# Require LLM-generated themes & plugins to be tagged as such
**URL:** https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871
**Category:** Site feedback
**Created:** [20 september 2026 om 19:27 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871 "2026-09-20T19:27:15Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@darkpixlz](https://meta.discourse.org/u/darkpixlz)
#### Post date: [20 september 2026 om 19:27 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/1 "2026-09-20T19:27:15Z")
Currently some people may try to upload plugins, themes, or components entirely generated by LLMs and not disclose it as such. There’s many reasons why it may be beneficial to know when something is fully generated by a LLM and there is no obligation to disclose said plugins as such at the moment. Personally, I would like to know upfront so I don’t end up installing a low-quality plugin with many performance/optimization/UX problems that LLM plugins have.
Obviously this relies on people being truthful and upfront (and people who have AI generated topics might not know better than what it says) but having a tag like #ai-generated that gets put on assets that are primarily AI generated would be beneficial for everybody.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [20 september 2026 om 19:48 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/2 "2026-09-20T19:48:18Z")
> [@darkpixlz](#):
>
> low-quality plugin with many performance/optimization/UX problems that LLM plugins have
I disagree with the notion that an LLM-generated plugin is inherently low-quality or necessarily suffers from performance, optimization, or UX issues. The quality of the result depends heavily on the person guiding the LLM and reviewing its output.
I’ve taken pride in the software I’ve developed over the past 40 years, and incorporating LLMs into my workflow has improved the quality of my work, not diminished it.
Conversely, I’ve seen plenty of hand-written plugins riddled with security vulnerabilities, performance issues, and poor design decisions, where I genuinely wished the author had used an LLM. Ultimately, it’s the quality of the developer and the resulting code that matters, not whether an LLM was involved in writing it.
---
### Author:  [@satonotdead](https://meta.discourse.org/u/satonotdead)
#### Post date: [20 september 2026 om 20:20 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/3 "2026-09-20T20:20:04Z")
I wonder how you suggest reviewing and/or updating code generated by LLMs, for those of us who are getting into vibe-coding to implement new functionalities or customize the actually shipped ones.
I know that a collective review in public repositories is ideal, but I would like to first do my homework and only publish versions that have exhausted my current capacity.
I am agree with the previous comment, not being anti-AI but at the same time being aware that EVERYTHING they generate must be audited, verified, and updated by humans.
Something curious, related:
> **[Someone Shared a Real Monet Painting as AI and Asked for Critiques](https://petapixel.com/2026/05/14/someone-shared-a-real-monet-painting-as-ai-and-asked-for-critiques/)**
>
> Someone shared a real Monet painting as an AI image and asked for critiques as to why AI art is inferior to the real thing. Hilarity ensued.
---
### Author:  [@darkpixlz](https://meta.discourse.org/u/darkpixlz)
#### Post date: [20 september 2026 om 21:48 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/4 "2026-09-20T21:48:11Z")
> [@RGJ](#):
>
> The quality of the result depends heavily on the person guiding the LLM and reviewing its output.
This is totally fair and at the end of the day I’m only allowed to speak for myself which has been observations of low-quality “slop” apps that all look identical and are generally low quality (both in terms of functionality and security), along with existing apps that have severely gone down in quality since they started largely offloading work to LLMs (such as visual studio code and formbricks; both of which I have since stopped using). Even if your app is perfect there’s still ethical concerns so it would be great if there was some form of notification for these creations as suggested. Doesn’t mean anybody _has_ to base anything off the tag but if you would like to then the option is nice.
> [@satonotdead](#):
>
> I wonder how you suggest reviewing and/or updating code generated by LLMs
As I said, this is inherently trust-based system and the sole developer’s responsibility to ensure it is tagged as such. Obviously there are some cases where the LLM tags itself in the git logs (like most do) so a TL3+ can take action if desired by viewing the GitHub.
---
### Author:  [@satonotdead](https://meta.discourse.org/u/satonotdead)
#### Post date: [20 september 2026 om 22:49 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/5 "2026-09-20T22:49:25Z")
> [@darkpixlz](#):
>
> As I said, this is inherently trust-based system and the sole developer’s responsibility to ensure it is tagged as such. Obviously there are some cases where the LLM tags itself in the git logs (like most do) so a TL3+ can take action if desired by viewing the GitHub.
I appreciate your reply, thank you. My inquiry is also directed to everyone and concerns tools that currently exist to verify code generated by LLMs.
I am not a developer, but I managed to implement functionalities that did not exist in Discourse. And I want to do what is within my reach in the best possible way.
I will consider tagging if I end up publishing my repositories; for now, they are private precisely because I am testing them, and I am interested in doing it right before distributing to the community.
---
### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [20 september 2026 om 22:55 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/6 "2026-09-20T22:55:14Z")
I’d be _extremely_ surprised if most _Core_ code (inc. Core Plugins) was not now built with Coding Agents, such is the extent to which development has changed.
