Nobody on my team reads code anymore
热度趋势
趋势数据积累中
百分比基于当前可用热度信号，而非评论数或独立用户人数。
Hugging Face 相关模型动态已经出现，适合跟踪能力变化、生态影响和后续可用性。
一位开发者注意到，尽管团队发货速度加快，但他们已不再阅读代码，转而依赖AI。为解决此问题，他们建议使用与编写代码的AI模型不同的、专门的AI模型进行代码审查。例如，NVIDIA的8B模型在审查严重性方面优于70B和340B模型，Hugging Face的7B模型在代码审查方面比70B基线高出46%，尤其是在身份验证错误方面。Coderabbit等商业工具也为此目的集成了Nemotron支持。
The last 2 months have been the fastest we've ever shipped, genuinely great for the company. But something serious crept in with it. The team started trusting the AI so much that nobody actually reads the code now.
I think this is the future and I'm not fighting it. But we still have a responsibility to ship safe software, and honestly it's easier to meet that responsibility with AI than without it. You write faster, so you have more time to verify. That time just has to actually go into verifying.
So here's my advice after 2 months of this, for whoever wants it:
- If you're not going to review the code yourself, or you just don't want to, write way more tests than you think you need. Every extra bit of coverage is one less place an AI mistake can hide where you'll never look.
- Never review code with the same model that wrote it. I've watched a model wave through its own bugs enough times that I just don't do it anymore. We write with whatever fits the task, Opus, Sol, Composer, Grok, then review with a different model. And the reviewer doesn't need to be big, it needs to be specialized. NVIDIA "fine-tuned an 8B model for review severity" here and it beat their 70B and 340B models at it. Hugging Face has a "writeup where a 7B trained for code review beat a 70B baseline by 46%" here , with the biggest gains on authentication bugs. Even the commercial tools are going this way, Coderabbit "added Nemotron support" here recently. A small model that only knows how to review sees things the big author model is blind to about its own code.
- Prefer several cheap review passes over one perfect one. There's a "nice experiment with a 12B reviewer" here showing multiple independent passes catch more than trying to make a single pass precise. Matches what we see, three quick passes from different models, dedupe the findings, done.
- Don't trust green tests or coverage numbers. There's a "study where LLM test suites hit 100% coverage with a 4% mutation score" here , meaning the tests ran the code but caught almost nothing. If a change matters, break the code on purpose and check that a test actually fails.
- Security needs its own pass, it will not fall out of functional review. "Veracode tested 100+ models" here and 45% of generated code failed security tests, with XSS insecure in 86% of relevant cases. Your tests can all pass while shipping that.
- Accept you can't review everything and tier it by blast radius instead. "Data from 22,000 developers" here shows review time up 441% and unreviewed merges up 31% under heavy AI adoption, the capacity problem is real. Auth, payments and migrations always get human eyes at ours, leaf code rides on the checks above.
That's what I've got so far. I genuinely just want a safer internet than the one we're heading toward, take whatever is useful from this :)