Vibecoding: a beginner's guide

Scary_Turtle said:
I hope you are adding all your security checks or only using this as an internal project that doesn't touch the internet.

The vibe coded things are coming through in pentests and have huge security flaws.

Even programs that have been pentested aren’t safe. Someone decides to “clean up” the code, dumps it into an AI without any of the context, and the AI strips out chunks that existed for a reason. Suddenly, an application that’s been tested for a decade is vulnerable to XSS, SQL injection, etc.
Click to expand...
Could real programmers please share some good practices and what to check for example the vulnerabilities such as XSS and SQL injection etc.
 
Last edited:
RedViking said:
Could real programmers please share some good practices and what to check for example the vulnerabilities such as XSS and SQL injection etc.
Click to expand...
owasp.org

OWASP Top Ten Web Application Security Risks | OWASP Foundation

The OWASP Top 10 is the reference standard for the most critical web application security risks. Adopting the OWASP Top 10 is perhaps the most effective first step towards changing your software development culture focused on producing secure code.
owasp.org owasp.org

Unfortunately many coders don't have a through security understanding.
 
This is the world I find myself in.
As a human, having to try and compete with machines and Gen Z that is so "excited about AI" is killing me- that they hand over entire code bases to AI and then the bosses tell the big bosses "Oh quality went down because the staff were slacking sir, we've canceled WFH so it should get better". Quality isn't getting better, AI has removed stuff without context, and now the ship is up the creek, without a paddle. Nobody knows where AI broke the code.. so here we sit, with customers dropping the product one by one, and potential lawsuits, and I sit in the still factory- no production being done because orders dried up.

I am telling you now that my current employer will go tits-up soon.. giving it 10 months tops.. I see the brown stuff heading for the fan.

This has happened because the bosses don't care about anything except the fancy graphs on TFS. Lines of code written in a day and tickets resolved > quality.
 
EmmanuelGoldstein said:
This is the world I find myself in.
As a human, having to try and compete with machines and Gen Z that is so "excited about AI" is killing me- that they hand over entire code bases to AI and then the bosses tell the big bosses "Oh quality went down because the staff were slacking sir, we've canceled WFH so it should get better". Quality isn't getting better, AI has removed stuff without context, and now the ship is up the creek, without a paddle. Nobody knows where AI broke the code.. so here we sit, with customers dropping the product one by one, and potential lawsuits, and I sit in the still factory- no production being done because orders dried up.

I am telling you now that my current employer will go tits-up soon.. giving it 10 months tops.. I see the brown stuff heading for the fan.

This has happened because the bosses don't care about anything except the fancy graphs on TFS. Lines of code written in a day and tickets resolved > quality.
Click to expand...
Then this is where you step in to save your job and move into a management role. Teach them about peer review and AI governance.
 
EmmanuelGoldstein said:
This is the world I find myself in.
As a human, having to try and compete with machines and Gen Z that is so "excited about AI" is killing me- that they hand over entire code bases to AI and then the bosses tell the big bosses "Oh quality went down because the staff were slacking sir, we've canceled WFH so it should get better". Quality isn't getting better, AI has removed stuff without context, and now the ship is up the creek, without a paddle. Nobody knows where AI broke the code.. so here we sit, with customers dropping the product one by one, and potential lawsuits, and I sit in the still factory- no production being done because orders dried up.

I am telling you now that my current employer will go tits-up soon.. giving it 10 months tops.. I see the brown stuff heading for the fan.

This has happened because the bosses don't care about anything except the fancy graphs on TFS. Lines of code written in a day and tickets resolved > quality.
Click to expand...
And I bet you issues started showing long before AI was introduced. AI is just a tool. Good practice and code review should not disappear.
 
RedViking said:
And I bet you issues started showing long before AI was introduced. AI is just a tool. Good practice and code review should not disappear.
Click to expand...
I wasn't at this company at the time but yes. No evidence of any good practices. Code reviews were done but there's no documentation for anything. And on top of that a culture of "need to know" because the former company owner was a paranoid sort.
 
AI is a tool, nothing more.
A recent example is my weekend projects.
I asked AI to write a function for me in C to calculate the CRC-16 of a packet but to use the PROFIBUS variant.

On the backend side, I am writing the code in Golang. It got that right on the first try.
On the front end, a piece of IoT I am making for myself, written in C, it keeps insisting the CRC polynomial is 0x1021.

No big deal, since I understand the code I just modified the offending line of code to make it work.

So yes, AI is a massive time-saver PROVIDED you UNDERSTAND THE CODE AND YOU CAN ARTICULATE WHAT YOU WANT.
If I was an uneducated vibe-coder... the whole thing would not work, and no clue why.

AI does not replace a programmer, it merely provides help with all the KAK jobs, things I can't be arsed to write anymore.
 
EmmanuelGoldstein said:
AI is a tool, nothing more.
A recent example is my weekend projects.
I asked AI to write a function for me in C to calculate the CRC-16 of a packet but to use the PROFIBUS variant.

