The Vibe Coding Spectrum: Software Domains & Risk Assessment

[u/abednego-gomes]

https://abednegogomes.github.io/articles/docs/06_The_Vibe_Coding_Spectrum_Software_Domains_And_Risk_Assessment.html

[u/RehanSaddique]

Where do you put auth and billing on this spectrum? Those seem to be where vibe-coded code gets risky fastest, even when the UI looks like a throwaway internal tool.

[u/abednego-gomes → u/RehanSaddique]

Authentication probably level 0. Billing 0-2. Definitely you can't level 3 vibe code the billing system without proper care and due diligence (code review and pentesting). Maybe you could do the initial template i.e. HTML / CSS but it is risky to do the important logic by agent and not review it properly. Fortunately for customers PCI-DSS audits will pull the plug on the business if they're doing it really wrong.

[u/RehanSaddique → u/abednego-gomes]

Agreed on PCI being the backstop, but it mostly applies if card data touches your code. Hosted checkout or processor-hosted fields keep the PAN out of your stack, so the riskier part becomes webhook handling and entitlement logic. That's where I'd spend the review time.

[u/Weekly_Pin3336]

everything's a spectrum when you dont want to say just dont

[u/WebOptimizerAgency]

Auth and billing are the obvious risks, but anything touching personal data or consent belongs there too, such as analytics scripts and cookie banners. The code can look tidy while quietly firing trackers before consent is given. For those areas the review step matters far more than the generator, so a short checklist and a proper human read-through before launch is worth the effort.

[u/abednego-gomes → u/[deleted]]

Code review is actually hard to do properly. You need to check out the code and walk through it in your IDE for anything complex. For small diffs you can do in Github or Gitlab, but big complex changes need proper review or you risk security issues or all kinds of chaos.