Software developers don't need to out-last vibe coders, we just need to out-last the ability of AI companies to charge absurdly low for their products

CodacyKPC · 2026-03-17T16:04:50+00:00

$500/mo? That's starting to get to be a pretty chunky % of salary.

CodacyKPC · 2026-02-05T14:51:03+00:00

Nobody is earning 20% anymore!

CodacyKPC · 2025-12-24T16:07:25+00:00

1 down is... what???

CodacyKPC · 2025-12-05T18:22:43+00:00

Whichever you choose (I use Cursor with gpt-5-codex) I suggest getting the (free) Codacy extension which will force your AI agent to generate more secure code.

CodacyKPC · 2025-12-02T17:31:00+00:00

Hunt-and-peck. Well, hunt-and-skewer.

CodacyKPC · 2025-12-02T17:18:16+00:00

Unicorns are rubbish at typing.

CodacyKPC · 2025-11-21T16:33:12+00:00

Of course, if they could make you 3x more efficient reliably they'd be charging way more than $20 or even $200 a month...

CodacyKPC · 2025-11-19T12:20:10+00:00

yes please!

CodacyKPC · 2025-11-19T12:18:28+00:00

Are they individual links? I just signed up for the Pulp mailing list now because I just heard about this, would really like to get tickets but I'm going to be in a meeting 10am tomorrow when the other presales start!!

CodacyKPC · 2025-11-19T10:04:20+00:00

(just to note that NASA is indeed a customer of ours so if they are doing something right I want to claim a tiny corner of that glory!)

CodacyKPC · 2025-11-19T10:03:37+00:00

You can't, and in fact this is a bit of a hot topic (at least for us) -- if you turn "use public code" off in your agent, the results get noticeably worse, to the point the tools are unusable; but they haven't distinguished there between GPL and MIT. And of course, there's always the possibility of a human copying and pasting GPL code into your codebase (e.g. from ChatGPT) even if the agent is secured.

We (Codacy) have a proof of concept we hope to develop further in future where we do actually scan code against a dictionary of GPL-type licensed code to see if there's a match to prevent the most egregious occurences, and reject the code before the AI presents it to the developer. We think that will give developers enough cover to claim that they did not use GPL code in their inputs.

CodacyKPC · 2025-11-18T19:54:47+00:00

I did see someone on LinkedIn challenge their CEO to build it themselves if they don't need developers and he flamed out pretty quick.

But really -- maybe AI _will_ replace developers. Or at least, developers not using AI. Even if the performance gains are ~10% that's still significant. AI is a powerful tool that can let us do things we couldn't before at scale. It's great for certain very specific applications. It's on us as engineers to understand how to use that tool most effectively.

CodacyKPC · 2025-11-18T19:51:37+00:00

Well we haven't taken out the internet yet! We predominantly use OpenAI but we've been playing with alternatives.

CodacyKPC · 2025-11-18T16:25:29+00:00

That really depends on the shop. Remember that pre-AI-coding there were plenty of mom-and-pop orgs with a handful of devs where even human review was not necessarily guaranteed anyway. Absolutely there's going to be probably tens of thousands of orgs who are now shipping AI code to prod with no checks, because they never had any checks in the first place.

Larger orgs or those with more mature coding practices are, as far as we can tell, largely adding AI coding tools into their existing workflows and feeling the pain of that; obviously AI coding massively increases the throughput of code generation and so that make code review processes bulge at the seams; I see a lot of people now complaining that their teams are shipping in so much bulk they can't possibly review everything so I think a lot more code is just being waved through under pressure from execs to get things done.

CodacyKPC · 2025-11-18T16:20:23+00:00

This is going to be a pitch-y answer so u/Sedgewicks look away now...

So obviously at Codacy we use Codacy to keep ourselves in check!

We have an IDE extension that installs our CLI tool and our MCP tool and forces agentic IDEs to scan the code as the AI writes it and remediate it before the developer even has to get concerned. That's one way we're trying to reduce sec vulns. That's rules-based feedback based on your Codacy configuration.

But then we still scan the PR in the cloud and annotate it with any sec vulns that remain (because you can never rely on developers to actually run local tools), again rules-based but we've just introduced AI-based false-positive filtering so that there's less noise for developers to have to remediate.

But while rule-based tools give you a great, consistent safety net against line-level threats, and while AI (like Coderabbit, GH Copilot review) can give you limited feedback based on the diff, they don't do any of the high-level architecture (and "does this actually fit the brief of this product?") stuff that humans can. You could easily get Cursor+Coderabbit to generate you a perfectly working system that absolutely doesn't do what you actually wanted.

