420: AI for the Code-Writing Purist: How to Use AI Without Surrendering Your Keyboard

October 24, 2025·23 min·1 clip

Arvid explains how a Claude Code security review caught a dangerous uncached search field he was about to deploy to PodScan's homepage.

This is aimed at code-writing purists. Arvid names the founder who sees Cloud Code, Cursor, Codex, and similar tools generating whole feature sets and immediately thinks about bugs, security vulnerabilities, and all that kind of stuff. He is not asking that founder to hand over the keyboard. The case, at least from the available excerpt, is tighter than that: use AI where the problem is narrow, visible, and grounded in the codebase. That distinction does a lot of work. Instead of treating a model like a replacement developer, Arvid describes an agentic system that can inspect one focused problem and catch details a tired founder might miss. The database example is the most practical one. He talks through index ordering, where a lookup that seems fine when it is created can be wrong once the real query pattern sorts and filters in a different way. It is the kind of mistake that slips through because it feels too small to revisit. With access to the surrounding data and a bounded job, the agent can flag the mismatch without acting like it owns the product. Security gets more time. Arvid points to Cloud Code's security review feature as a behind the scenes check on recent changes before they turn into bigger risks. The tone stays pretty sober. He is not cheering on careless vibe coding. He is looking for leverage against insecure applications that show up when people ask models to build too much too quickly. Prompts become a kind of policy. His hypothetical is to put application security preferences and common best practices into a system prompt, then have the tool review the codebase through that lens. That is the useful line: the machine gets a constrained inspection job, while the founder keeps judgment over scope. The close turns toward PodScan.fm, where Arvid applies the same founder logic to monitoring over 4 million podcasts, finding customer insights, and turning messy market chatter into competitive intelligence and startup ideas.

As heard by us

A practical argument for using AI as a scoped code reviewer and security check, without giving up control of the keyboard.

Arvid Kahl makes a useful case for AI as a focused assistant for founders who still want to keep their hands on the code. His argument is less about handing over the product roadmap to an agent and more about giving AI narrow jobs with clear boundaries: checking recent changes…

Read the full review in PlayNext →

Why you'd press play

Use AI for the sharp edges, not the whole keyboard.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from The Bootstrapped Founder