Vibecoding: a beginner's guide

Scary_Turtle said:
I hope you are adding all your security checks or only using this as an internal project that doesn't touch the internet.

The vibe coded things are coming through in pentests and have huge security flaws.

Even programs that have been pentested aren’t safe. Someone decides to “clean up” the code, dumps it into an AI without any of the context, and the AI strips out chunks that existed for a reason. Suddenly, an application that’s been tested for a decade is vulnerable to XSS, SQL injection, etc.
Click to expand...
Could real programmers please share some good practices and what to check for example the vulnerabilities such as XSS and SQL injection etc.
 
Last edited:
This is the world I find myself in.
As a human, having to try and compete with machines and Gen Z that is so "excited about AI" is killing me- that they hand over entire code bases to AI and then the bosses tell the big bosses "Oh quality went down because the staff were slacking sir, we've canceled WFH so it should get better". Quality isn't getting better, AI has removed stuff without context, and now the ship is up the creek, without a paddle. Nobody knows where AI broke the code.. so here we sit, with customers dropping the product one by one, and potential lawsuits, and I sit in the still factory- no production being done because orders dried up.

I am telling you now that my current employer will go tits-up soon.. giving it 10 months tops.. I see the brown stuff heading for the fan.

This has happened because the bosses don't care about anything except the fancy graphs on TFS. Lines of code written in a day and tickets resolved > quality.
 
EmmanuelGoldstein said:
This is the world I find myself in.
As a human, having to try and compete with machines and Gen Z that is so "excited about AI" is killing me- that they hand over entire code bases to AI and then the bosses tell the big bosses "Oh quality went down because the staff were slacking sir, we've canceled WFH so it should get better". Quality isn't getting better, AI has removed stuff without context, and now the ship is up the creek, without a paddle. Nobody knows where AI broke the code.. so here we sit, with customers dropping the product one by one, and potential lawsuits, and I sit in the still factory- no production being done because orders dried up.

I am telling you now that my current employer will go tits-up soon.. giving it 10 months tops.. I see the brown stuff heading for the fan.

This has happened because the bosses don't care about anything except the fancy graphs on TFS. Lines of code written in a day and tickets resolved > quality.
Click to expand...
And I bet you issues started showing long before AI was introduced. AI is just a tool. Good practice and code review should not disappear.
 
RedViking said:
And I bet you issues started showing long before AI was introduced. AI is just a tool. Good practice and code review should not disappear.
Click to expand...
I wasn't at this company at the time but yes. No evidence of any good practices. Code reviews were done but there's no documentation for anything. And on top of that a culture of "need to know" because the former company owner was a paranoid sort.
 
AI is a tool, nothing more.
A recent example is my weekend projects.
I asked AI to write a function for me in C to calculate the CRC-16 of a packet but to use the PROFIBUS variant.

On the backend side, I am writing the code in Golang. It got that right on the first try.
On the front end, a piece of IoT I am making for myself, written in C, it keeps insisting the CRC polynomial is 0x1021.

No big deal, since I understand the code I just modified the offending line of code to make it work.

So yes, AI is a massive time-saver PROVIDED you UNDERSTAND THE CODE AND YOU CAN ARTICULATE WHAT YOU WANT.
If I was an uneducated vibe-coder... the whole thing would not work, and no clue why.

AI does not replace a programmer, it merely provides help with all the KAK jobs, things I can't be arsed to write anymore.
 
EmmanuelGoldstein said:
AI is a tool, nothing more.
A recent example is my weekend projects.
I asked AI to write a function for me in C to calculate the CRC-16 of a packet but to use the PROFIBUS variant.

On the backend side, I am writing the code in Golang. It got that right on the first try.
On the front end, a piece of IoT I am making for myself, written in C, it keeps insisting the CRC polynomial is 0x1021.

No big deal, since I understand the code I just modified the offending line of code to make it work.

So yes, AI is a massive time-saver PROVIDED you UNDERSTAND THE CODE AND YOU CAN ARTICULATE WHAT YOU WANT.
If I was an uneducated vibe-coder... the whole thing would not work, and no clue why.