It is also clear a lot of effort has been put into the Discourse repo to make it coding agent friendly, both for building extensions and modifying core.
It is now, imho, very hard to justify _not_ using coding agents on most work as the drop in efficiency simply wouldn’t make business or even common sense.
This horse has truly bolted (in fact it bolted around September 2025)
It’s only about standards and workflow refinement now.
You might be better off asking for a tag for “no AI was used to build this” aka “ai-free” as that would apply to so very few.
I get the sensitivity around this, but I really believe the world has moved on.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [21 september 2026 om 00:39 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/7 "2026-09-21T00:39:56Z")
I am not concerned at all about “how a plugin was formed” and if the craft person used a pencil vs a pen.
“No AI here”, is not something that gives me even an ounce of extra confidence when it comes to installing a theme or plugin.
However… there is a much more serious problem we need to tackle at CDCK.
Core plugins and source code at Discourse is security scanned regularly, when a person installs a supported channel they have confidence around how secure the code is.
The **third party** plugins and themes here are “the wild west”, anyone can contribute, we do not security scan them or ensure they are following best practices. This puts the community at risk.
I would like to reach a world where “version XYZ” of theme was at least automatically scanned to give self hosters at least some confidence.
So my vision here is the complete opposite :slight_smile: require versions of third party themes and plugins pass some sort of AI scan prior to being advertised here.
---
### Author:  [@darkpixlz](https://meta.discourse.org/u/darkpixlz)
#### Post date: [21 september 2026 om 01:07 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/8 "2026-09-21T01:07:25Z")
Code review by LLM is totally different than “claude build me this app and make no mistakes” and publishing the output with little to no validation or edits you made yourself in my opinion at least on ethical grounds. Unfortunately, you can’t really force an end user to have accountability, and no matter how hard you try _somebody_ will find a way to download something malicious. But regardless, how ethical LLMs are is a separate conversation and not really relevant to this thread.
> [@satonotdead](#):
>
> I am not a developer, but I managed to implement functionalities that did not exist in Discourse
and that’s okay! I’m not suggesting a sweeping ban on anything with AI involvement in #Customization.. I’d just like it tagged properly so those who do not want to open that can of worms don’t end up doing so.
---
### Author:  [@elmuerte](https://meta.discourse.org/u/elmuerte)
#### Post date: [21 september 2026 om 06:05 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/9 "2026-09-21T06:05:05Z")
I have a lot of issues with LLM based tooling (and their results). Not just the security, legal, reliability, and environmental problems. But that is besides no the main issue here.
Security, the broad definition, is the important issue here. If the code is AI generated or not.
What tooling does CDCK use for security checks? Various of them would also be important for 3rd party creations.
But there is more to check for. With which external systems does the 3rd party creation talk to. Most security analysis tools will accept that software communicates with external servers, without a heartbeat. But a pure cosmetic theme component should not perform any call to an external server. So the 3rd party creation can contain security holes, or contain issues which can harm availability. But they could also exfiltrate data.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [21 september 2026 om 06:50 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/10 "2026-09-21T06:50:42Z")
> [@sam](#):
>
> Core plugins and source code at Discourse is security scanned regularly, when a person installs a supported channel they have confidence around how secure the code is.
>
> The **third party** plugins and themes here are “the wild west”, anyone can contribute, we do not security scan them or ensure they are following best practices. This puts the community at risk.
I 95% agree with that. And now we’re talking about Discourse, imagine we would be in the Wordpress world!
(The lacking 5%: I don’t think it’s the “wild west” - security issues are being reported through meta to those third party developers and in general they’re being fixed pretty quickly).
But at the same time my experience is that LLMs (_nowadays_) generate more secure code than the average human plugin author. And you can throw a plugin at any decent LLM and ask it “find and fix any security issues” and it will do it, even if the human does not have much security knowledge.
I’ve been manually reviewing plugins for the last decade and I’ve seen a lot: SQL injections (by people who thought ActiveRecord was too fancy), API key settings having `client: true`, complete lack of authorisation and access controls, lack of rate limiting. They’re all found and fixed by LLMs in no time and without too much of an effort.
So again: I think LLMs made this _better_, not worse.
> [@darkpixlz](#):
>
> tagged properly so those who do not want to open that can of worms
You’re still associating LLM generated code with a “can of worms”, that’s too black and white.
---
### Author:  [@philh](https://meta.discourse.org/u/philh)
#### Post date: [21 september 2026 om 06:53 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/11 "2026-09-21T06:53:17Z")
> [@sam](#):
>
> So my vision here is the complete opposite :slight_smile: require versions of third party themes and plugins pass some sort of AI scan prior to being advertised here.
