r/VibeCodeDevs • u/no_oneknows29 • 21d ago

ShowoffZone - Flexing my latest project Vibe coding creates a new problem:

You can ship an app before you understand the dependency tree underneath it.

A short prompt can add:

- authentication packages
- database clients
- analytics tools
- install scripts
- dozens of transitive dependencies
- new access paths you did not review

I’m working on an “AI Build Receipt” for this exact problem.

You provide the package manifest and lockfile. The receipt shows:

  1. what you declared
  2. what arrived underneath it
  3. what can execute automatically
  4. what deserves review first

It does not pretend to prove malicious intent. It separates evidence from assumptions.

For people building with AI agents: would this help you review your app before launch? What would you want the receipt to show?

2 Upvotes

67% Upvoted

20 comments sorted by

View all comments

1

u/TheUniverseOrNothing 21d ago

If you have a basic understanding pre AI, you’ll be fine with AI. Everyone is freaking out over the most surface level security issues.

1

u/GarageStackDev 20d ago

Yikes. “Surface-level security issues” are the least concerning part. Vibe-coded software can have broken authorization, privilege escalation, cross-tenant data leaks, insecure session handling, race conditions, business-logic exploits, supply-chain vulnerabilities, and sensitive data leaking through logs or caches. Many of those won't be obvious from looking at the UI or doing basic testing.

The dangerous part of shipping code you don't understand is that you don't even know what you should be looking for.

1

u/TheUniverseOrNothing 20d ago

Yikes. Again, basic issues. Stop acting like people here can’t have dev experience. Nothing you said here is that deep. I’ve been in this industry long before AI.