Actually wait, it's worse than that. The product works, demo looks great. Then someone opens the network tab and ... yeah. "Quality doesn't matter" really just means nothing caught fire yet.

But the "where's your control group" take bugs me too. It's not that AI writes buggier code line for line. The gaps are just in different places. Devs who've shipped real apps add rate limiting, auth middleware, proper CORS — because they got burned before. AI skips all of it because nobody prompted for it.

I read through about 80 AI-generated repos a few weeks ago. Code looked decent. The missing stuff was always the same list — no auth on admin routes, API keys hardcoded in client JS, CORS wide open, debug endpoints still live in prod. Over and over.

Nothing there makes a wall of shame. Nothing's exploded yet. But it's the kind of stuff that does.

I run static analysis on mixed human/AI codebases. The AI parts pass tests fine but they'll have stuff any SAST tool flags on first run — hardcoded creds, wildcard CORS, string-built SQL. Works in a demo, turns into a CVE in prod.

And nobody's review capacity scaled with generation speed. Most teams don't even have semgrep in CI. So you get unreviewed code just sitting in production.

The "10x" is real if you count lines shipped. Nobody counts the fix cost downstream though.

The quantity is there. Nobody's asking "does this thing actually work" before hitting deploy. That's the real gap.

Then we talk about containment like anyone actually looked at that dep list.

I've been poking at security issues in AI-generated repos and it's the same thing: more generation means less review. Not just logic — checking what's in your .env, whether API routes have auth middleware, whether debug endpoints made it to prod.

You can move that fast. But "review" means something different now. Humans make human mistakes. AI writes clean-looking code that ships with hardcoded credentials because some template had them and nobody caught it.

All these frameworks are racing to generate faster. Nobody's solving the verification side at that speed.

No test catches any of that. Code works, tests pass, database is wide open.

It's not even a correctness problem. It's that the LLM never thought about rate limiting, CORS headers, CSRF tokens, a sane .gitignore — because nobody asked it to. Those are things devs add from muscle memory, from getting burned. The AI has no scars.

Does GitAgent validate check prompt definitions for suspicious patterns? Instructions to access filesystems, exfiltrate env vars, call external endpoints? Seems like a natural extension if you're already running validation in CI.

What actually moved the needle was talking about data, not the product. I posted about my tool — crickets. Then I wrote about stuff I discovered while building it and people started engaging. Exact same product behind both posts, just "here's what I found" instead of "here's what I built." Night and day difference.

My Dev.to article got 42 reads and 2 reactions. Not exactly going viral. But here's the thing — Google picked it up within days, and I'm already seeing search traffic trickle in. Honestly that might end up being worth more than any launch-day spike.

Twitter was a waste of time. Brand new account, zero followers, zero impressions. And I mean literally zero — the algorithm just doesn't show tweets from fresh accounts to anybody. I could've tweeted the cure for cancer and nobody would've seen it.

Reddit though. One post in r/webdev's Showoff Saturday thread pulled 1,400 views and 10 comments. Blew everything else out of the water. Downside: that sub only lets you self-promote on Saturdays, and AutoMod killed one of my replies because my account was too new. Cool.

Also looked into BetaList — turns out they dropped their free tier, it's $39 minimum now. Found another directory that approved me in 2 days and sent... one visitor. One.

Biggest takeaway that nobody talks about: the thing blocking you isn't your writing or your product. It's subreddit karma requirements and account age filters. AutoMod doesn't care how good your post is. If you're planning to use Reddit for anything, go make that account right now. You'll thank yourself in a month.