And it's only getting worse with the waves of vibe-coders.

I actually wrote about this recently after poking around a popular extension that Antigravity users were installing. It's wild what people are doing with your credentials, and you'd have no idea! https://opista.com/posts/blind-trust-in-vs-code-extensions

▲

dawnerd 2 hours ago | parent [-]

I got in an argument with someone the other day that said their vibe coded app was more secure than something hand written because the ai “knows all exploits”.

We’re cooked.

	▲	christoph-heiss 2 hours ago \| parent [-]
		That's why any repo with a README ridden with emojis (and other telltale signs) is just an instant nope nowadays. (One of the only good things about GH is, that if you block some account, it will tell you if that account contributed to some repo at the top. Makes it very easy to filter out slopcode.)