Vibe coding: when to trust the AI, when to read the diff

I’ve been writing software for twenty-five years, and for the last six months an AI has written a lot of it next to me. That sentence would have annoyed me a decade ago. Now it’s just how I work — but only because I figured out where to hold the wheel.

“Vibe coding” gets mocked as letting the model run wild while you nod along. That’s not it. The vibe is the direction — the taste, the architecture, the call on what’s worth building. The typing is negotiable. The judgment is not.

Trust the AI for the boring middle

Scaffolding, glue code, the third CRUD endpoint that looks like the other two — hand it over. This is where models are genuinely faster than me and rarely wrong in ways that matter. If I can describe it in a sentence and I’d be bored writing it, it’s a good candidate.

The model is a fast junior who never gets tired and never gets defensive. Treat the output like a PR from someone you like but don’t fully trust yet.

Read the diff when it touches anything real

There’s a line I don’t cross: anything that touches money, auth, data deletion, or a public API gets read line by line. Every time I’ve skipped that, I’ve paid for it. My rule of thumb:

• If it can lose a user’s data, I read every line.
• If it can leak a user’s data, I read it twice.
• If it only affects me, I let it ride and fix it later.

The part people miss: reading the diff is also how you learn the codebase the model is building. Skip it and six months later you’re a tourist in your own repo.

# block commits that touch auth without a human reviewer
if git diff --cached --name-only | grep -q 'auth/'; then
  echo "⚠ auth changed — read the diff before you ship"
  git diff --cached auth/ | less
fi

That’s the whole philosophy in one hook. Let the AI move fast everywhere it’s cheap to be wrong, and force a human pause everywhere it’s expensive. The speed is real. So is the discipline that makes the speed safe.

Twenty-five years in, the tools finally feel like leverage instead of overhead. I just had to stop pretending the judgment was ever going to be automated away.