I recently asked an AI coding assistant to fix a small issue in my project. It found the problem quickly and suggested a solution that looked perfectly reasonable.
But after applying the fix, two unrelated parts of the application stopped working.
I spent more time understanding the side effects than I would have spent fixing the original bug myself.
AI coding is getting impressive, but I still feel we need to be careful about trusting every suggested change.
Been thinking about this after seeing a few posts here about vibe-coded apps breaking in production. Auth bugs, webhook failures, that kind of thing.
What worries me more is the stuff that doesn't break loudly. No error, no crash, it just quietly leaks data or accepts requests it shouldn't. Things like exposed API keys sitting in the frontend bundle, missing rate limits, or database rules that let any logged in user read rows that aren't theirs. None of that throws an error. It just sits there until someone finds it.
For the non-engineers building real products with this stuff, what does your actual security check look like before you launch. Are you running anything to scan for this, paying someone to review it once, asking the AI itself to audit its own code, or just shipping and hoping nothing bad happens.
Curious if there is an actual workflow people are settled on, or if this is still the part everyone quietly skips.
With how fast you can spin up new features using modern AI tools now, scope creep is dangerously easy. Every time I sit down to work, I end up building something cool instead of telling people the product actually exists. Getting a couple of hundred signups with a handful of active users is usually the universe telling you to step away from the code editor and start talking to humans. When do you personally draw the line and say, "Okay, no more features until we get more distribution"?
Something I keep running into with vibe coding: the agent loses context mid-task and rebuilds a helper that already exists, under a new name, a couple of folders away.
Everything compiles and tests pass. But now half the app uses version A and half uses version B, and the two slowly drift apart. Each version passes review on its own, so nothing looks broken.
The symptoms can be small, like inconsistent date formatting across pages. They can also be serious. If only one copy got the auth check or input validation, part of your app is protected and part isn t, with no visible sign.
One cheap guardrail I ve seen: at the end of each session, ask the agent to list every new function it created, then check for near-duplicates before release.
Building apps with AI models in minutes feels amazing but hitting a weird bug in code you didn't actually write is a nightmare. It s way too easy to just ask the AI to fix its own mistake creating layers of patches that no one fully understands.
While it definitely speeds up shipping dealing with maintenance or scaling later down the line gets tricky fast.
Do you manually inspect everything the AI generates or do you have a specific rule to make sure you still understand how your app works under the hood?
I started dictating my prompts recently because typing out long paragraphs of context during debugging gets exhausting. The upside is huge you naturally explain the why behind a bug instead of just throwing a short command like "fix error" at the LLM. But the friction comes when you have to say exact file names or variable paths out loud. I end up sounding ridiculous trying to spell out camelCase names or special symbols.
For those using voice tools regularly in tools like Cursor how do you split what you dictate versus what you still manually type?
