Vibecoding: a beginner's guide

JerryMungo said:
1) What am I collecting and why am I collecting it (data)? Do I really need to collect it, because what I don't collect can't be stolen on my watch.
2) Am I applying best practice for securing everything sensitive? If it is stolen or accidentally leaked, can I point to the best practices and say we did our best?
Click to expand...
This is very sensible.
 
JerryMungo said:
For me the biggest questions with security are:

1) What am I collecting and why am I collecting it (data)? Do I really need to collect it, because what I don't collect can't be stolen on my watch.
2) Am I applying best practice for securing everything sensitive? If it is stolen or accidentally leaked, can I point to the best practices and say we did our best?
Click to expand...

So this is where I also want to change the scope of the project at this stage. I do not think I should be collecting much info except what is necessary for the application to work. I am thinking however to give export function and then when ever someone uses they application they either import their saved file or link it from an online drive such as Google Driver or One Drive. That way I dont have that information stored on the server.

Where it does get a bit complicated is with in the Software there needs to be different profiles for each of the projects, so I need to make sure information are not shared or linked between the projects within the software.

But yes, a lot of research and planning to do to get the specification ready.
 
RedViking said:
Where it does get a bit complicated is with in the Software there needs to be different profiles for each of the projects, so I need to make sure information are not shared or linked between the projects within the software.
Click to expand...
Yes, this is not unusual, but doable with GUIDs or other unique IDs guiding the data boundaries.
 
RedViking said:
In my planning for the prototype, interesting enough Claude has already mentioned implementing OWASP as part of the auditing.

So far I have been jumping between Google AI Studio, Claude and ChatGPT , using all 3 in conjunction as I run out of tokens and sharing the input across all 3 to get different perspectives and opinion of the alternatives. Then I notice there are areas where they overlap or are in agreement and seems like solid advice.

The thing is I need to now subscribe to one of them so I can move from planning/specification to prototype. I have a prototype created with Google AI Studio which has been under many reviews , however it was to learn and understand how these platforms and this technology works. I also realise there are things I didn't actually need and to narrow the scope of the project. So I am now going back to writing the Specification and the continue with the paid plan on one of these platforms. Currently it is estimated to be a 30 000 - 50 000 lines of code project, but I'm going to reduce it in narrowing the project.

To give some perspective I have taken my knowledge of the last 20 years in the construction industry and I am building a structural calculator and a compliance checker for builders and designers. The first stage is to get a working prototype , then an internal review and testing among the team , and then finally get it properly reviews and then taking to the Building Council and Research Institute and then go Public.

There is a problem though. Finances.

I really enjoy Claude so far and thinking to go with the pro plan, but my concern is token limits. I can't afford the highest plan right now, we are busy with retrenchments, part of the problem is due to the complicated standards and compliance requirements it's too expensive for people to even start the building process, and I hope this can cut down hours and weeks of work as well as make the team more efficient.

Now rambling....
Click to expand...
Why chop and change between them, and be constrained by their specific models?

Just use something like Kiro which gives you access to the Anthropic, OpenAI and open weight models. And it's spec driven. You can set your own workflow - something like Opus or whatever other frontier model for the important stuff like your requirements and design, Sonnet for coding, cheaper models like Minimax for grunt work like PBT. When you need to debug you pick the most appropriate depending on the complexity of the bug.

Works out wayyyyyy cheaper when you set you own workflow across a combination of all models. And no time limit BS limitations...
 
Mike Hoxbig said:
Why chop and change between them, and be constrained by their specific models?

Just use something like Kiro which gives you access to the Anthropic, OpenAI and open weight models. And it's spec driven. You can set your own workflow - something like Opus or whatever other frontier model for the important stuff like your requirements and design, Sonnet for coding, cheaper models like Minimax for grunt work like PBT. When you need to debug you pick the most appropriate depending on the complexity of the bug.

Works out wayyyyyy cheaper when you set you own workflow across a combination of all models. And no time limit BS limitations...
Click to expand...
I am not familiar with this. Will look into it. Cheers! Any other tips please. :)
 
Mike Hoxbig said:
Works out wayyyyyy cheaper when you set you own workflow across a combination of all models. And no time limit BS limitations...
Click to expand...
Not sure what you mean by the time limit BS limitations. Kiro has credit capped limits and premium models consume credits at different multipliers. Not sure it's proven to be cheaper - what metrics do you base that on, you can use cheaper models within a any provider.

