Blog

Writing on AI code quality

Deterministic linting, API hallucinations, and what happens when you stop trusting AI to test its own code.

·6 min read

Vibe Coding Isn't the Problem. Skipping Verification Is.

The speed of vibe coding was never the risk — treating verification as optional is. How to keep the loop fast with a deterministic CI gate between 'agent wrote it' and 'it merged'.

·7 min read

The State of AI Code Quality: What We Found Scanning Real Codebases

First-party data from api-doctor's first five weeks of external scans: two-thirds of scans surface a real integration issue — and every finding is a measurement API providers have never had: which parts of their docs are failing AI agents.

·7 min read

The Fix Should Ship With the Bug Report: Why API Verification Needs to Write the PR

Y Combinator's RFS says API providers shouldn't announce changes — they should apply them, agent-opened PR and all. api-doctor already runs that loop: rules tracked against the latest SDKs, and the fix opened the moment one fires.

·9 min read

The Vibe Coding Security Crisis: What the 2026 Data Actually Shows

62% of AI-generated code contains vulnerabilities, AI-linked CVEs grew 6x in three months, and one in five samples imports a package that doesn't exist. Here's what the numbers mean and what to do.

·8 min read

Secrets Management for Claude Code: A Practical Setup Guide

Claude Code will read your .env and can paste real key values into generated code. Here's the guardrail setup: gitignore, CLAUDE.md rules, permission denies, and a pre-commit scan.

·8 min read

How to Hide API Keys From AI Coding Agents (Claude Code, Cursor, Windsurf)

AI coding agents hardcode API keys because they can't see your .env setup. Here's how keys leak into client bundles and git, and how to catch it before you ship.

·5 min read

Silent Failures: Why AI Code Passes Tests But Breaks in Production

Code compiles. Tests pass. Code review approves. Then it fails in prod. Here's the pattern every api-doctor user finds.

·2 min read

You Can't Test AI Code With AI (Here's Why & What To Do Instead)

Claude writes broken code. Claude writes broken tests. You need deterministic verification to break the loop.

·3 min read

Webhook Signature Verification: The #1 Bug AI Agents Miss

Your Claude Code/Cursor skips webhook verification. Attackers can spoof requests. api-doctor catches this before deploy.

·3 min read

Your AI Handler Accepts Any Webhook Shape (And You'll Regret It)

Claude Code accepts any webhook structure. Provider changes it. Code crashes silently. api-doctor validates schemas.

·2 min read

Why api-doctor's Rules Are Open Source (Transparency Matters)

See exactly what api-doctor checks. All rules open source on GitHub. No black boxes.

·3 min read

Network Timeouts Cause Double Charges: The Idempotency Key Bug

Your Stripe/Resend call retries without idempotency keys. Customer charged twice. Here's why api-doctor catches it.

·2 min read

Add api-doctor as a Claude Code Skill in 1 Minute (Auto-Fix API Bugs)

Make Claude Code auto-verify and auto-fix API bugs. One-minute setup. Zero manual checking.

·4 min read

Why Your AI Coding Agent Hardcodes API Keys (And How to Catch It)

Claude Code and Cursor hardcode API keys and secrets by default. Here's why AI coding agents do it, and how api-doctor catches it before you commit.

·4 min read

Claude Code Auth Bug: When Your AI Locks Users Out of Their Accounts

Claude Code inverts auth logic by default. Users locked out. Tests pass. api-doctor catches it before deploy.

·3 min read

AST Rules vs LLM Prompts: Why You Can't Ask Another AI to Review AI Code

Testing AI code with AI is like asking a hallucination to detect hallucinations. Here's the deterministic alternative that actually works.

·2 min read

We Analyzed 237 AI Projects. Here's Every API Bug We Found.

237 developers. 237 projects. Here are the patterns of bugs your AI generates (and how to catch them).

·4 min read

Code Review Isn't Enough: Why api-doctor Catches What Humans Miss

Your reviewer doesn't know Stripe docs by heart. They miss idempotency keys, webhook verification. api-doctor doesn't.