66
Vibe Coding Has a Security Problem Nobody Wants to Talk About (mothasa.substack.com)
submitted 8 months ago by to c/programming@programming.dev
23 comments fedilink hide all child comments
 

AI-generated code is shipping to production without security review. The tools that generate the code don't audit it. The developers using the tools often lack the security knowledge to catch what the models miss. This is a growing blind spot in the software supply chain.

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 8 months ago

HITL

AI augmented > AI generated.

Human review with AI co-review > AI generated review.

Human-arranged AI augmented documentation > AI documentation which always seems to believe that the most innocuous comment spelling correction is the most important change..

If you completely remove humans from the development cycle then you don't know what's in your codebase anymore.

  • permalink
  • fedilink
  • source
    •