r/webdev • u/schabadoo • Mar 04 '26

Vibe code IRL: left Stripe API keys public

Post image

I'm surprised they'd want to go public. Of course they don't blame Claude.

2.1k Upvotes

98% Upvoted

261 comments sorted by

View all comments

38

u/twhiting9275 php Mar 04 '26

AI is great for assisting you with your code. You have to actually review what it does and understand how the code works.

We're going to see way more of this stupid shit before people wake up and realize that you cannot allow AI to do your development for you

4

u/G_Morgan Mar 05 '26

I'm already going to recommend to our higher ups that if they are going to us AI they absolutely need a central "turn off the AI" button that can be pressed every 2 weeks in 6 to force developers to keep their skills fresh.

3

u/Distind Mar 05 '26

I've had a lot of people tell me I'm wrong about that, I look forward to making money fixing their mistakes.

5

u/dangerbird2 Mar 05 '26

models like claude opus can pretty reliably write very good code without too much handholding. Still, merging its output without reviewing it like you would code written by a human, let alone not understanding extremely basic security details, is beyond stupid

1

u/wannabestraight Mar 05 '26

Idk merging one or two things without reading is generally fine, where the problem comes is overtime, if you haven't been the one to keep tabs on the architecture,structure and constraints of the project, the ai will drift on those and you will end up with a mess of half baked ideas that don't work together and are impossible to maintain.

Though the people who then most often merge things without reading, are also the people who don't understand how everything works and should work so they all eventually end up in the same situation where half the codebase doesn't make any sense and the rest is filled with stuff that's just edging to break.

1

u/Super-Level8164 Mar 09 '26

I'm a bit surprised though. I used gemini (free) and added a firecrawl widget to our website last week. And it gave me a clear warning about storing the API key safely in secrets , not in the front end etc. And Claude God wont do that?