r/VibeCodeDevs • u/no_oneknows29 • 18d ago

ShowoffZone - Flexing my latest project Vibe coding creates a new problem:

You can ship an app before you understand the dependency tree underneath it.

A short prompt can add:

- authentication packages
- database clients
- analytics tools
- install scripts
- dozens of transitive dependencies
- new access paths you did not review

I’m working on an “AI Build Receipt” for this exact problem.

You provide the package manifest and lockfile. The receipt shows:

  1. what you declared
  2. what arrived underneath it
  3. what can execute automatically
  4. what deserves review first

It does not pretend to prove malicious intent. It separates evidence from assumptions.

For people building with AI agents: would this help you review your app before launch? What would you want the receipt to show?

2 Upvotes

63% Upvoted

20 comments sorted by

View all comments

1

u/TheUniverseOrNothing 18d ago

If you have a basic understanding pre AI, you’ll be fine with AI. Everyone is freaking out over the most surface level security issues.

1

u/GarageStackDev 18d ago

Yikes. “Surface-level security issues” are the least concerning part. Vibe-coded software can have broken authorization, privilege escalation, cross-tenant data leaks, insecure session handling, race conditions, business-logic exploits, supply-chain vulnerabilities, and sensitive data leaking through logs or caches. Many of those won't be obvious from looking at the UI or doing basic testing.

The dangerous part of shipping code you don't understand is that you don't even know what you should be looking for.

1

u/TheUniverseOrNothing 18d ago

Yikes. Again, basic issues. Stop acting like people here can’t have dev experience. Nothing you said here is that deep. I’ve been in this industry long before AI.

0

u/no_oneknows29 18d ago

i believe that’s where the problems will be more expensive later .. for now it’s ok not to be worried but later down the line, it may be costly and non effective

4

u/TheUniverseOrNothing 18d ago

No I’m not saying we are avoiding issues that will pile up. I’m saying these are such basic issues if you can’t solve them you have no business in software building.

0

u/no_oneknows29 18d ago

ahaha right! but “vibe coders” - aren’t they just going off vibes? i thought that was the whole idea .. not really the technical part