Field notes on vibe coding: how the tools actually behave, where they help, where they bite, and what to check before you ship.
[object Object] · Business
AI writes faster than your team can read. How to structure a review for AI-generated pull requests: disclosure, stated intent, size caps, a fixed reading order, and triage by blast radius.
[object Object] · Risks
AI assistants invent version numbers that were never published, and a quarter of upgrade recommendations in one 2026 study referenced versions that do not resolve. How to catch them before they reach a lockfile.
[object Object] · News
Every AI coding tool is really a context manager with a model attached. How selection, indexing and compaction work inside Cursor, Claude Code, Copilot and Codex, and why a million-token window did not end the problem.
[object Object] · News
Feature lists and demos tell you almost nothing about how a tool will behave in your codebase. Here is how to run a real evaluation: one live work item, your own review rules, and outcome measures rather than task counts.
[object Object] · Risks
AI slop is generated output that reads as competent and carries nothing. In a codebase it compiles, passes the happy path, and quietly costs you your architecture. Here is how to recognise it and keep it out.
[object Object] · Business
Every major AI coding vendor assigns you the output, and that is the easy half of the question. The harder half is whether prompted code is copyrightable at all, and what a thin authorship record costs you later.
[object Object] · Risks
Measured studies agree on where vibe-coded apps fail: missing authorisation, leaked credentials and baseline defences nobody asked for. Here is the evidence, and the controls that cut the exposure before real users arrive.
[object Object] · Best practices
Vibe coding was defined as a way of working for throwaway projects, and most people keep going well past that point. Five signals that it is time to read the code yourself, the security evidence behind them, and how to take over without losing the pace you gained.
[object Object] · Best practices
You do not have to hand-write every test for AI-generated code, but the checks have to come from somewhere other than the model that wrote it. Spec-first prompting, property-based tests and mutation testing, with the published data behind each.
[object Object] · Best practices
An agent obeys its permissions, not your instructions. The layers that actually hold in production: scoped credentials, separated environments, approval gates on destructive actions, spend and time limits, and logs you can reconstruct.
[object Object] · Best practices
Asking a model for one verifiable change at a time produces code you can merge; asking for a rewrite produces a pull request nobody can review. The evidence, the mechanism behind it, and the narrow cases where a rewrite is still the cheaper move.
[object Object] · Risks
AI coding tools invent functions, parameters and whole packages because they predict plausible text rather than looking anything up. Here is the evidence on how often it happens, why the invented names are convincing, and the checks that catch them before they reach production.
[object Object] · Tools
Two questions decide it: does the change touch more than the file you are in, and can something other than your own reading confirm it worked. Here is how the two modes differ, what each is good at, and where an agent is the wrong call.
[object Object] · Guides
Both let you build software without typing the implementation, but one hands you visual logic you can edit and the other hands you generated source code. What separates no-code from vibe coding, and which failure mode you would rather own.
[object Object] · Business
Most businesses running AI coding tools have no written rules for them. Here is what a short, enforceable policy has to cover on ownership, review thresholds, dependencies and shadow AI, and which parts belong in CI rather than in a document.
[object Object] · Best practices
Vibe coding drops the diff read by definition. New formal-verification work shows the same model that writes a vulnerable line spots it 78.7% of the time when asked to review, which is the strongest argument yet for putting the review step back.
[object Object] · Best practices
Vibe coding, as originally described, meant accepting changes without reading them. The measured cost of that habit is now visible in code quality data and in a string of data leaks. Here is how to read a diff you did not write, and how to keep diffs small enough to read.
[object Object] · Guides
Both skip hand-written code, but only one hands you source files you own and have to maintain. Where no-code and vibe coding actually split, what each costs, and how to pick for a specific piece of work.
[object Object] · Best practices
A prompt that works states the goal in one sentence, carries the context the tool cannot see, names the constraints, and shows one example. Here is the structure, the published guidance behind it, and where prompt quality stops helping.