AI does not replace a programmer, it merely provides help with all the KAK jobs, things I can't be arsed to write anymore.
Click to expand...
I am an uneducated vibe coder. I ask AI to explain everything. Also try to learn and educate myself along the journey. What would never have been possible in my life is now possible.
 
RedViking said:
I am an uneducated vibe coder. I ask AI to explain everything. Also try to learn and educate myself along the journey. What would never have been possible in my life is now possible.
Click to expand...
Yes, and that's also a good thing. It will get better as well. The trick is to find the right balance, but also not to think that humans will be replaced outright.
 
EmmanuelGoldstein said:
Yes, and that's also a good thing. It will get better as well. The trick is to find the right balance, but also not to think that humans will be replaced outright.
Click to expand...
What would be awesome is if I can follow good enough practice to hand over the fully functional and well implemented project to a senior dev to finalise and push for production, I'm a specially pedantic about security.
 
JerryMungo said:
Before shipping, get yourself a once off sub to a competitor platform, prefreably pay as you go for their most powerful engine, then ask it to critique the code (no changes made), specifically in the security department and according to OWASP top 10... take that output and feed your original LLM, asking it it's 'opinion' on those findings.

Weigh up for yourself the output from the two based on your own research and see if anything needs to be done. It can be done properly with an LLM but you'll learn alot in the process - that's a big take-away.
Click to expand...
In my planning for the prototype, interesting enough Claude has already mentioned implementing OWASP as part of the auditing.

So far I have been jumping between Google AI Studio, Claude and ChatGPT , using all 3 in conjunction as I run out of tokens and sharing the input across all 3 to get different perspectives and opinion of the alternatives. Then I notice there are areas where they overlap or are in agreement and seems like solid advice.

The thing is I need to now subscribe to one of them so I can move from planning/specification to prototype. I have a prototype created with Google AI Studio which has been under many reviews , however it was to learn and understand how these platforms and this technology works. I also realise there are things I didn't actually need and to narrow the scope of the project. So I am now going back to writing the Specification and the continue with the paid plan on one of these platforms. Currently it is estimated to be a 30 000 - 50 000 lines of code project, but I'm going to reduce it in narrowing the project.

To give some perspective I have taken my knowledge of the last 20 years in the construction industry and I am building a structural calculator and a compliance checker for builders and designers. The first stage is to get a working prototype , then an internal review and testing among the team , and then finally get it properly reviews and then taking to the Building Council and Research Institute and then go Public.

There is a problem though. Finances.

I really enjoy Claude so far and thinking to go with the pro plan, but my concern is token limits. I can't afford the highest plan right now, we are busy with retrenchments, part of the problem is due to the complicated standards and compliance requirements it's too expensive for people to even start the building process, and I hope this can cut down hours and weeks of work as well as make the team more efficient.

Now rambling....
 
JerryMungo said:
1) What am I collecting and why am I collecting it (data)? Do I really need to collect it, because what I don't collect can't be stolen on my watch.
2) Am I applying best practice for securing everything sensitive? If it is stolen or accidentally leaked, can I point to the best practices and say we did our best?
Click to expand...
This is very sensible.
 
JerryMungo said:
For me the biggest questions with security are:

1) What am I collecting and why am I collecting it (data)? Do I really need to collect it, because what I don't collect can't be stolen on my watch.
2) Am I applying best practice for securing everything sensitive? If it is stolen or accidentally leaked, can I point to the best practices and say we did our best?
Click to expand...

So this is where I also want to change the scope of the project at this stage. I do not think I should be collecting much info except what is necessary for the application to work. I am thinking however to give export function and then when ever someone uses they application they either import their saved file or link it from an online drive such as Google Driver or One Drive. That way I dont have that information stored on the server.

Where it does get a bit complicated is with in the Software there needs to be different profiles for each of the projects, so I need to make sure information are not shared or linked between the projects within the software.

But yes, a lot of research and planning to do to get the specification ready.
 
RedViking said:
In my planning for the prototype, interesting enough Claude has already mentioned implementing OWASP as part of the auditing.

So far I have been jumping between Google AI Studio, Claude and ChatGPT , using all 3 in conjunction as I run out of tokens and sharing the input across all 3 to get different perspectives and opinion of the alternatives. Then I notice there are areas where they overlap or are in agreement and seems like solid advice.

