So much AI, so many add-ons... and so many bugs

[Forsaken]

You mean less? If I'd question a hefty add on if it were $10-20 over their pricing, unless the demand is particularly high, i.e. it's one of the top 10 suggestions not yet implemented.

Of the add-ons I know are likely vibe coded, they are charging around the same prices as Xon does for most of his add-ons. Bob and DragonByte and there are a few priced similarly to those as well.

There are also competing add-ons that are undercutting on price, which in most cases does not matter, but when it may skew new users to using something of lower and potentially detrimental quality that becomes a bigger issue.

 

[Max Fridman]

@Forsaken was very generous with the “likely (the UX is clearly coded using GPT/Claude/Gemini). However, knowing how things work around here from a developer’s perspective, even if someone actually suffers real harm, no action will be taken.

Now, I don’t want to be a naysayer, or someone who attacks or stirs up unnecessary controversy. But when it came to a developer who was clearly scamming and harming people using this forum, the response was insufficient, delayed, and unprofessional. And no rules were established to prevent similar situations from happening in the future.

Honestly, I expected better. Now, it doesn’t take a genius to see what’s going on. Sure, it’s easy to sit here banging my fists on the table and “demand” that action be taken. From my perspective, since I’ll never buy these vibe-coded add-ons, it’s just a matter of curiosity to see (if and when) action will be taken. Because I think some basic measures will need to be taken in this regard. And I hope they do so before someone gets seriously hurt due to inexperience.

It’ll be fun when someone sees the entire forum compromised. User data exfiltrated. Maybe via privilege escalation. All for 15/20/30 dollars worth of add-ons purchased on Xenforo.com.

It’s less fun to watch the price war, given that entire add-ons (even very complex ones) are being churned out in a matter of hours. More serious developers might seriously consider abandoning this market. After all, no distinction is made between those who meet the standards, possess professionalism, technical skills, and so on. As if we needed any more excuses to stop supporting Xenforo.

Here’s what I can tell those with less experience:

• Realistically, you don’t need many add-ons to make your site useful.
• Rely on sellers with a proven track record and years of experience (Xon, Siropu, Painbaker, Bob, Dragonbyte, Wutime, Stuart Wright).
• These sellers already have 99% of what you need on the market to make your forum unique, useful, etc.
• Are there any good new developers? Yes. (Matt. C for example) Evaluate them over time.
• Don't install too many add-ons. They'll prevent you from updating your site in the future.
• Invest in developing custom add-ons for niche features that no one else will ever integrate. It costs money, but it will pay off by making your site unique.
• Take the time to learn a little about how Xenforo add-ons work so you can tell the difference between a well-made one and a shoddy one.

In any case, if you have any questions, start a thread and ask, someone with more experience will be able to give you advice. After all, that’s what forums (including this one) are for.

 

[Mr Lucky]

After all, no distinction is made between those who meet the standards, possess professionalism, technical skills, and so on. As if we needed any more excuses to stop supporting Xenforo.

This is something that really worries me. I have no idea how to tell if an addon is well coded or not. So I will not even try out any addons from a developer I do not already know and trust to write the addon professionally. This is not going to be a problem because I have a policy of not installing any more addons anyway. Unless (again) this new wave of ai coded addons by apparently less professional or sklilful develops does end up successfully undercutting and threatening the real devs.

 

[mjda]

Maybe it was a good idea for IPS to discontinue their add-on marketplace after all. Maybe XF should consider doing the same. It's a moderation nightmare and I feel like it's only going to get worse as more and more people start strictly using AI to code add-ons for them with no actual skill to test the code or diagnose/fix potential issues.

Of course the hope would be that XF could figure out an in-between solution. Something that didn't allow anyone and everyone to post add-ons but also something that doesn't discourage new developers, who actually know what they're doing, from getting involved. I'm just not sure what that solution would be without creating a lot of new work for someone.

It's easy for us all to say something needs to be done, or "demand" something be done, but I doubt XF would argue that point. The problem, at least in my opinion, is knowing what can be done that isn't a logistical nightmare for the company.

 

[Mr Lucky]

Of course the hope would be that XF could figure out an in-between solution.

Part of the solution may already be in place, ie user reviews. I do give reviews but I tend to wait quite a while so that I can evaluate either whether there has been a significant trouble free period, or in the case of issues, whether those were dealt with in a timely manner and with good communication.

I would encourage people to write well thought out honest and objective resource reviews. But I would still very much welcome some kind of vetting and developer certification process. I'd pay a bit more per addon and for the licence for that kind of protection from scammers and unskilled chancers.

 

[PhineasD]

@SenseiXS is one example. After being registered for 9 years, they spit out 11 AI coded addons (64% paid) in in 15 days, with the front-to-back AI (website, support replies, etc).

And it just so happens that a user who registered in 2026 has given 5-star reviews to several of their add-ons...

Either we start figuring out how to filter professional developers' add-ons from the 100% AI or...

