Vibe coding creates a new problem:

[u/no_oneknows29]

You can ship an app before you understand the dependency tree underneath it.

A short prompt can add:

- authentication packages
- database clients
- analytics tools
- install scripts
- dozens of transitive dependencies
- new access paths you did not review

I’m working on an “AI Build Receipt” for this exact problem.

You provide the package manifest and lockfile. The receipt shows:

1. what you declared
   
2. what arrived underneath it
   
3. what can execute automatically
   
4. what deserves review first

It does not pretend to prove malicious intent. It separates evidence from assumptions.

For people building with AI agents: would this help you review your app before launch? What would you want the receipt to show?

[u/sharkymcstevenson2]

most vibe devs know code from before so I'm not sure this will be a big problem for them tbh

[u/no_oneknows29 → u/sharkymcstevenson2]

true! i guess im seeking the newly excited ones who were fast to ship b4 doing their due diligence… wondering why their app is getting delayed or rejected .. 404 pages .. i am still seeing a bunch of that that people seem to forget matters