I review the code that matters - anything security adjacent or that's an API that will be used by other code in the future.

I don't review code that either works or doesn't - most HTML and CSS layout code for example. There I test it on desktop and mobile and commit it if it works.

Ditto for stuff that's simple. A JSON endpoint that runs a SQL query and returns some JSON? If it works and a glance at the tests looks OK then I trust my agents wrote it properly.

I'm getting more confident with my judgement over what needs a close look and what doesn't over time, as so far I haven't been majorly burned my any mistakes that snuck through.

Honestly, it's similar to being an engineer on a larger team. You don't review every line of code written by every one of your coworkers.

I think this is THE issue of our time as programmers to be honest: do you review every line of code an agent writes?

An increasing number of expert programmers are moving in the direction of NOT reviewing every line. It's working out OK for a lot of them.

▲

t-writescode an hour ago | parent | next [-]

> Ditto for stuff that's simple. A JSON endpoint that runs a SQL query and returns some JSON? If it works and a glance at the tests looks OK then I trust my agents wrote it properly.

That is *exactly* the sort of area I *wouldn’t* blindly trust AI, there’s a huge security boundary there. What if the AI is doing string concatenation with user-provided data???

	▲	simonw 25 minutes ago \| parent \| next [-]
		Once you've seen the AI not make mistakes like that a few dozen times you start to trust it not to mess that up in the future.
	▲	hombre_fatal an hour ago \| parent \| prev [-]
		We're pretty far past this if you're using anything close to the sota models. But you could be defensive with a security checklist in agents.md and have adversarial review, if you wanted.

▲

mekael an hour ago | parent | prev | next [-]

I've found that engineers on a large team do read every line, mainly due to the fact that the skill levels run the gamut from intern to lead, and only 1 or 2 people out of 12 might have knowledge of the application being modified.

It's actually getting worse due to "AI code bloat", for example I have 16k lines of code to review across 3 apps by the end of this week. Normally it would be a quarter of that, but what Claude produces is extremely verbose in some places and anemic in others, and I can't tell at a glance what's right and what looks right with that much ground to cover.

▲

slopinthebag an hour ago | parent | prev | next [-]

I think it also depends on what you're building. Some solo project or basic html thing? Sure no need to review every line. It's a bit different when you're working on foundational libraries that a business relies on, anything touching a production database, etc.

▲

skydhash an hour ago | parent | prev [-]

> Honestly, it's similar to being an engineer on a larger team. You don't review every line of code written by every one of your coworkers.

We don’t because everyone is accountable for his or her own mistakes. So everyone is incentivized for their recklessness to not be the root cause of some bug.

> An increasing number of expert programmers are moving in the direction of NOT reviewing every line. It's working out OK for a lot of them.

Have you ever asked your users? What about bug reports? Is the amount and rate decreasing?