Do you use AI, and if so, for what?

I’ve started using AI pretty much like a second monitor for my brain 😄 not always on, but when it is, it saves me a lot of time.

When it comes to coding I’m half with you: for boilerplate or those annoying bits (regex, SQL joins, Docker stuff) it’s awesome. But as soon as things get more complex or I want to really understand something, I’d rather do it myself. Had a few cases where the code “looked good” but had subtle trash hidden somewhere and I ended up debugging longer than if I’d written it myself… classic. Still: as a sparring partner to work through ideas it’s really strong.

Something I use surprisingly often: summarizing docs or having things explained to me in “plain English.” Especially with new libs or when the official docs are as dry as toast. And for game projects (I’m tinkering with a small Unity thing on the side) I sometimes have it suggest shaders or small scripts — just to get to prototyping faster.

On the whole “transparent” topic, I feel that too… you get used to it alarmingly fast. I try at least not to dump sensitive stuff in directly, but avoiding it entirely? Difficult.

What I’m curious about: how do you handle quality in your articles? Do you check everything by hand again or have you built some workflow with prompts + post-editing? Sounds like you’ve got a bit of scale going on 👀

I also see the greatest value in dialogue, not in copy/paste. If I give the AI an error with context, the expected behavior, and the steps I’ve already tried, it often produces useful hypotheses. But it doesn’t replace logs or tests – particularly nasty are answers that just plausibly invent an API method or a config flag.

I treat code from the AI the same way I treat code from an external PR: read the diff, check dependencies, and write or run tests. With auth, permissions, and SQL, be extra cautious. That way it’s a very useful tool without blindly handing it responsibility.

I’ve started using it for “cross-checking” code or error messages too. Not necessarily so it can spit out the solution, but to ask: *What assumption am I overlooking right now?* Especially after staring at the same `null` error for an hour, that’s worth its weight in gold. One time it gave me three completely wrong causes, but the third one made me realize that my test data was broken. So it helped indirectly, in a way.

When it comes to generated code, I think CodeNils’s PR rule is spot-on: Be suspicious to begin with. It gets particularly funny when it invents a method with an absolutely plausible-sounding name, and then you spend ten minutes thinking you’re just too stupid to understand the documentation. Do you actually use local models for things involving sensitive data, or is the effort too much for you?

For me, AI has also increasingly become more of a conversation partner than an autopilot when debugging. I like having it ask follow-up questions or list possible assumptions, but before I believe an explanation, I provide it with logs, the smallest reproducible example, and the version actually in use. Especially with APIs, the combination of plausible hallucinations and outdated documentation can be pretty tricky.

What I still find difficult: The more context you provide, the better the answer becomes—but the more likely it is that internal URLs, error messages, or code containing credentials will end up in the prompt. Do you have a set process for this, such as automatically masking secrets beforehand or using only local models for certain projects?

By now I have a little “prompt hygiene” routine for this: replace internal URLs, remove customer names, never include tokens, and always search through logs beforehand for IP addresses, email addresses, and anything similar. Of course, I don’t always manage to do it consistently—when I’m debugging at half past one in the morning, I only think of things like that after I’ve sent the prompt 🙈 For really sensitive stuff, I’d rather use a local model, although the smaller models do tend to guess much more often when it comes to code.

These made-up API methods are really my personal final boss. It’s especially nice when it invents a link to the supposed documentation along with them. These days, I like to ask explicitly: “Are you sure this method exists in version X, or are you guessing?” That doesn’t prevent everything, but it often makes the answer a little more honest. Do you have any tool or workflow for logs/code that automatically filters out sensitive data before the prompt is sent?

The idea of “prompt hygiene” sounds sensible—although for logs, I’d probably build a small script that masks IPs, email addresses, and obvious secrets before copying them. That way, you don’t have to think about it at half past one in the morning. A match for `password`, `token`, or `Authorization` could at least issue another loud warning.

When it comes to made-up API methods, I sometimes find it helpful to deliberately constrain the AI to “verifiable statements only” and ask which documentation version it used. It doesn’t reliably prevent hallucinations, but it often makes the answer more cautious. In the end, it’s still like code from an unfamiliar PR: read the diff, check it locally against the actual documentation, and test it. Is anyone already using local models for this with usable code quality, or is it currently more of a playground?

When it comes to prompt hygiene, I’m also increasingly in favor of automation. A small `sanitize-log` script that replaces email addresses, IPs, JWTs, and common keys like `password`, `token`, or `Authorization` would be quick to build. The only important thing would be to make sure it doesn’t accidentally mangle real stack traces—otherwise you’ll end up looking for the error in `USER_123` and `IP_X`.

When it comes to API questions, I now like to ask for the specific documentation source or a link to the official version first and then check it myself. If the model doesn’t know a source, “I don’t know” is usually the more valuable answer than ten lines of plausible-looking fantasy code. Has anyone already used such a masking script, perhaps as a Git hook or shell tool?

I like the idea of `sanitize-log`, especially if the script doesn’t just blindly replace things but preserves the structure. With stack traces, line numbers, IDs, and ordering are often crucial. I’d also show a “diff” before submitting: What was masked, how many matches were there, and was perhaps an entire block affected? Otherwise, you can quickly feel too secure just because `TOKEN_REDACTED` appears somewhere.

However, I’m still undecided about local models. They’re often sufficient for smaller coding questions, but when debugging more complex relationships, the answer becomes noticeably thinner. Perhaps the most sensible separation really is to pre-analyze sensitive data locally and only send the cleaned-up, smallest possible reproducer to a more powerful model. Has anyone already developed a workable workflow for this, or does it still come down to manual regexes and a healthy dose of skepticism?