The spec first approach is the only way to do anything significant though, that I do like about Kiro's approach - Anthropic's own staff highly recommend that. It helps you get on the same page as the LLM and iron out the details before you start, saving time and rework in the long run.
 
Last edited:
JerryMungo said:
Not sure what you mean by the time limit BS limitations. Kiro has credit capped limits and premium models consume credits at different multipliers.
Click to expand...
And I prefer the credits system, you know exactly how much you have remaining and can buy more prepaid credits if you need. No having to deal with 5 hour resets, hidden weekly caps etc. and arbitrarily hitting a wall just when you have a train of thought going.

You might not do much during the week, then have a chunk of time on a weekend where you want to get a lot done, that's when you hit the real limitations on Claude.
JerryMungo said:
Not sure it's proven to be cheaper - what metrics do you base that on, you can use cheaper models within a any provider.
Click to expand...
Based on.... *drum roll* ...credit usage. You are able to assign actual metrics to your workflow, the types of tasks you execute, the models you choose for different tasks etc. If you document this, over time you'll eventually find the best combination for you. Everyone's uses it for different things so I'm not going to speak for everyone. But personally I get a lot more done on Kiro Pro Max than I did on Claude Max 5x.

But in general just think about it - using Anthropic models for everything (including grunt work) is a proper waste. You only need a frontier model to get your design right, the actual code is generated from the design, so why would you need a frontier model for that and PBT. Any decent open weight model will do just fine, which you don't have access to on Claude. Your affordable option is Haiku which I wouldn't even trust with a hello world.
JerryMungo said:
The spec first approach is the only way to do anything significant though, that I do like about Kiro's approach - Anthropic's own staff highly recommend that. It helps you get on the same page as the LLM and iron out the details before you start, saving time and rework in the long run.
Click to expand...
Agree, the main limitation I've found with Kiro (which I hope they actually fix someday), is when you make changes on the fly it doesn't give you an option to automatically update your documentation. You have to remember to manually tell it. But the fact that you even have access to multiple models from different vendors in one place on its own is a selling point...
 
Last edited:
Mike Hoxbig said:
And I prefer the credits system, you know exactly how much you have remaining and can buy more prepaid credits if you need. No having to deal with 5 hour sessions, hidden weekly caps etc. and arbitrarily hitting a wall just when you have a train of thought going.

You might not do much during the week, then have a chunk of time on a weekend where you want to get a lot done, that's when you hit the real limitations on Claude.
Click to expand...
Then use PAYG token based billing. No point in comparing apples with oranges.
Mike Hoxbig said:
Based on.... *drum roll* ...credit usage. You are able to assign actual metrics to your workflow, the types of tasks you execute, the models you choose for different tasks etc. If you document this, over time you'll eventually find the best combination for you. Everyone's uses it for different things so I'm not going to speak for everyone. But personally I get a lot more done on Kiro Pro Max than I did on Claude Max 5x.

But in general just think about it - using Anthropic models for everything (including grunt work) is a proper waste. You only need a frontier model to get your design right, the actual code is generated from the design, so why would you need a frontier model for that and PBT. Any decent open weight model will do just fine, which you don't have access to on Claude. Your affordable option is Haiku which I wouldn't even trust with a hello world.

Agree, the main limitation I've found with Kiro (which I hope they actually fix someday), is when you make changes on the fly it doesn't give you an option to automatically update your documentation. You have to remember to manually tell it. But the fact that you even have access to multiple models from different vendors in one place on its own is a selling point...
Click to expand...
I'd say track cost per accepted task, rework hours, defects found later, test failures, and review burden, not credits consumed. The “cheapest” model can be costly if it creates subtle mistakes. The other issue is that coding and design are not really separable in that way. Coding exposes design decisions - edge cases, data models, error handling, security boundaries, interpretation of rules, etc. To say the code is generated from the design is a bit of an over simplification IMO.

I also wouldn't call PBT grunt work. It's relatively cheap to generate test scaffolding. Defining the properties that must always hold and knowing whether a failure is because of bad production code, a bad property, or a bad model of the standard is higher domain reasoning IMO. Low-cost models could assist but not really do a good job of authoring or reviewing some of this stuff.

Nothing wrong with smaller models for bounded transformations, test-data generation, formatting, simple refactors, and documentation drafts.

Sure, multi-model is a good thing, but introduces extra oversight and governance, as long as you're prepared to put in the time for that.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X