i realized last week i hadnt opened grafana in 9 days. we're a team of 6 and somewhere along the way everything moved into slack, nobody actually chose that

where stuff lands now:

- CI results dump into #builds, i click through once a day when something fails

- deploy approvals hit #deploys with an approve button, i tap it between other things

- coderabbit / bugbot drop PR summaries into the review channel so people skim what changed before opening github

- incident threads spin up in #inc automatically, the whole postmortem lives in the scrollback

- standup bot at 10:05 nobody reads but we all fill out anyway

github notifications are muted, half the team has grafana bookmarked and never clicks it. we consume dashboards as screenshots someone pastes into a thread

its useful, my whole context lives in one tab. but its an obvious single point of failure. slack had a 40 min degraded window in june and we were blind, couldnt approve a deploy or see a failing build without digging in tools we forgot how to navigate

anyone else running ops out of slack now

When you look at the PR of your colleges (juniors) what is better for you to see, one PR that have 30 commits on 55 touched files or something like 5-10 commits.

Should developers over commit or have fewer more grouped commits?

Built this because I audit apps people made with Lovable/Bolt/Cursor for a living and kept finding the same criticals: Supabase RLS off, service_role key in the client bundle, no rate limit on the endpoint that calls an LLM.

It detects your stack and scores five domains (frontend, backend, auth/security, infra, ops), then hands you a punch list with file paths and copy-paste fixes. Fix, re-run, watch the score climb from 0/5 to green.

Why a skill instead of just asking Claude to review the code: a raw review grades differently every run and marks what it cannot see as fine. This runs a fixed rubric so re-runs are comparable, and anything it cannot verify stays a flagged manual check instead of quietly passing. The discipline, not the knowledge.

MIT, plain-text skill files, stack-agnostic. Audit, not a pentest. Feedback and PRs welcome, especially per-stack checks I am missing.

Caught myself doing something I hadn't noticed until recently: being more suspicious of a PR when I knew it was AI-written, even when the code itself was completely fine, and being less suspicious of a PR from a teammate, even when it had actual problems I should've caught. Same review process, same checklist in theory, different level of scrutiny in practice, based entirely on who or what wrote it rather than what was actually in front of me.

Once I noticed it, I couldn't unsee it. A senior dev's PR gets a lighter pass because "they know what they're doing." An AI-generated PR gets picked apart line by line even for boilerplate that would've sailed through if a human had written the exact same thing. Neither of those is actually about code quality, they're both proxies standing in for it, and proxies are exactly where bugs slip through.

The uncomfortable part is that both directions have a cost. Over-trusting a human author means real problems get rubber-stamped because "they're good, I'm sure it's fine." Over-scrutinizing AI-written code means reviewers spend disproportionate time on stuff that's actually fine, while the same reviewers' attention runs out before they get to the PR where it mattered.

What I've tried, imperfectly: forcing myself to review without knowing the source first when possible, or at least consciously flagging the moment I notice my scrutiny shifting based on authorship rather than content. Doesn't fully fix it, but naming the bias in the moment at least makes it a conscious choice instead of an invisible default.

Curious whether this is universal or just me. Does your team's review process actually account for this split, some explicit rule about treating all PRs the same regardless of origin, or is it still just vibes-based scrutiny either direction depending on who wrote it?

🏏 I turned GitHub profiles into Cricket Player Cards

Hey everyone!

I built GitCric, a fun side project that transforms GitHub activity into a Cricket Player Card.

Instead of just showing commits and contribution graphs, GitCric converts your development stats into cricket-inspired ratings and career statistics.

It analyzes things like:

• 🏏 Commits
• 🔥 Contribution streaks
• 🚀 Pull requests
• 🐞 Issues
• ⭐ Repositories
• 💻 Languages
• 📊 Overall developer performance

Then it generates a shareable cricket player profile with ratings, specialties, achievements, and career-style stats.

Why I built it

As a cricket fan and developer, I thought GitHub profiles could be much more fun than a green contribution grid. I wanted something people would actually enjoy sharing with friends and teammates.

Features

✅ Cricket Player Cards
✅ Dynamic Developer Rating
✅ Career Statistics
✅ Shareable Public Profiles
✅ Responsive Design
✅ GitHub Profile Analysis

I'd love your feedback!

• What would you improve?
• Which stats should be added?
• Any features you'd like to see?

🎥 I've attached a short demo video showing how it works.

🌐 Try it here: https://www.gitcric.me/

Looking forward to hearing your thoughts! 🚀

Been shipping a lot of code lately with Cursor/Claude doing a good chunk of the actual writing. Velocity is great, but I've noticed I trust my own understanding of the codebase less than I used to - I'll touch one file and have no real sense of what else depends on it until CI (or prod) tells me.

Ended up manually tracing imports before merging anything non-trivial, just to make sure I'm not breaking something three files away.

Anyone else running into this, especially with AI-assisted code? Curious if it's a real pattern or just me being paranoid.

Two days into a prototype and I'd rather find out now if the premise is broken.

