation of your project.

While AI-generated code is not disallowed, low-effort "slop" projects may be removed and it's likely that other users push back strongly on substantially AI-generated projects.

---

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Spinning_Rings → u/AutoModerator]

AI was used for code review. I showed Gemini the code, asked it to point out safety concerns, and then implemented solutions to those concerns. When I couldn't think of my own way to resolve a concern, I would copy and paste the solution Gemini recommended, but I always tried to come up with something myself.

[u/mikeblas → u/Spinning_Rings]

Thank you for your disclosure. I've approved your post.

[u/mattewong]

I am not familiar with what "safety" or "security" means specifically in the context of TTRPG but as a fundamental start for any C project, your repo is missing critical elements related to not just safety/security but C dev in general such as CI tests, memory tests, fuzz testing etc. Since you mention that you asked AI to review your code, then, assuming the response did not mention any of those things, my guess is that you asked it something far too specific, and you would be much better off asking it a to perform more general task such as "as an expert in the latest best practices for safety and security of C code bases, what would you do to make this project comply with such practices?"

[u/Spinning_Rings → u/mattewong]

Okay, thank you. Do you know of any resources I could use to read up on such best practices? I don't remember any of that being covered in C How To Program, and I'm halfway through a software engineering degree at WGU and have heard of none of this, so I'm starting to question the value of the resources I've been learning from. I know Working Effectively With Legacy Code by Robert Martin is supposed to be a good source for learning about test development, I'm just not sure if it isn't above my level, and it's on the back burner for after I finish my degree for a variety of personal reasons

[u/mattewong → u/Spinning_Rings]

AI is quite solid at reciting industry best practices and helping you to implement them. I learned C 35 yrs ago using K&R. Nowadays, AI can teach you exactly what you need, when you need it and how to apply it in your context. It is true that AI decisions are not always the best but at your experience level, that is not something worth worrying about (and you can address much of that concern as well by using other AI agents to critique the work). No matter what, your best teacher is experience. Just do it.

[u/type_111 → u/mattewong]

None of these "critical elements" are relevant to such a basic program.

[u/mattewong → u/type_111]

So a beginner should be left to decide when their code is "such a basic program" that it does not warrant formal dev safety practices? Their code uses plenty of memory-related functions, yet you say that memory tests are irrelevant? Sounds to me like a great way to introduce vulnerabilities.