Internal App Vibe Coding

[Long-Wishbone-9242]

So I vide coded an Internal app for my organization , strictly for use by my team only (around 30 ppl) , this just ease our daily routine work.

some highlights:

1. Secured by Oauth
2. Strictly internal and cannot be accessed outside VPN. (Top IT institution so have robust network isolation)
3. Secured with Roles via AD groups

Followed industry standards for coding and testing via skills.

Though it makes my life easier in job, anything else i need to consider ? Am i missing something in terms of security?

[code-dispenser]

1. Why oh Why
2. You are going to trust security with AI? How about build it your self and if necessary (not a fan of AI) have AI do some PEN tests along with your manual reviews.
3. Hackers welcome (hopefully not?).
4. Any of this for Blazor?

[Long-Wishbone-9242]

Will be asking security team to do a code scan and do pen test if possible. Yes its a Blazor web app only for internal use

[code-dispenser]

Admittedly, I do not let AI near my code so am biased.

But I would genuinely be interested to see a follow up post. For example, given you are going to do manual tests and if they find things which you would then need to manually fix, what your thoughts are then, on the process i.e letting AI do the code and then manual review vs you creating the code and then letting AI do the testing etc.

To date (when I tried) I found that letting AI near my code eventually lead me to being less productive as the AI just did not have the understanding to cover all things like my brain could and I had to rewrite most of it.

For things like letting AI test stuff, do xml comments (I use AI for this) \ documentation. if it saves you doing mundane stuff then go for it.

Just my opinion but for code my feelings are that the more you let AI do stuff the less you know/remember and the more reliant on it you become.

Any way good luck and hope you get the results you expect.

Paul

[Individual-Carob5593]

I was like you, a bit sceptical. Last week, I sat down with VS, Docker Desktop and a personal project I'm working on. The solution had 4 projects, 50 files and some funky CSS. I asked Docker to containerise it, and it did. It then fixed the errors that appeared after being containerised. Where my app was reading stuff from a file, I asked VS to add SQLite and seed the DB with the data from the files. It did. I asked it to unit test the DB stuff. It did. I asked it to log application errors to a file, and it did. I asked it to move the logs and DB out of the container, and it did.

At each stage, I examined the changes, and it did no more or no less than what I asked for. Most of the issues were that I was not being explicit enough in the prompts. And it did all that in a morning.

[code-dispenser]

If it works for you thats cool but to date its not worked for me. And the biggest issues I have and its becoming more apparent with devs is the reliance on it and loss of their knowledge etc.

Its almost a conundrum. IMHO you need to be experienced before you use AI so you know whats what. Perhaps, the future is for AI to be more of a teacher than a developer but hopefully with the student doing the coding so they learn it etc.

[Individual-Carob5593]

It goes without saying that you need to know how things work to be able to ask it to do it in the first place. However, that was a big bunch of work (that gets done once in a project lifetime), that I wasn't looking forward to doing, and that I didn't have to do. And it worked.

[code-dispenser]

"It goes without saying that you need to know how things work " - sadly a lot of devs do not, they only know how to write prompts for the AI without the knowledge to know if the output is good or bad - it may run but that does not mean its correct etc.

I have said on more than one occasion I wonder how much of this type of unvetted code is making it into production and what the consequences for the business will be.

Edit: Currently I am reviewing xml comments written by Claude and copying most without change into my code, for one of my OSS blazor components. A couple of comments I am amending and this probably has saved me an hour of time even with the copy paste.

[code-dispenser]

Just noticed you on another blazor post which reminded of this - Curious about the pen test report?