zlacker

>>gregor+(OP)
The commits are revealing.

Look at this one:

> Ask Claude to remove the "backup" encryption key. Clearly it is still important to security-review Claude's code!

> prompt: I noticed you are storing a "backup" of the encryption key as `encryptionKeyJwk`. Doesn't this backup defeat the end-to-end encryption, because the key is available in the grant record without needing any token to unwrap it?

I don’t think a non-expert would even know what this means, let alone spot the issue and direct the model to fix it.

>>rienbd+s22
That is how LLM:s should be used today. An expert prompts it and checks the code. Still saves a lot of time vs typing everything from scratch. Just the other day I was working on a prototype and let claude write code for a auth flow. Everything was good until the last step where it was just sending the user id as a string with the valid token. So if you got a valid token you could just pass in any user id and become that user. Still saved me a lot of time vs doing it from scratch.

>>victor+Ng2
> ... Still saves a lot of time vs typing everything from scratch ...

how ? the prompts have still to be typed right ? and then the output examined in earnest.

>>signa1+az2
A prompt can be as little as a sentence to write hundreds of lines of code.

>>fastba+dC2
Hundreds of lines that you have to carefully read and understand.

>>shaky-+bh3
Are you not doing that already?

I go line-by-line through the code that I wrote (in my git client) before I stage+commit it.

>>fastba+fs4
You read at the same speed line-by-line your code when you are in your git client?

You are doing something wrong. I go line-by-line through my code like 7x faster than I would do it for someone's else code, because I know what I wrote, my own intentions, my flow of coding and all of those details. I can just look at it en passant, while with AI code I need to carefully review every single detail and the connection between them to approve it.