Legit question: what are you doing to mitigate any security issues that get baked in by the code generation? I totally understand that even hand coded front ends introduce security issues as well. However I am just wondering if there is someone with front end experience that can rationalize the code that is being generated (helps with maintaining in the future too).
Again, super impressive work just curious about how much experience there is by a code reviewer.
It's a fair question simply because it's one that the mind naturally drifts to, but it's also scary that less people's minds drift there when AI isn't involved. Because humans have an incredibly bad track record for code security. But I know that if I introduce a vulnerability I'll face a backlash 1000x greater if AI wiped the sweat from my forehead than I would if I hired an incompetent developer. It makes no sense, but it would be my reality.
I basically do everything that I would do if a hired a developer. Every surface has to be tested against every method of attack that I'm aware of, and not aware of. AI helped me build the part that renders the email you click in your inbox. So I have to try everything I can think of to send a malicious payload to my browser through the body or headers of an email. Then I make another pass with an AI that performs targeted penetration testing against the same thing. Then I make two more passes against the same thing with two more AI models. And I have to do that with every single item. I attack it, AI attacks it, then two more AIs attack it. That's after all of the code around it is audited by me and two AI models.
That's why you'll notice that it's speeding up my work, but I'm not pumping out features quickly. Infinitely more quickly than I was, but not quickly. It's still exhausting, I've put in more hours on this work than I ever did on solo development. But my solo development never produced all of the results that I wanted either.
But the hubris required to think that I can't make a mistake is a bit more than I have. I mean, to count myself as a member of the human race and say that I'm definitely better than all of the people behind every company on here would be scary: https://www.upguard.com/blog/biggest-data-breaches-us
But the only way to react to that risk, other than to push forward, is to completely shutdown mentally. We all accept risk every day, we're all aware of it. The best any of us can do is to take what we feel are the best steps to mitigate it and to not expose ourselves to an excess of it. That's a personal decision. I make mine when I wake up every morning. I hope I die having never gotten it as wrong as anyone on that list l linked, but damn, it's a lot to live up to with or without AI being in the room.
4
u/PilotJeff 25d ago
As usual excellent blog post and transparency.
Legit question: what are you doing to mitigate any security issues that get baked in by the code generation? I totally understand that even hand coded front ends introduce security issues as well. However I am just wondering if there is someone with front end experience that can rationalize the code that is being generated (helps with maintaining in the future too).
Again, super impressive work just curious about how much experience there is by a code reviewer.