I just came across someone with practically no coding experience releasing an open-source password manager called KAPEVault. Project: https://kapevault.brewedops.cloud/ And we’re not talking about some basic tutorial project. This is an actual downloadable Windows and Android application being publicly distributed for storing passwords, 2FA codes, API keys, government IDs, and other sensitive information. I’m a software engineer, and I actively use AI coding tools myself. I think they’re incredible. But seriously, of all the things you could build with little to no programming experience, why the fuck would you choose a password manager? To give credit where it’s due, the project is open source, has a documented threat model, automated tests, and a self-conducted security review. But the repository also explicitly acknowledges that it hasn’t undergone a third-party security audit. That’s a pretty important distinction when you’re asking people to trust your software with practically their entire digital identity. Using AES-256-GCM and scrypt doesn’t automatically make a password manager secure. Neither does having a polished interface, passing automated tests, or getting an AI to review its own output. Security isn’t just about choosing the right encryption algorithms. It’s about understanding the entire attack surface, handling secrets properly, identifying edge cases, and knowing what can go wrong even when everything appears to work. I’m not saying this particular project is insecure. I haven’t performed a security audit, and that would be an irresponsible claim. My concern is the growing confidence with which people are releasing security-critical software they may not fully understand. There’s absolutely nothing wrong with beginners experimenting, learning, and open-sourcing their projects. That’s how people improve. But building something for educational purposes and distributing something that real users might entrust with their banking credentials are two completely different levels of responsibility. AI has made it ridiculously easy to produce working software. Unfortunately, it has also made it ridiculously easy to mistake a working application for a secure one. You can outsource writing code to an AI. You can’t outsource accountability when something goes horribly wrong. At what point should we start taking this seriously? submitted by /u/onepunchcode
Originally posted by u/onepunchcode on r/ClaudeCode