But I can't imagine any big vulnerabilities in a local frontend anyway? I'd be more worried about accidentally sending/resending requests and generating unnecessary load for the server. For authentication it's hard to mess up as long as you're not sending passwords to servers other than the one you're trying to log in.

Depends on how expensive the tool is, mind you. I use local models so I've never had to poke around much at how much the paid ones go for, I don't know what you're using.

If you do opt for a scan, please disclose it properly. Many will never consider code that has been touched by an LLM in any shape or form, but it's better to be honest about it.

Finally, if you pay the frontier labs for their models you are supporting their business practices including training models on stolen data, the destruction of the environment and further inflation of the AI bubble. A local model is not much better, all things considered, but at least Scam Altman and Wario Amodei won't benefit.

I think that LLMs for coding is both terrible practice and environmentally costly, but I can see this sort of usecase being beneficial. Trying to find a model that's only been trained on open source code, and that runs without a huge environmental cost is tricky though. You really don't want the risk that some proprietary code has got into the training set and it gets regurgitated for you. There's been way too many court cases over a few lines of code being copied.

It's kind of a lose/lose tho. The target audience is very anti-LLM, so some people will hate it. It's that or leave low-hanging fruit bugs in there.

Either way, make sure to include an AI disclosure and explanation front-and-center. If I see a new project posted any more, I immediately write it off as low effort, vibe-coded slop until I have a reason to think otherwise. But using LLMs is not necessarily equivalent to slop imo.