Nobody on my team reads code anymore
Heat trend
Collecting trend data
The percentage is based on available heat signal, not comment count or independent people.
Hugging Face model activity is surfacing — worth tracking for capability changes, ecosystem impact, and availability.
A developer observed that their team has stopped reading code, relying instead on AI, despite shipping faster. To mitigate this, they suggest using a different, specialized AI model for code review than the one that wrote the code. Examples include NVIDIA's 8B model outperforming 70B and 340B models for review severity, and a Hugging Face 7B model beating a 70B baseline by 46% for code review, especially for authentication bugs. Commercial tools like Coderabbit are also integrating Nemotron support for this purpose.
The last 2 months have been the fastest we've ever shipped, genuinely great for the company. But something serious crept in with it. The team started trusting the AI so much that nobody actually reads the code now.
I think this is the future and I'm not fighting it. But we still have a responsibility to ship safe software, and honestly it's easier to meet that responsibility with AI than without it. You write faster, so you have more time to verify. That time just has to actually go into verifying.
So here's my advice after 2 months of this, for whoever wants it:
- If you're not going to review the code yourself, or you just don't want to, write way more tests than you think you need. Every extra bit of coverage is one less place an AI mistake can hide where you'll never look.
- Never review code with the same model that wrote it. I've watched a model wave through its own bugs enough times that I just don't do it anymore. We write with whatever fits the task, Opus, Sol, Composer, Grok, then review with a different model. And the reviewer doesn't need to be big, it needs to be specialized. NVIDIA "fine-tuned an 8B model for review severity" here and it beat their 70B and 340B models at it. Hugging Face has a "writeup where a 7B trained for code review beat a 70B baseline by 46%" here , with the biggest gains on authentication bugs. Even the commercial tools are going this way, Coderabbit "added Nemotron support" here recently. A small model that only knows how to review sees things the big author model is blind to about its own code.
- Prefer several cheap review passes over one perfect one. There's a "nice experiment with a 12B reviewer" here showing multiple independent passes catch more than trying to make a single pass precise. Matches what we see, three quick passes from different models, dedupe the findings, done.
- Don't trust green tests or coverage numbers. There's a "study where LLM test suites hit 100% coverage with a 4% mutation score" here , meaning the tests ran the code but caught almost nothing. If a change matters, break the code on purpose and check that a test actually fails.
- Security needs its own pass, it will not fall out of functional review. "Veracode tested 100+ models" here and 45% of generated code failed security tests, with XSS insecure in 86% of relevant cases. Your tests can all pass while shipping that.
- Accept you can't review everything and tier it by blast radius instead. "Data from 22,000 developers" here shows review time up 441% and unreviewed merges up 31% under heavy AI adoption, the capacity problem is real. Auth, payments and migrations always get human eyes at ours, leaf code rides on the checks above.
That's what I've got so far. I genuinely just want a safer internet than the one we're heading toward, take whatever is useful from this :)