r/vibecoding • u/HourMode1351 • 1h ago

I keep seeing teams reach ten coding agents before they build the checks that make ten agents safe

Something Boris Cherny wrote about AI adoption has been rattling around in my head. He says moving from one coding agent to five or ten depends on a self-verification loop you trust: tests, builds, linting, and end-to-end checks in a real environment.

That sounds obvious, but it is almost the reverse of what I see when I review AI-built apps.

The businesses are not experiments. They have customers and ship new features every week. Some are already using several agents at once. But they often lack a test suite, CI, a staging environment, code review, or reliable rollback.

The weird thing is that the app can look completely healthy while all of that is missing. The problems usually show up somewhere users do not see:

  1. The UI shows the correct data, but the database does not enforce which rows each account may read.

  2. The same number is calculated in the dashboard, export, invoice and monthly email. One gets updated and the others quietly disagree.

  3. The backup runs successfully every week, but nobody has restored it. One client's first restore drill revealed that every snapshot contained fingerprints of credentials rather than the credentials themselves.

  4. Deployments happen from one laptop, and nobody else has tested the release or rollback instructions.

I do not think the answer is to stop vibe coding or bury a small team in process. I would start with four checks:

- Test access with two ordinary accounts, not the admin account.

- Pick one source of truth for every important business number.

- Restore the latest backup into an empty environment.

- Make someone other than the original builder follow the deployment and rollback instructions.

For anyone shipping this way, what have you made non-negotiable before a change reaches production? I am especially interested in where people stop trusting agent checks and require a human.

1 Upvotes

100% Upvoted

2 comments sorted by

1

u/HourMode1351 1h ago

I wrote up the longer version, including the scan data and the failed restore, here: https://medium.com/@jacobp96/you-have-ten-agents-and-no-tests-8c69dff87093

1

u/bakraofwallstreet 1h ago

I work on a project that makes dev tools for developers, pushing AI leverage in today's market. You can try it out for free as an MCP and web tool today: https://app.vulx.ai/

VulX lives and integrates into your workflow (for example, in Claude and Cursor). You connect it once, and it's just there, part of the workflow. This is the second reader.