The thing is I need to now subscribe to one of them so I can move from planning/specification to prototype. I have a prototype created with Google AI Studio which has been under many reviews , however it was to learn and understand how these platforms and this technology works. I also realise there are things I didn't actually need and to narrow the scope of the project. So I am now going back to writing the Specification and the continue with the paid plan on one of these platforms. Currently it is estimated to be a 30 000 - 50 000 lines of code project, but I'm going to reduce it in narrowing the project.

To give some perspective I have taken my knowledge of the last 20 years in the construction industry and I am building a structural calculator and a compliance checker for builders and designers. The first stage is to get a working prototype , then an internal review and testing among the team , and then finally get it properly reviews and then taking to the Building Council and Research Institute and then go Public.

There is a problem though. Finances.

I really enjoy Claude so far and thinking to go with the pro plan, but my concern is token limits. I can't afford the highest plan right now, we are busy with retrenchments, part of the problem is due to the complicated standards and compliance requirements it's too expensive for people to even start the building process, and I hope this can cut down hours and weeks of work as well as make the team more efficient.

Now rambling....
Click to expand...
Why chop and change between them, and be constrained by their specific models?

Just use something like Kiro which gives you access to the Anthropic, OpenAI and open weight models. And it's spec driven. You can set your own workflow - something like Opus or whatever other frontier model for the important stuff like your requirements and design, Sonnet for coding, cheaper models like Minimax for grunt work like PBT. When you need to debug you pick the most appropriate depending on the complexity of the bug.

Works out wayyyyyy cheaper when you set you own workflow across a combination of all models. And no time limit BS limitations...
 
Mike Hoxbig said:
Why chop and change between them, and be constrained by their specific models?

Just use something like Kiro which gives you access to the Anthropic, OpenAI and open weight models. And it's spec driven. You can set your own workflow - something like Opus or whatever other frontier model for the important stuff like your requirements and design, Sonnet for coding, cheaper models like Minimax for grunt work like PBT. When you need to debug you pick the most appropriate depending on the complexity of the bug.

Works out wayyyyyy cheaper when you set you own workflow across a combination of all models. And no time limit BS limitations...
Click to expand...
I am not familiar with this. Will look into it. Cheers! Any other tips please. :)
 
JerryMungo said:
Not sure what you mean by the time limit BS limitations. Kiro has credit capped limits and premium models consume credits at different multipliers.
Click to expand...
And I prefer the credits system, you know exactly how much you have remaining and can buy more prepaid credits if you need. No having to deal with 5 hour resets, hidden weekly caps etc. and arbitrarily hitting a wall just when you have a train of thought going.

You might not do much during the week, then have a chunk of time on a weekend where you want to get a lot done, that's when you hit the real limitations on Claude.
JerryMungo said:
Not sure it's proven to be cheaper - what metrics do you base that on, you can use cheaper models within a any provider.
Click to expand...
Based on.... *drum roll* ...credit usage. You are able to assign actual metrics to your workflow, the types of tasks you execute, the models you choose for different tasks etc. If you document this, over time you'll eventually find the best combination for you. Everyone's uses it for different things so I'm not going to speak for everyone. But personally I get a lot more done on Kiro Pro Max than I did on Claude Max 5x.

But in general just think about it - using Anthropic models for everything (including grunt work) is a proper waste. You only need a frontier model to get your design right, the actual code is generated from the design, so why would you need a frontier model for that and PBT. Any decent open weight model will do just fine, which you don't have access to on Claude. Your affordable option is Haiku which I wouldn't even trust with a hello world.
JerryMungo said:
The spec first approach is the only way to do anything significant though, that I do like about Kiro's approach - Anthropic's own staff highly recommend that. It helps you get on the same page as the LLM and iron out the details before you start, saving time and rework in the long run.
Click to expand...
Agree, the main limitation I've found with Kiro (which I hope they actually fix someday), is when you make changes on the fly it doesn't give you an option to automatically update your documentation. You have to remember to manually tell it. But the fact that you even have access to multiple models from different vendors in one place on its own is a selling point...
 
Last edited:
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X