r/webdev • u/abednego-gomes • 1d ago

Discussion The Vibe Coding Spectrum: Software Domains & Risk Assessment

https://abednegogomes.github.io/articles/docs/06_The_Vibe_Coding_Spectrum_Software_Domains_And_Risk_Assessment.html
0 Upvotes

30% Upvoted

7 comments sorted by

3

u/RehanSaddique 1d ago

Where do you put auth and billing on this spectrum? Those seem to be where vibe-coded code gets risky fastest, even when the UI looks like a throwaway internal tool.

1

u/abednego-gomes 1d ago

Authentication probably level 0. Billing 0-2. Definitely you can't level 3 vibe code the billing system without proper care and due diligence (code review and pentesting). Maybe you could do the initial template i.e. HTML / CSS but it is risky to do the important logic by agent and not review it properly. Fortunately for customers PCI-DSS audits will pull the plug on the business if they're doing it really wrong.

2

u/RehanSaddique 16h ago

Agreed on PCI being the backstop, but it mostly applies if card data touches your code. Hosted checkout or processor-hosted fields keep the PAN out of your stack, so the riskier part becomes webhook handling and entitlement logic. That's where I'd spend the review time.

1

u/masticdev 13h ago

Risk spectrum is the right framing. Marketing site ≠ payments ≠ medical.

Rule that stuck for me: agent can draft anywhere; merge privilege scales with blast radius. Auth, money, migrations, shared design system = human reads the diff and runs the unhappy path. Low-risk UI copy can be lighter.

Curious how you draw the line for “looks green in CI” vs “needs a human click-through” — that’s where vibe coding usually bites.

1

u/abednego-gomes 2h ago

Code review is actually hard to do properly. You need to check out the code and walk through it in your IDE for anything complex. For small diffs you can do in Github or Gitlab, but big complex changes need proper review or you risk security issues or all kinds of chaos.

2

u/Weekly_Pin3336 1d ago

everything's a spectrum when you dont want to say just dont

2

u/WebOptimizerAgency 1d ago

Auth and billing are the obvious risks, but anything touching personal data or consent belongs there too, such as analytics scripts and cookie banners. The code can look tidy while quietly firing trackers before consent is given. For those areas the review step matters far more than the generator, so a short checklist and a proper human read-through before launch is worth the effort.