Using AI agent to code
Using AI agent to code
As a solo developer on side projects, you need to have things done, and done fast. With this, I wanted to test the new Laravel boost. Instead of me writing Controllers, migrations and an AI could write for me and save me the time, it was a great idea. I set up Laravel boost to work with Claude as an agent, I created my project, it’s a simple api support, newsletter and ticketing system for apps that are or maintained on DebuggedSoftware.
With that I embarked on creating the project fast, and Laravel boost is really good, it even created the test cases and tested them, it’s awesome to say the least but… It has its flaws and you need to check them out.
It generated the code that would have taken me more than a few minutes and all I had to do was audit it. When doing the audit, I loved the new code, it was precise, well structured and formatted, the migrations, controllers and models looked great, until I looked at the api.php (the file responsible for the API endpoints). I was shocked to find the API endpoints for viewing, editing and deleting the support tickets, newsletters and contact info were visible and anyone who had seen the code which I had pushed to Github, could just do a curl or use postman to do a delete or get the data from the API.
I loved using Laravel boost, but you have to be careful and have it tested and audited well.
What I Found: Instead of generating protected API routes, Boost created all the routes as public. For instance, it generated a simple Route::delete(...) instead of wrapping it in an auth:sanctum middleware group.
Why It Happened: I think the AI defaults to the simplest, most common implementation. It’s great at structure but doesn’t inherently understand security context.
How I Fixed It: The fix was simple but crucial. I moved all the API routes into the auth:sanctum middleware group. It took me five minutes, but it saved a massive security vulnerability.
Get eric muigai’s stories in your inbox
Join Medium for free to get updates from this writer.
My Key Takeaways:
- Incredible for Speed: It drastically reduces boilerplate coding time.
- Not a Security Expert: You are still the architect and the security guard.
- Never deploy its code without a thorough audit.
- Audit the Routes File First: This is now the first file I check.
Have any of you tried Laravel Boost or other AI coding agents? What was your experience?