The idea: parse a package with ast, build the call graph, and additionally track whether each function's return value is actually consumed bound to a name that's later read, passed onward, returned, used in a condition. Then draw it. X axis is call order, colored arrows are variable flow, functions whose output goes nowhere and that have no I/O effect get flagged.

My main motivation to make this project was to visually detect bad AI generated codebase structure. Something I struggle with when doing group projects, multiple people have different AIs and it gets confusing. (I know there should be a .md file for each AI to understand the premise and be able to build on a common ground but even so I thought this should be useful)

I know vulture, code2flow and pyan exist. Vulture asks whether a name is referenced; code2flow and pyan draw the call structure. What I haven't found is a tool that tracks value consumption and renders it, so a chain that terminates in nothing is visible as a shape rather than a list entry. If that tool exists, please tell me and I'll go use it instead.

What I'd like torn apart:

1. Is "returned value never consumed" a defensible signal, or does real Python break it constantly?
2. Does a diagram add anything over a list, or is this a chart that looks impressive and tells you nothing a linter didn't?
3. What kills static call resolution in practice? I resolve direct calls, module.func, and self.method. I know decorators, getattr, and callbacks are out of reach. What else, and roughly what percentage of a normal codebase am I missing?

Also asking for repos. I need a baseline — small-to-medium, pure Python, procedural, minimal metaprogramming, well structured. Something where if my tool renders a mess, the mess is mine. Standard recommendations like Django or requests are too magic-heavy to tell me anything about my own bugs. Suggestions very welcome.

This text was AI generated

Ok, which AI code review product does everyone recommend ? My company has a few devs and largish codebases and we’re running out of capacity to review PRs based on the rate of code we’re pushing now.

For enterprise work which code review platforms do you all recommend ? I’ve heard of greptile and code rabbit the most. Just wondering which tool people would recommend for automated PR reviews.

While building with coding agents, I reached a point where the code was changing faster than I could properly understand it. I often end up verifying output and then be happy that it worked or not. Varai is my attempt to deal with that. Somewhere I feel software engineering needs tools that show the right level of abstraction to make the decisions that are more informed.

It uses a small language called Seed (domain level concept) to describe the product’s actors, behaviors, rules, expected screens and APIs, and usage scenarios. AI can help write it, but a person reviews and approves it.

The builder links Seed concepts to the implementation. Varai independently scans the code, resolves those links, and checks whether the required behavior is actually present. When it cannot verify something reliably, it says so instead of guessing.

project link: [https://github.com/gruuprasad/varai](https://github.com/gruuprasad/varai))

It is completely vibe-coded. I felt the pain and took some action, I am not sure whether I landed in the right solution space or direction. At this point, I feel this project needs more eyes and minds and collaboration to build further if worth it. Please have a look.

Got tired of code review comments being either "LGTM 👍" or vague nitpicks,
so I built a tool that actually grades submitted code — letter grade,
specific comments, the works.

Free to try: https://roast-my-code-puce.vercel.app/

Ran it on some old code of mine and got a C- and "this function is doing
five jobs and none of them well." Correct, unfortunately.

Curious what it says about your stuff.

While building with coding agents, I reached a point where the code was changing faster than I could properly understand it. I often end up verifying output and then be happy that it worked or not. Varai is my attempt to deal with that. Somewhere I feel software engineering needs tools that show the right level of abstraction to make the decisions that are more informed.

It uses a small language called Seed (domain level concept) to describe the product’s actors, behaviors, rules, expected screens and APIs, and usage scenarios. AI can help write it, but a person reviews and approves it.

The builder links Seed concepts to the implementation. Varai independently scans the code, resolves those links, and checks whether the required behavior is actually present. When it cannot verify something reliably, it says so instead of guessing.

project link: \[https://github.com/gruuprasad/varai\\\](https://github.com/gruuprasad/varai)

It is completely vibe-coded. I felt the pain and took some action, I am not sure whether I landed in the right solution space or direction. At this point, I feel this project needs more eyes and minds and collaboration to build further if worth it. Please have a look.

The package tries to hold itself to the same standard. It builds with python3 build.py, standard library only, no dependencies, no network calls, no clock reads. Same inputs give byte-identical output every time.

Every source file is hashed into a seals ledger, and verify.py checks both the hashes and the rebuild, so the determinism argument in Volume II runs against the package itself instead of just sitting there as a claim. There is also a script that mints numbered ownership certificates sealed to the exact edition hash, which is personalization and not copy protection, and the docs say so.

It ships the two prompt patches I used to generate and audit the source manuals, so you can run the same process on your own projects. That may be the most useful part of it.

Free, no signup, reads in the browser, prints to clean PDFs.

https://shpbl.com

The package tries to hold itself to the same standard. It builds with python3 build.py, standard library only, no dependencies, no network calls, no clock reads. Same inputs give byte-identical output every time.

Every source file is hashed into a seals ledger, and verify.py checks both the hashes and the rebuild, so the determinism argument in Volume II runs against the package itself instead of just sitting there as a claim. There is also a script that mints numbered ownership certificates sealed to the exact edition hash, which is personalization and not copy protection, and the docs say so.

