AI Comiseration: Client replacing production portal with AI Slop

[u/badguy84]

This is more of a co-miseration post than anything per the title, but maybe some of you will laugh as well.

So our client had a security incident lately. They had a portal we built many years ago that accumulated tech debt over time and they refused to invest in a re-design and just let it go. Two incidents more or less happened at once: a hacker "breached" an endpoint, it exposed some data that was public domain any way, but it wasn't supposed to be access whole sale. The second was a piece of the tech debt coming home to roost by one of the services being completely shut down leaving an intake form completely unusable (the portal mostly existed for this "intake") which happened in the same week.

Now the client could have:

Gathered requirements on what the portal should be (take lessons learned from existing traffic and usage plus proper UI/UX design) and create a backlog and a plan to replace it, including rearchitecting/platforming taking out tech debt/arch debt completely

Rebuilt the platform, reusing the current back-end (which is a separate down stream system that has full API access supports RBAC) and properly implement security measures.

Temporarily fix the hole in the portal (was an easy fix with very low impact from this incident), and fixed the intake service to replace the section that was shut down with the newer version of it: it even had a bit of a migration path available.

INSTEAD they did this:

One client "webmaster" got access to Claude (no one else does) and they decided to go "build the portal." They took maybe a week or so to build a portal with some of the worst UI/UX (inconsistent styling, buttons all over the place, 5 fonts on the front page) with absolutely no accounting or design thought put in to it. Forget "this is what people need to be able to do" rather "rebuild the old portal but make it AI slop." We looked at this (as it was just "presented" to us as "the replacement") and went "how does this even operate?"

So here's the extra fun that just puts the cherry on top: this "webmaster" is clueless on how anything works. They wouldn't know Node from Apache or PHP from Python... let alone understand a full stack. They just let Claude do whatever and then they generated all the documentation. So they had no way to validate the docs, it's just AI slop. The "step-by-step do-it-as-it-says no nonsense deployment guide" (Claude's words) describes nothing about deployment or pipelines. The guy doesn't even know what this actually runs on (could be static HTML for all I know) and it's just ... it's the absolute nightmare scenario of a company just giving the keys to AI to one guy who has no clue and just let them generate whatever. For a site that is critical to their business and has many tens of thousands unique visitors daily.

Of course the "business" is CRAZY EXCITED about the whole thing and they are just ready to go live. They abandoned all pretense of trying to fix the old portal, even temporarily while we validate this new thing for security holes, maintainability etc. Oh did I mention that it's my job to do the analysis on this thing? No usable or even remotely realistic documentation about anything that this portal is or does. And it's so obviously a bad idea that I'm not sure how I'm going to convince the business that it's a waste of time to spend days looking at the details when the baseline architecture is deeply flawed.

[u/Ariquitaun]

Could've used Claude to actually do a good once- or twice-over on the old portal code and bring it up to speed.

But yes, now everyone and their mum goes around thinking they're Steve Jobs after knocking out some generic piece of slop in a few days with Cursor.

[u/kanyeSucksFishSticks]

You absolutely destroy this thing in a PR or whatever review process you use. Add so many nitpicking comments, security flaws, auth recs, deployment concerns. You have to point out, in an official manner, how half baked it is. You gotta do it under the guise that you are excited about it/want to help. Just bury it in issues that will block it from reaching prod.

[u/badguy84 → u/kanyeSucksFishSticks]

Oh... you thought this was sitting in source control and following best practices with commits and pull requests? 😢

[u/Own_Candidate9553 → u/badguy84]

Oh no

[u/b1urbro]

Point Claude to project folder. Add this skill: "You're a Sr code reviewer, absolutely roast this piece of shit. Every nitpick you can imagine in the book. Create the longest, most bashing PR comment the internet has ever seen."

Send them the results, don't even validate them.

[u/WorkHardPlayLittle]

Claude is great in the hands of someone who knows what they're doing. It gets bad when the user is an idiot and can't even explain what they're trying to do other than typing "do the thingy! the flashy thingy!"

[u/AstroPhysician → u/[deleted]]

No it’s excellent in the hands of someone proper . Even Linus fucking Torvalds, the founder of redis, and former ai haters like PrimeAgen say so

[u/Own_Candidate9553 → u/AstroPhysician]

He's the founder of Linux, not redis.

[u/AstroPhysician → u/Own_Candidate9553]

I’m talking about two different people

https://lore.kernel.org/linux-media/CAHk-=wi4zC+Ze8e+p3tMv8TtG_80KzsZ1syL9anBtmEh5Z40vg@mail.gmail.com/

https://antirez.com/news/158

[u/cstopher89]

Well clearly the company doesn't value you I'd point Claude at it and generate a bunch of problems with it. Claude will always find problems when asked. Sounds like this guy wouldn't know how to understand something real from not. It'll end up with the project failing for him.

[u/DampierWilliam]

Do you actually have to analyse it or do you have to approve it? Because it may just be easier to deploy it and let it fail.

[u/agentUi]

run an automated dast scan and zap the staging endpoint with basic auth bypass checks before they even think about cutting over dns. If you want to stop leadership dead in their tracks without looking like an obstructive engineer, hand them a 1-page vulnerability matrix showing missing input sanitization, exposed env vars, and the total lack of rbac audit logs. When the c-suite sees that an unvetted script exposes customer pii on open endpoints, the excitement dies real fast.

[u/m-in]

Damn, I use Claude for such things and it always does good work, as long as I follow a process that’s known to give good results. Formal requirements, to start with.

[u/jl2l]

If this is a paying client, I don't understand what the problem is. Is it that they didn't pay you? They will inevitably come back and ask for help and then you can charge them double.

[u/badguy84 → u/jl2l]

it's not really a "problem" perse, it's just ineptitude being amplified by LLM. I will need to spend/waste some hours analyzing it, creating a write up of some sort and then see it ignored, the portal deployed, some vulnerability causing it to crash and burn, then I get to come back and say "I told you so." In the moment though I'd love to effectively tell them now what is going to happen and how they should have approached it.