After using a lot of AI-generated code lately, I've found myself spending a lot of hours on checking and repairing a lot of easy-to-spot security flaws. That being said, AI generally sucks at actually implementing secure code (or architectures), as well as recommending what to do to make your app more secure (sometimes even decently secure).
Have you had this problem as well? If yes, how do you tackle it?
Had a moment this week where a bug showed up in a part of the app I didn't write by hand, my agent did, and when someone asked me why it broke, my honest answer was "I'm not totally sure yet." That's a weird sentence to say out loud as the person who's supposed to own the code.
With code I wrote myself I can usually reason about a bug from first principles even before I open the debugger. With vibe-coded stuff I sometimes have to re-read the whole file like a stranger before I can explain anything, and the explanation ends up being "here's what I found after digging" instead of "here's why this happens."
Ran into this a bunch while vibecoding with longer agent runs.
The agent confidently starts building something a teammate already tried months ago and closed the PR on. It has no way to know, because git only keeps what got merged. Every rejected attempt, and the reason it was rejected, just isn't there. So the agent happily walks into the same wall.
The reasoning behind a codebase (why the timeout is 30, why an approach got dropped) lives in closed PRs and reviews nobody reads again. Your agent can't see any of it.
How are you all handling this? Do you paste past decisions into context by hand, keep a decisions doc, or just catch it in review? Genuinely curious what's working, because review-only has not been enough for me.
Do you just wait, work on something else, or review the changes as they happen?
For me, every commit tells a story. To really understand the code, I first need to understand why each change was made and how it fits into the bigger picture.
That s why I try to stay involved while the agent is working reviewing the diff, creating a issues, following the logic, and making sure it s heading in the right direction.
Real question for anyone running coding agents daily.
I started counting how often Claude Code and Codex ask for permission during a typical session. It's around 100 prompts per hour. Read file? Yes. Run test? Yes. Lint? Yes. git push --force? Also yes if you're zoned out.
I m curious how others here are thinking about the last mile of vibecoded apps.
It feels like we ve crossed the first threshold: solo founders and small teams can now ship useful products much faster with Cursor, Lovable, Replit, Claude, codex, etc.
Vibecoding gave me speed, and quietly took something back. A clear picture of what I'm actually building.
I can see every diff. The AI ships feature after feature. But when I zoom out, I've lost the thread. What's really in here now, how the pieces fit, whether I'm still heading where I meant to go. The commits tell me what changed. Nothing tells me what it means, or where it's quietly drifting.
When I wrote everything myself, that map lived in my head for free. Now the code moves faster than my understanding of it, and the gap keeps widening.
So for people building fast with AI: what keeps you oriented? A tool, a ritual, or do you just trust the diffs and hope the shape holds?
Saw a stat recently that stuck with me: 92% of U.S. developers now use AI coding tools daily, but only 29% actually trust the code those tools produce. That gap is wild when you sit with it; we've fully adopted the workflow before we've actually resolved whether we believe in the output. Tech Xplore
Vibe coding specifically (prompt-driven, minimally governed AI coding) is being pulled apart from more disciplined AI-accelerated and agentic engineering workflows as companies figure out where "move fast" actually breaks things. Gartner's projecting 40% of new enterprise production software will be built with vibe coding techniques by 2028, which is a lot of surface area for the same trust gap to show up in. Tech Xploredaily.dev
