I’ve been working on an open source project called Pando (https://github.com/trypando/pando), which is meant to help alleviate “Shadow AI” vibecoded apps in workplaces, and give employees an outlet for what they build.

With that said, it’s a big project and I’m a solo maintainer right now, and as a result I’m using AI for much of the development process. Obviously this isn’t new. AWS, Google, Meta, and pretty much every company and developer is using AI to assist in development and code review now. It’s the name of the game in many cases.

So my question is, when building with AI, without another human to read my PRs, what are some ways to ensure the code isn’t slop?

Currently, I’m doing standard unit tests (but no mutation tests, so these could be bad tests), duplication testing, CodeQL scanning, integration and smoke tests, and I’m also using SonarQube and CodeRabbit. This has slowed down PR velocity tremendously, but I’m ok with that if my quality and peace of mind is increasing.

I could build Pando closed source and put out a bunch of slop, and no one would be the wiser until stuff started breaking, but that’s not the point of the project. But being completely visible, and targeted at real orgs, I feel like the bar is high.

Thoughts?

I do extremely regular audits

I just ask..

Me: How much of this application is slop?

Claude: Exactly the right amount.

Me: Commit, push and backup the session.