Skip to content
CodeLifter

Provenance Desk

Sourced answers on what vibe coding leaves behind: detection, safety, ownership, licensing and disclosure. Every page leads with a short answer you can quote, then lists the primary sources the editors checked it against on 2026-10-15. Pages are drafted with AI assistance and reviewed by an editor; none of this is legal advice.

Three rubber stamps, one with an orange-red handle, beside a stack of blank index cards Most read · Detection Can you tell if code was written by AI? Not reliably. A 2024 study found existing detection tools all performed poorly on source code, and a watermark exists only if the generator added one. What does show authorship is a record made at the time: commit history, an Assisted-by or Co-authored-by trailer, a pull request note. 8 sourcesVerified 2026-10-15

All pages 10

  1. A black clipboard holding a blank checklist form, an orange-red pencil across the bottom Reference AI-code policy tracker Sixteen published policies from open source projects and foundations, each linked to the organisation’s own page. Six ban AI-generated contributions, five require or expect a label, and five allow it on conditions.
    AI-assistededitor-reviewed
    16 sources · 2026-10-15
  2. A small black balance scale holding a blank index card in one pan and an orange-red tag in the other Safety Is vibe coding bad? Fine for throwaway prototypes, risky for code other people run. A 2022 study found assistant users wrote less secure code yet felt more confident, and a 2024 study found models recommending packages that do not exist.
    AI-assistededitor-reviewed
    6 sources · 2026-10-15
  3. A blank envelope sealed with orange-red tape, beside an old iron key Safety Is vibe-coded software safe to ship? Not without review: a 2021 study found about 40% of 1,689 programs written by GitHub Copilot to be vulnerable. A ten-minute routine for secrets, user input, fake packages and licence notices.
    AI-assistededitor-reviewed
    6 sources · 2026-10-15
  4. A folded sheet closed with a plain orange-red wax seal, beside a stick of sealing wax Ownership Who owns AI-generated code? Under US law, code generated from prompts alone has no copyright owner. The Copyright Office report of January 2025, the Thaler v. Perlmutter ruling, and what GitHub’s terms say about output.
    AI-assistededitor-reviewed
    5 sources · 2026-10-15
  5. Black scissors beside a cut strip of blank paper with an orange-red tag Licensing May I use a snippet I copied? Usually, on the terms it was published under: Stack Overflow content is CC BY-SA 4.0, newer MDN code samples are CC0, and an unlicensed GitHub repository grants nothing.
    AI-assistededitor-reviewed
    6 sources · 2026-10-15
  6. A paper-wrapped parcel tied with string, with a blank orange-red bordered label Disclosure Disclosing AI help in commits Add the trailer your project names, usually Assisted-by. What the Linux kernel, Mesa and LLVM ask for, and why Mesa reserves Co-authored-by for human co-authors.
    AI-assistededitor-reviewed
    6 sources · 2026-10-15
  7. An open manila folder holding a blank ruled form, clipped with an orange-red paper clip Disclosure How to keep a provenance record Five fields beside the code: origin, author type, an SPDX licence identifier, sources and the date it was last verified. The five fields are a CodeLifter convention; SPDX, REUSE and the NTIA SBOM elements sit underneath.
    AI-assistededitor-reviewed
    6 sources · 2026-10-15
  8. A wooden card catalogue drawer full of blank index cards, one orange-red divider Reference Glossary of code provenance terms From vibe coding and MCP to SPDX, SBOM and SLSA, each term defined in plain words and tied to the document that defines it.
    AI-assistededitor-reviewed
    21 sources · 2026-10-15
  9. A black computer mouse under a glass paperweight, an orange-red tag beside it Authorship Does disabling right click protect your content? No. The script cancels one browser event, and view source, developer tools and screenshots still work. Copyright, a licence and signed commits show who made the work.
    AI-assistededitor-reviewed
    5 sources · 2026-10-15

Questions on the forum

Ask on the forum
  1. Provenance · Answered by the editors Can you prove you wrote a piece of code yourself?
  2. Prompts · Answered by the editors How do I stop a coding assistant from using innerHTML?
  3. Policy · Answered by the editors How can a team enforce an Assisted-by trailer on commits?