I’ll start with saying that I think it’s good you’re asking about this. A lot of things are possible these days with all these AI tools, but they don’t solve the problem of unknown unknowns.
I think the most honest thing I could say is that it’s almost certainly not “engineered well” but there’s nuance to that. The most important bit is that it almost certainly has at least one vulnerability or issue that could lead to a whole host of problems for both you and your users. Given, that’s true of all code, but without being vetted by someone who knows what to look for there’s a much higher chance some low hanging fruit was missed.
If it’s safe and secure and actually works, then the rest doesn’t matter so much. Not saying it’s gotta be Fort Knox, but even the smartest models can easily miss something that an experienced human wouldn’t.
I would strongly recommend hiring an experienced developer to at least audit it. Will be a lot cheaper than an out of control cloud bill or worse, lawsuits.
I commend you for opening yourself up to potential torment here for the sake of your product and its users, but a) nobody is gonna do it for free and b) even if they did, well, you get what you pay for!
I actually asked Claude to audit the codebase specifically for security vulnerabilities. It found a few things and I fixed them, but I'm very aware that asking another LLM to check the LLM-generated code might be the software equivalent of asking the fox to inspect the henhouse.
I’ll start with saying that I think it’s good you’re asking about this. A lot of things are possible these days with all these AI tools, but they don’t solve the problem of unknown unknowns.
I think the most honest thing I could say is that it’s almost certainly not “engineered well” but there’s nuance to that. The most important bit is that it almost certainly has at least one vulnerability or issue that could lead to a whole host of problems for both you and your users. Given, that’s true of all code, but without being vetted by someone who knows what to look for there’s a much higher chance some low hanging fruit was missed.
If it’s safe and secure and actually works, then the rest doesn’t matter so much. Not saying it’s gotta be Fort Knox, but even the smartest models can easily miss something that an experienced human wouldn’t.
I would strongly recommend hiring an experienced developer to at least audit it. Will be a lot cheaper than an out of control cloud bill or worse, lawsuits.
I commend you for opening yourself up to potential torment here for the sake of your product and its users, but a) nobody is gonna do it for free and b) even if they did, well, you get what you pay for!
I actually asked Claude to audit the codebase specifically for security vulnerabilities. It found a few things and I fixed them, but I'm very aware that asking another LLM to check the LLM-generated code might be the software equivalent of asking the fox to inspect the henhouse.
For context: I can read and understand some HTML and CSS, but beyond that I really can't code.
I started building LearnFrom by describing what I wanted to AI, letting it write the code, testing it, fixing what broke, and repeating the process.
Somehow, that turned into a real SaaS used by 100+ creators and businesses.
And now I'm wondering whether "it works" is a very dangerous substitute for "it's well engineered."
That's what I'd like HN to help me figure out.
Suppose your LLM provider goes down. How do you fix bugs now?
Then I'd probably just stare at the error message until the LLM comes back...
or switch to another LLM provider...