NoCode, a developer tool built around reviewing AI-generated code changes as diffs before they touch your project, shipped its flagship feature last week—only to discover it had been disabled by default the entire time. The company's founder detailed the incident in a post on DEV.to on August 18, calling it "the mechanism was never wired up."

A Review Gate Nobody Reviewed

The irony isn't subtle: a code review tool shipping without its review gate enabled means users were generating AI code changes with zero oversight. For a product whose entire value proposition hinges on catching AI hallucinations and security issues before they reach production, this is the kind of bug that makes you want to pull an all-nighter.

The Scale of the Problem

The incident lands against a backdrop of widespread skepticism about AI code quality. According to Sonar's 2026 research, 96% of developers don't fully trust AI-generated code—yet only 48% of them verify it before shipping. That gap between distrust and action is precisely why products like NoCode exist in the first place.

What Went Wrong

The founder didn't specify technical details about the misconfiguration, but described finding the disabled gate during what sounds like a routine audit. The feature they built their name around—the diff-based review mechanism that gives developers visibility into AI changes—was simply not active for new users out of the box.

Defaults Matter in Dev Tools

This incident underscores how critical configuration defaults are in developer infrastructure. When your product promises to solve a trust problem with AI-generated code, shipping with verification disabled defeats the entire purpose. Users expect security and review features to be enabled by default, not something they have to hunt down in settings.

The Fix

NoCode has since enabled the review gate for all users, according to the post. But the story serves as a reminder that shipping fast means nothing if you're shipping the wrong thing—infrastructure tooling especially needs to get the basics right before adding features.

Key Takeaways

  • Always audit your defaults, especially in security-critical paths
  • If your product is named after a feature, make sure it's enabled by default
  • 96% of developers don't trust AI code—but only half verify it before shipping

The Bottom Line

NoCode's whole reason for existing depends on that review gate being active—by disabling it by default, they left their users exposed to the exact problem they built the product to solve. This is a cautionary tale about how a single misconfigured default can undermine months of engineering work and shatter user trust in an instant.