On the backend side, I am writing the code in Golang. It got that right on the first try.
On the front end, a piece of IoT I am making for myself, written in C, it keeps insisting the CRC polynomial is 0x1021.

No big deal, since I understand the code I just modified the offending line of code to make it work.

So yes, AI is a massive time-saver PROVIDED you UNDERSTAND THE CODE AND YOU CAN ARTICULATE WHAT YOU WANT.
If I was an uneducated vibe-coder... the whole thing would not work, and no clue why.

AI does not replace a programmer, it merely provides help with all the KAK jobs, things I can't be arsed to write anymore.
Click to expand...
I am an uneducated vibe coder. I ask AI to explain everything. Also try to learn and educate myself along the journey. What would never have been possible in my life is now possible.
 
RedViking said:
I am an uneducated vibe coder. I ask AI to explain everything. Also try to learn and educate myself along the journey. What would never have been possible in my life is now possible.
Click to expand...
Yes, and that's also a good thing. It will get better as well. The trick is to find the right balance, but also not to think that humans will be replaced outright.
 
EmmanuelGoldstein said:
Yes, and that's also a good thing. It will get better as well. The trick is to find the right balance, but also not to think that humans will be replaced outright.
Click to expand...
What would be awesome is if I can follow good enough practice to hand over the fully functional and well implemented project to a senior dev to finalise and push for production, I'm a specially pedantic about security.
 
RedViking said:
What would be awesome is if I can follow good enough practice to hand over the fully functional and well implemented project to a senior dev to finalise and push for production, I'm a specially pedantic about security.
Click to expand...
Before shipping, get yourself a once off sub to a competitor platform, prefreably pay as you go for their most powerful engine, then ask it to critique the code (no changes made), specifically in the security department and according to OWASP top 10... take that output and feed your original LLM, asking it it's 'opinion' on those findings.

Weigh up for yourself the output from the two based on your own research and see if anything needs to be done. It can be done properly with an LLM but you'll learn alot in the process - that's a big take-away.
 
For me the biggest questions with security are:

1) What am I collecting and why am I collecting it (data)? Do I really need to collect it, because what I don't collect can't be stolen on my watch.
2) Am I applying best practice for securing everything sensitive? If it is stolen or accidentally leaked, can I point to the best practices and say we did our best?

One of my fav things is to NOT collect any contact details for people who sign up if I don't have to. Outsource authentication to OAuth providers (Microsoft, Google, Meta) and don't store anything locally if not required - hash it if you have to store to compare it (e.g. if you want people to login with email + password, then hash both the email and the password and use it for verification only - that way you're not storing anything personal). If you want to communicate with people (usually why you collect email), you do it within the app itself through a messaging interface with the user account, not via public email. For the times you need to email someone, you ask them to provide their email, you compare it to the hashed email address you have against their account and you send them an email at that point (e.g. resetting password etc.), but they have to provide the email address and you never store it.
 
JerryMungo said:
Before shipping, get yourself a once off sub to a competitor platform, prefreably pay as you go for their most powerful engine, then ask it to critique the code (no changes made), specifically in the security department and according to OWASP top 10... take that output and feed your original LLM, asking it it's 'opinion' on those findings.

Weigh up for yourself the output from the two based on your own research and see if anything needs to be done. It can be done properly with an LLM but you'll learn alot in the process - that's a big take-away.
Click to expand...
In my planning for the prototype, interesting enough Claude has already mentioned implementing OWASP as part of the auditing.

So far I have been jumping between Google AI Studio, Claude and ChatGPT , using all 3 in conjunction as I run out of tokens and sharing the input across all 3 to get different perspectives and opinion of the alternatives. Then I notice there are areas where they overlap or are in agreement and seems like solid advice.

The thing is I need to now subscribe to one of them so I can move from planning/specification to prototype. I have a prototype created with Google AI Studio which has been under many reviews , however it was to learn and understand how these platforms and this technology works. I also realise there are things I didn't actually need and to narrow the scope of the project. So I am now going back to writing the Specification and the continue with the paid plan on one of these platforms. Currently it is estimated to be a 30 000 - 50 000 lines of code project, but I'm going to reduce it in narrowing the project.

To give some perspective I have taken my knowledge of the last 20 years in the construction industry and I am building a structural calculator and a compliance checker for builders and designers. The first stage is to get a working prototype , then an internal review and testing among the team , and then finally get it properly reviews and then taking to the Building Council and Research Institute and then go Public.

There is a problem though. Finances.

I really enjoy Claude so far and thinking to go with the pro plan, but my concern is token limits. I can't afford the highest plan right now, we are busy with retrenchments, part of the problem is due to the complicated standards and compliance requirements it's too expensive for people to even start the building process, and I hope this can cut down hours and weeks of work as well as make the team more efficient.

Now rambling....
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X