Ten developers using AI assistants don't produce one coherent codebase. They produce ten coding styles, ten prompt strategies, and ten different vulnerability surfaces — then merge them into one repo. The failures aren't random. They're structural: each developer's AI assistant has its own generation habits, its own blind spots, and its own non-determinism. What catches the gaps isn't another AI reviewer. It's a scanner that runs the same rules on every PR, every time, regardless of who wrote the code.
Why Individual Vibe Coding Habits Don't Aggregate
BrassCoders treats every developer's code the same way: it runs 12 static-analysis scanners — Bandit, Pylint, Pyre/Pysa, Semgrep, ast-grep, detect-secrets, and six custom detectors — and emits the union of their findings as YAML. The developer's name doesn't appear in the output. The AI assistant they used doesn't appear. What appears is the vulnerability pattern, the file path, and the scanner that caught it.
This matters because vibe coding habits don't cancel each other out at team scale. One developer prompts their AI assistant to be conservative with dependencies. Another prompts theirs to ship fast. A third uses a different model entirely. Each of these produces code with different structural properties. Some AI assistants tend toward certain SQL construction patterns. Some miss exception-handling edge cases in ways others don't. None of this averages out when you merge. Each developer contributes their AI assistant's specific blind spots to the shared codebase.
