See the first paragraph here: https://alexgaynor.net/2026/sep/07/is-it-correct/
If your definition of "works" includes "doesn't have vulnerabilities", you're going to need to do more than just poke at it and add tests.
If your definition of "works" includes "doesn't have vulnerabilities", you're going to need to do more than just poke at it and add tests.
It's not perfect, but vibe coding means you don't even get that.
Vibe-coding actually might be the absolute best way to find vulnerabilities because the AI knows a lot more about them than you or I do, it can pattern-match against known anti-patterns, will do exhaustive searches without flagging halfway through, and is kept up-to-date by its ongoing weight-maintenance about new types of vulnerability.
What you have prompted me to do is add a pass to the 'make a release' script to ask it to search for vulnerabilities and report them, then put any found ones on the TODO list for the next pass.