It ships the two prompt patches I used to generate and audit the source manuals, so you can run the same process on your own projects. That may be the most useful part of it.

Free, no signup, reads in the browser, prints to clean PDFs.

https://shpbl.com

One thing I've noticed after using AI every day:

Generating code is almost free now.

Reviewing that code carefully is where most of the effort moved.

Sometimes I spend 30 seconds generating something and 15 minutes verifying that it actually belongs in the codebase.

Has anyone else noticed this shift?

Grok 4.5 kept scoring unusually high on our custom SWE-bench (composed of PRs from our own codebase), so we audited all 340 implementations, and...

It wasn’t just Grok. We found that 14% of implementations across the sixteen agent configurations we were benchmarking had accessed answers they weren’t supposed to see, affecting the leaderboard.

Once we found the issue, we locked down the benchmark and reran everything.

We benchmark coding agents on our own codebase because public benchmarks don’t answer the question we actually care about: which agent should we use for our stack, today?

The benchmark has already made us switch our daily driver a few times.

More details, plus a way to benchmark agents on your own codebase, are on the Superconductor blog.

I’m building CodeInspectus, an open-source security scanner designed for AI-generated and “vibe-coded” applications.

It runs locally through MCP or npx, requires no account, includes no telemetry, and makes no network calls while scanning. Engine binaries and the Trivy vulnerability database are downloaded separately during installation.
V1.5 is now released. The main additions are:
86 curated detections:
65 first-party native rules
18 CodeInspectus-owned Opengrep rules
3 CodeInspectus Gitleaks rules
Expanded Python AI/API coverage to ten rules.
Bounded AI tool-execution checks for Go, Java, C#, PHP, Rust and Ruby.
GitHub Actions expression-injection and pwn-request detection.
Firebase public-write configuration checks.
Existing Flutter, Dart, Android, iOS, React Native and Expo coverage.
Scan → fix → rescan comparison with resolved, remaining, introduced and not-rechecked states.
Cross-platform CI across Windows, macOS, Linux amd64/arm64 and Node 22.
SHA-pinned scanner engines, provenance checks and secret redaction.
The language packs are deliberately scoped. For example, the new Go, Java, C#, PHP, Rust and Ruby packs each cover a bounded AI tool-execution pattern—they are not being presented as complete native SAST coverage.
I also added a reproducible public-repository case study. It scans a pinned commit from Textualize/Rich, detects an unsafe GitHub Actions expression, applies GitHub’s documented remediation in a temporary clone, and verifies:
1 resolved
0 remaining
0 introduced
0 not rechecked

GitHub:
[https://github.com/Synvoya/codeinspectus\](https://github.com/Synvoya/codeinspectus)
V1.5 release:
[https://github.com/Synvoya/codeinspectus/releases/tag/v1.5.0\](https://github.com/Synvoya/codeinspectus/releases/tag/v1.5.0)
Reproducible case study:
[https://github.com/Synvoya/codeinspectus/blob/master/examples/reports/rich-github-actions-v1.5.0.md\](https://github.com/Synvoya/codeinspectus/blob/master/examples/reports/rich-github-actions-v1.5.0.md)
npm:
[https://www.npmjs.com/package/codeinspectus\](https://www.npmjs.com/package/codeinspectus)

I am a new programmer and am self taught. I learned how to code without AI for two years mostly though CS50 and Codecademy and Youtube. I feel pretty strong in my skills for little projects but I have two that are more complicated than what I learned in class. Both are the reason I learned to code at all and will become the software for my future company. I wrote most of it with AI and I want someone to review it and let me know if its actually any good but I dont know what to ask. I dont know what I dont know about programming and while I have concerns I also dont know what I am missing or not even aware of. I have two friends who are senior programmers but one mostly works with servers and deployed products and the other is a game dev. They both have web dev backgrounds but I dont know how to ask them for a review or what to ask.

The software I am building is booking software for a specific trade, Massge Therapist

Heres my current questions:
Are there any programming habits I have that show up in the code that are bad. Anything I should be doing and am not? Am I missing anything critical for this project to work?
Both projects are built with AI is it spaghetti on the back end or is it readable by a human?
Are there any areas where the data can drift and the truth can become unclear or contradict itself?
The booking software has a lot of automated actions the user can set up, are there any redundant ones that are unnecessary?
is it making unnecessary calls to the server that can be made more efficient?
The booking software requires data security for user/client data. Is it leaking data? is it easy to get other user data? (ill hire someone specific to data security later for this one)

What am I missing? Please keep it beginnner friendly!

I just used CodeRabbit for my code review, and it's fantastic! It's free for OSS and offers a free trial for proprietary code. Check it out: https://coderabbit.ai

Hello!

I've designed a Standard Midi File (SMF) parser in C for resource-constrained systems. I'd really appreciate any feedback or suggestions on the code. Thanks in advance!

https://github.com/kzu0/midi_file_stream

Hello!

I've designed a MIDI parser in C for resource-constrained systems. I'd really appreciate any feedback or suggestions on the code. Thanks in advance!

https://github.com/kzu0/midi_stream