> I need to build a website, with a database and the other obvious stuff.

There is nothing obvious about needing a database for a website.

As much as we’d like to say “Make me a website that does X, Y, and Z” and then taking a nap, I’ve found breaking it down is best, even if each step is done by AI.

I started with just ChatGPT for the preliminaries.

I wrote a description, loose set of requirements then had the AI review the requirements for completeness and consistency, then draft them into a requirements.md file.

Then I gave the requirements to the AI and had it generate an architecture and design doc.

Then I had the AI review the design against the requirements a few times, refining them.

I also did a couple of rough paper sketches of layout and photographed them (digital or scan would be fine/better of course).

Only then did I switch the agentic coding AI.

Again, I broke it down into steps.

First, mock up the UI/UX with dummy data.

Implement the backend needed to support the UI.

Hook it all up.

Refine and add features.

Have it do code reviews to remove dead code, consolidate redundancies, etc. Always make sure it meets its requirements and design (modify design if necessary so that it documents the real state). It can also maintain your Readme.md.

I did this in a long afternoon to create a utility site that tracked Azure DevOps PRs across multiple projects and repos, creating links to YouTrack tickets, and providing basic searching and sorting (so a lot of API calls and state persistence, but no local database). I only had a step “fail” once or twice, usually due to misunderstanding or vagueness. No real errors.

By the end of the afternoon, I gave the tool to my team and it’s been being used without error since. a few new features were requested and I did the last few steps for each new features - add feature, code review, requirements review, update design and Readme.md.

For security (or anything else really), you can ask the LLMs to implement those features, but it is up to you to verify that they are implemented correctly. The OWASP Top 10 are a good place to start.

Don't just trust it. I've done websites as sample projects to work with LLMs to understand them better.... and while sometimes brilliant, they can miss really obvious things. One time it did user login but never actually verified the password set for a user login.

Treat it like an intern/assistant, not a magical thing that does work for you. While sometimes brilliant, they can miss obvious things, especially if you don't hold its hand. Verify, verify, verify.