@davidgerard A cursory glance at their posts suggests they're stressing it isn't vibe coding if it's only "auditing" existing code?
Which is a very fine line that still results in /using/ the slop machinery.
I wish the software development ecosystem would fix the underlying architectural problems rather than keep brushing them under the rug. But we're now all so entrenched in arguing to slop or not to slop that few are talking about what it means not to slop.
@zimzat this is not 'vibe coding' by any definition, but if you just use LLMs for security/bug auditing, you don't explain your code style guide in AGENTS.md.
@mkljczk Yup, if it explains more than just expected security standards and patterns then this is the signal that suggests it won't remain "vibe auditing". 😞️
(The fact that 'vibe auditing' can stochastically find actual security vulnerabilities says to me that we've done a horrible job establishing secure practices and prevention)
@zimzat I mean, it shouldn't surprise anyone that by burning hundreds billions of dollars you can get a security auditing tool that finds stuff previous tools couldn't find.
@mkljczk The part I take issue with is that our human programming practices haven't kept up to date with security problems. That the top CVE / OWASP categories are still Overflow and Injection says we've done very little to systematically prevent massive vulnerabilities.
context-sensitive escaping by default, parameter binding by default, automatic memory management, type validation, etc. These are or could be standard in modern languages or retrofitted into older ones.