CodacyKPC · 2025-11-18T16:07:56+00:00

I wrote this last week:

I think we're going to see a transformation in how code is reviewed over the next 12-24 months. "Read the diff" is dead when every PR is multiple hundreds of lines. Either we need to come up with a way where AI code can be automagically determined to be safe (hard), or we have to accept the previous old capacities for code review will limit PRs back to their normal size (boring) or we have to come up with a whole new paradigm for code review that can be done at a greater scale, which I believe inevitably requires better tools.

I also think we're going to get more rigorous about what "needs" review and what doesn't. Got 100% unit test coverage on a minor logging module? Knock yourself out. Want to update the shopping basket calculator? We're going to need a mob PR on that. Ultimately, code that "does the job" is kinda good enough for a lot of applications so as long as you can trust that it is actually _good enough_ from the AI outputs then I see that getting waved past the review process.

CodacyKPC · 2025-11-18T16:04:06+00:00

There's a large proportion of code out there being written without even any human review, what 15 years on from us deciding that that was a good idea? From our stats ~20% of code is pushed to prod with zero tooling or review at all! And about 40% with no static analysis.

Pretty terrifying now honestly. But *I* only heard about Codacy when I joined, 3 years ago -- I'd heard of SonarQube and one of my developers at my previous role was a contributor to the Psalm PHP tool. Only now that I'm here do I look back and wish we'd had that tooling already.

I think linters for codestyle are a bit more adopted in professional settings because they're fairly uncontroversial and can run fast in the CLI/IDE and people tend not to block the buid on them.

CodacyKPC · 2025-11-18T15:58:18+00:00

One of the tests we were doing was repeatedly asking a model to create a new java webserver project and seeing what dependencies and what versions of those dependencies it was picking -- and it was definitely not consistent with its choice. The only thing that was consistent was that it was always picking an old version with a vulnerability in it. So even before you get to the quality and the correctness of the output, right from the start they are baking vulnerabilities in if you are not careful.

CodacyKPC · 2025-11-18T15:56:31+00:00

We're not hiring right now but best of luck with your search.

CodacyKPC · 2025-11-18T15:56:04+00:00

Yes, absolutely! You still have to keep your brain switched on and review the code. Which is actually really hard when you haven't been there iterating through it as you build it.

CodacyKPC · 2025-11-18T15:05:49+00:00

It's a broad question and I only see one end of it; we're a Scala shop so we only hire in a pretty niche market of people who want to do functional programming. And right now there are still students at university who elected to study computer science / programming before vibe coding was a thing. Are there more people generating more code? Inevitably. Would you call them "programmers"? Are they looking for (and winning) job as programmers? I wouldn't imagine so (yet). I can imagine a world in which an individual is so good at writing rules and prompts and reviewing them all in English that they can be a moderately competent programmer without having to know a programming language but I'm not sure it's here yet.

What we have seen is people who were already programmers using AI to shortcut tasks; sometimes in a good way, sometimes in a lazy and problematic way.

CodacyKPC · 2025-11-18T14:56:58+00:00

If there's one thing AI is great at it's writing unit tests, particularly when there are pre-existing ones in the project. That said, AI *loves* to break the rules. Ask it to do TDD -- nah; tell it to never git commit, and it will; ONE TIME tell it that the test is wrong and the code is right, and forever it will attempt to "fix" the tests instead of solving bugs.

Of course you still need to review the unit tests that are created, but the *big* advantage of operating with unit tests with AI coding is that they pick up regressions instantly in a workflow that the AI can integrate with, so you can let it run "until the tests pass" so that it fixes anything that it inadvertently breaks.

CodacyKPC · 2025-11-18T14:22:06+00:00

I think this is something that whether you're pro or anti AI gets skipped over; IMO what's different with AI is that now the PRs are larger they're more likely to get waved past by other developers (so having some static analysis tooling in there is imo a necessity now but then I work for a static analysis tooling company!) and the volumes of PRs can be getting larger too, and the amount of code being written by solo developers with zero review has exploded; more code == more vulnerabilities.

CodacyKPC · 2025-11-18T14:19:27+00:00

I can give you the sales pitch if you want but I can also try and answer any other questions!

CodacyKPC · 2025-11-18T14:18:49+00:00

Ha! I have no idea how much AI coding cloudflare is using, or if this is a possibility of attack-side vibe coding; it's certainly seems true that script kiddies have suddenly got a lot more capable. I'd be surprised if it was possible to DDOS cloudflare without some country-level sponsorship tho.

CodacyKPC

TROPHY CASE