**Jack McDade** has taken that approach with the Statamic addon directory
> **[Stewarding the Marketplace](https://statamic.com/blog/stewarding-a-better-marketplace)**
I welcome the approach, found it useful for confirming what we already new needed to be done. It also helps build confidence in the code.
Seems something similar could be implemented here without too much of a stretcht by Team.
---
### Author:  [@Canapin](https://meta.discourse.org/u/Canapin)
#### Post date: [21 september 2026 om 15:52 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/12 "2026-09-21T15:52:04Z")
I’m also concerned by low quality plugins and components, and I don’t really trust them when they are 99% vibe coded by someone who doesn’t know about programming.
But I also believe experienced programmers here and there saying that bad programmers existed way before AI[[1]](#footnote-2041338-1). Sloppy and unreliable, flawed code has been hand-crafted from ages.
What concerns me is when I see a vibe-coded app/plugin/whatever and I _suspect_ the author didn’t review the code.
While I have some basic knowledge in programming, I have not coded for a long time, and was never good at it. I gave a try to vibe-code for a few projects.
Initlally very reluctant to publish them officially on meta, I finally did it after taking the time to review and understand what each piece of code was doing and also publicly state my approach in my topics. Not that I remember all I read before publishing those plugins, but at least, I could ensure the reliability and security at the time I published this work.
I have a good example to illustrate how vibe code could have made me ship a very unsafe plugin.
Before working on [🖼️ Topic Gallery](https://meta.discourse.org/t/topic-gallery/394953), I worked on, I made a proof of concept of a similar plugin here: [A way to monitor user-uploaded files 🖼️ - #2 by Canapin](https://meta.discourse.org/t/a-way-to-monitor-user-uploaded-files/358635/2)
It was working great, and the AI followed my directives.
There was a problem : Though the feature was clearly a moderation feature, the AI didn’t take into account permissions : any user, including visitors, were able to open this page and see all the files uploaded by all users. It was obvious for me that it should be admin only, but the AI didn’t “think” about that. And because I didn’t ask it, it made a public page by default.
So I keep telling myself that if myself and AI were able to oversee such a security leak, then non-coders vibe coding TCs and plugins might unfortunately do the same.
Opinion about AI code in software are strongly polarized. You just have to take a look at any popular open source project where Claude is cited as co-author of the last commits to see a torrent of hate from certain people.
I’m convinced that we should approach those things with caution and that our opinions should be more nuanced.
I’m not particularly in favor of having some sort of `vibe-coded` tag that could unnecessarily harm the popularity of well-coded and safe customizations and their author.
I know that since anyone can now produce customizations, there might be more and more coming each day, and not enough people to review them.
AI review is perhaps the solution. My gut don’t really like this idea for various reasons, but I believe that if Sam proposes this kind of solution, then it’s probably a good one, because I trust very much his skills and judgement. Especially since I myself don’t know jack shit. :laughing:
Perhaps some devs here that know about programming and Discourse ecosystem could have a title that explicitely shows they expertise in this field, so they could be seen as trustable devs even by visitors who are just looking for customizations here without registering. It would be the opposite of what you ask for, darkpxlz. Instead of “shaming” potentially unstrustable customizations, we’d emphasize trustable ones. :slight_smile:
Just food for though, tho. :person_shrugging:
* * *
1. I should know, I was one of them! [↩︎](#footnote-ref-2041338-1)
---
### Author:  [@darkpixlz](https://meta.discourse.org/u/darkpixlz)
#### Post date: [21 september 2026 om 16:25 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/13 "2026-09-21T16:25:21Z")
> [@Canapin](#):
>
> Opinion about AI code in software are strongly polarized. You just have to take a look at any popular open source project where Claude is cited as co-author of the last commits to see a torrent of hate from certain people.
It’s entirely possible that I’m stuck in an anti-AI echo chamber of the media I consume and the people that I interact with daily. I was almost certain this request would not be as unpopular as it has been but if everybody here actually loves coding with LLMs and doesn’t want a tag purely for transparency then who am I to stop that? Detecting the LLM code is fairly easy still so if anybody (like myself) really wants to avoid it they can just check the contributors for a LLM tagging itself like I suggested previously.
---
### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [21 september 2026 om 17:51 UTC](https://meta.discourse.org/t/require-llm-generated-themes-plugins-to-be-tagged-as-such/412871/14 "2026-09-21T17:51:01Z")
> [@darkpixlz](#):
>
> doesn’t want a tag purely for transparency then who am I to stop that?
Given it’s a controversial subject I personally back your original request which would serve the part of the community that is, at present, more on the sceptical side (fair enough)
However I suspect that we would end up labelling almost everything, which kind of defeats the point?
I would also agree with others that not all AI generated code is equal - some of it is written by more recent, more expensive models, guided by experienced developers, whereas in other cases it might be a one-shot from a less experienced person using a less capable model and the repo might not be utilising best practice - and you can only judge that by examining the repo itself and also observing if people are having frequent issues.