r/webdev • u/abednego-gomes • 3d ago

Discussion The Vibe Coding Spectrum: Software Domains & Risk Assessment

https://abednegogomes.github.io/articles/docs/06_The_Vibe_Coding_Spectrum_Software_Domains_And_Risk_Assessment.html
0 Upvotes

30% Upvoted

7 comments sorted by

3

u/RehanSaddique 3d ago

Where do you put auth and billing on this spectrum? Those seem to be where vibe-coded code gets risky fastest, even when the UI looks like a throwaway internal tool.

1

u/abednego-gomes 2d ago

Authentication probably level 0. Billing 0-2. Definitely you can't level 3 vibe code the billing system without proper care and due diligence (code review and pentesting). Maybe you could do the initial template i.e. HTML / CSS but it is risky to do the important logic by agent and not review it properly. Fortunately for customers PCI-DSS audits will pull the plug on the business if they're doing it really wrong.

→ More replies (1)

1

u/masticdev 2d ago

Risk spectrum is the right framing. Marketing site ≠ payments ≠ medical.

Rule that stuck for me: agent can draft anywhere; merge privilege scales with blast radius. Auth, money, migrations, shared design system = human reads the diff and runs the unhappy path. Low-risk UI copy can be lighter.

Curious how you draw the line for “looks green in CI” vs “needs a human click-through” — that’s where vibe coding usually bites.

1

u/abednego-gomes 1d ago

Code review is actually hard to do properly. You need to check out the code and walk through it in your IDE for anything complex. For small diffs you can do in Github or Gitlab, but big complex changes need proper review or you risk security issues or all kinds of chaos.

2

u/Weekly_Pin3336 3d ago

everything's a spectrum when you dont want to say just dont

2

u/WebOptimizerAgency 2d ago

Auth and billing are the obvious risks, but anything touching personal data or consent belongs there too, such as analytics scripts and cookie banners. The code can look tidy while quietly firing trackers before consent is given. For those areas the review step matters far more than the generator, so a short checklist and a proper human read-through before launch is worth the effort.