--- title: A Security-Critical Project Where I Don't Read the Code description: A developer shares how ShellSyntaxTree (SST), a bash/PowerShell AST parser used in production by thousands of Netclaw installations, is built almost entirely... canonical: https://daily.dev/posts/a-security-critical-project-where-i-don-t-read-the-code-biqp7b91d twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A Security-Critical Project Where I Don't Read the Code | daily.dev og:description: A developer shares how ShellSyntaxTree (SST), a bash/PowerShell AST parser used in production by thousands of Netclaw installations, is built almost entirely... og:url: https://daily.dev/posts/a-security-critical-project-where-i-don-t-read-the-code-biqp7b91d og:image: https://api.daily.dev/og/posts/BIQP7B91D.png og:image:alt: A Security-Critical Project Where I Don't Read the Code og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A Security-Critical Project Where I Don't Read the Code **[Aaronontheweb](https://daily.dev/sources/aaronontheweb)** · 10 min read · 0 upvotes · 0 comments ## Summary A developer shares how ShellSyntaxTree (SST), a bash/PowerShell AST parser used in production by thousands of Netclaw installations, is built almost entirely by LLMs (specifically Codex running headlessly) without manual code review. Three properties make this possible: narrow, well-constrained mission scope; high verifiability through thousands of regression-tested command corpuses that run in under a minute; and fast feedback loops via dogfooding SST into Netclaw. The author argues that skipping code review is only viable when software is cheap to verify exhaustively, tightly scoped, and has rapid feedback — conditions that most projects don't meet. Human oversight shifts from code review to product-manager-style concerns: API ergonomics, developer experience, and behavioral correctness within constraints. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What conditions make it safe to skip code review for LLM-generated code in production? Three properties make unreviewed LLM-authored code viable in production: a narrow, well-constrained mission that limits what the LLM must decide; high verifiability, meaning the software can be exhaustively regression-tested cheaply and quickly; and fast feedback loops where failures surface rapidly and feed back into the test suite. Most projects lack all three, making review still necessary for the vast majority of software. _Teams shipping LLM-generated code without review track the edge cases and regressions that matter on daily.dev._ ### What is the difference between verification and testing in software quality assurance? Verification aims to be exhaustive by design, while testing is meant to be indicative. In practice, verification means running thousands of known inputs through a system and asserting correct outputs across the entire back-catalog on every change — catching regressions broadly. Testing, by contrast, samples behavior to give confidence rather than attempting full coverage. The distinction matters most when deciding how much human review is still needed. _Developers rethinking their QA strategy around LLM-generated code find relevant debates and approaches on daily.dev._ ## Similar posts on daily.dev - [When to use SAST versus an LLM security scanner](https://daily.dev/posts/when-to-use-sast-versus-an-llm-security-scanner-g0xclaxzt) · GitLab · 0 upvotes · 0 comments - [The Role of Static Code Analysis in Fintech Compliance](https://daily.dev/posts/the-role-of-static-code-analysis-in-fintech-compliance-d509dy1wy) · JetBrains · 1 upvotes · 0 comments - [Hybrid Automated Code Review: Deterministic AST Rules \+ LLMs](https://daily.dev/posts/hybrid-automated-code-review-deterministic-ast-rules-llms-cpb0eabf8) · SitePoint · 0 upvotes · 0 comments --- Tags: [#testing](https://daily.dev/tags/testing), [#llm](https://daily.dev/tags/llm) [View this post on daily.dev](https://daily.dev/posts/a-security-critical-project-where-i-don-t-read-the-code-biqp7b91d) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A Security-Critical Project Where I Don't Read the Code","url":"https://daily.dev/posts/a-security-critical-project-where-i-don-t-read-the-code-biqp7b91d","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-security-critical-project-where-i-don-t-read-the-code-biqp7b91d"},"datePublished":"2026-08-10T19:33:53.498Z","dateModified":"2026-08-12T12:28:42.795Z","description":"A developer shares how ShellSyntaxTree (SST), a bash/PowerShell AST parser used in production by thousands of Netclaw installations, is built almost entirely...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6e71d180ae666292cd9ca63ec72a2765?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6e71d180ae666292cd9ca63ec72a2765?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aaronontheweb","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aaronontheweb","logo":"https://media.daily.dev/image/upload/s--tSGdiukL--/f_auto/v1711188699/logos/aaronontheweb","url":"https://daily.dev/sources/aaronontheweb"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-security-critical-project-where-i-don-t-read-the-code-biqp7b91d","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"testing,llm","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aaronontheweb","item":"https://daily.dev/sources/aaronontheweb"},{"@type":"ListItem","position":3,"name":"A Security-Critical Project Where I Don't Read the Code"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-security-critical-project-where-i-don-t-read-the-code-biqp7b91d#faq","mainEntity":[{"@type":"Question","name":"What conditions make it safe to skip code review for LLM-generated code in production?","acceptedAnswer":{"@type":"Answer","text":"Three properties make unreviewed LLM-authored code viable in production: a narrow, well-constrained mission that limits what the LLM must decide; high verifiability, meaning the software can be exhaustively regression-tested cheaply and quickly; and fast feedback loops where failures surface rapidly and feed back into the test suite. Most projects lack all three, making review still necessary for the vast majority of software. Teams shipping LLM-generated code without review track the edge cases and regressions that matter on daily.dev."}},{"@type":"Question","name":"What is the difference between verification and testing in software quality assurance?","acceptedAnswer":{"@type":"Answer","text":"Verification aims to be exhaustive by design, while testing is meant to be indicative. In practice, verification means running thousands of known inputs through a system and asserting correct outputs across the entire back-catalog on every change — catching regressions broadly. Testing, by contrast, samples behavior to give confidence rather than attempting full coverage. The distinction matters most when deciding how much human review is still needed. Developers rethinking their QA strategy around LLM-generated code find relevant debates and approaches on daily.dev."}}]} ```