 

[Slavik]

what can be done that isn't a logistical nightmare for the company.

This is the crux of it.

I gave claude code 2 addons, one that was vibe coded under my strict supervision and one which was hand coded.

Unfortunately it was unable to differentiate between them, which is kind of the point, an AI assisted addon under supervision of a developer who knows what they are doing can still be as quality as one done entirely by hand.

If anyone has some solutions, all ears.

 

[ENF]

Realistically, you don’t need many add-ons to make your site useful.

I'm quoting this specific line, but I'd like to quote much more but I'm afraid of opening the proverbial Pandora's Box.

A number of those recent addons are gimmicks that add gamification or trying replicate things that are already out there that work just fine. The comment above is right but that's a hard sell to people who trying to add features or functions to keep members coming back. We already use some of the professionally made addons from what I'd call Senior Developers on XenForo, but anything else that we need is either made in-house or we hire someone with a trusted background to help us out. (because it's usually specific to our use case and not really relevant to other sites)

We already know that a good majority of people just slap upgrades on or drop in addons without question because they got it from Xenforo.com. I'm fairly sure that the bigger production sites that have a lot more to lose would (hopefully) do a better job at evaluating addons before allowing them anywhere near their data.

If anyone has some solutions, all ears.

The only immediate solution (for now) I can see is that XF should have some sort of disclaimer when downloading 3rd party addons FROM Xenforo.com that these addons should not be trusted at face-value and should be properly tested before use on someone's site. That's not a direct solution but it can serve as a warning and ensure that any liability is put back on the addon owner OR the person who downloads and installs it to their site.

For those of us who've been around longer than we'd care to admit, I'd hope that we know better than to trust something blindly from someone we don't know.

 

[ES Dev Team]

Over the last few months, the number of users uploading add-ons to the resources section has spiked.

I’ve tested a few of them and found nothing but errors and glitches. In fact, it’s easy to tell they're relying on AI to develop the add-on because they usually roll out multiple updates just to fix a single bug, and when they finally do, a brand new bug pops up out of nowhere, the addon can't be uninstalled or rebuilt, and features that were previously implemented just disappear... Anyway, they're just shooting in the dark, and it’s obvious they aren't profeesional developers.

Honestly, this makes me feel pretty insecure, and I look suspiciously at users who don’t have a history on the forum showing they are actual developers. Not to mention other cases where add-ons suddenly popped up like mushrooms overnight, only to be deleted the following weeks without even leaving the option to download them as "unmaintained."

I’d love to hear your thoughts on this.

My company does a little bit of AI coding, prototyping, and research.. but generally ~90% of code is still 'manual plow'.

Developers don't like reading code they didn't write. It's hard. Many of them will just rewrite anything foreign!
People with vibecoding tools especially don't like reading the code. Vibecoding tools are usually designed against reading the code, too.

So yeah, if you use software that's clearly created with this process, then you are a beta tester because the programmer responsible for it hasn't really tested it or thought out all the edge cases since they were removed from the process.

A good hint that you're about to use vibe coded software is that the description of it looks AI generated.

The 'benefit of the doubt' chances i've given to clearly vibe coded software were all wasted. So i won't even try this crap anymore.

At our shop, vibe coding is banned for anything other than decorative/prototype/snippet applications because it consistently produces poor results compared to expert work. it is very bad at architecture. Once you spend time writing tests and guardrails and things to help counter the danger, you are not actually gaining speed.

It is possible to do human in the loop processes with AI ( it's a sidekick ) and produce human-equivalent code. The programmer actually sees the code during the process, and that makes a huge difference. But that requires more effort..

 

[frm]

The only immediate solution (for now) I can see is that XF should have some sort of disclaimer when downloading 3rd party addons FROM Xenforo.com that these addons should not be trusted at face-value and should be properly tested before use on someone's site.

I think this is sufficient warning:

The entirety of the risk as to the results, quality and performance of the Software is with You.

(From the license agreement)

Perhaps there should just be a notice (or similar) on Resources that makes this more prominent or clear that anything downloaded and installed is at your own risk. An argument could be made there, but it's already in the license agreement that you agreed to in order to download resources to begin with (I believe you need a connected account to download any, but I could be wrong).

 

[ENF]

Perhaps there should just be a notice (or similar) on Resources that makes this more prominent or clear that anything downloaded and installed is at your own risk. An argument could be made there, but it's already in the license agreement that you agreed to in order to download resources to begin with (I believe you need a connected account to download any, but I could be wrong).

I should have clarified that I meant that there should be a pop-up (with a strong warning language) that has an additional warning with an accept button/checkbox. Hopefully, that would prompt people to be more careful? But, I guess the same thing will happen like it does for us, nobody reads the warnings or can follow instructions.

 

[haqzore]

And it just so happens that a user who registered in 2026 has given 5-star reviews to several of their add-ons...

Many of the "support threads" are a literal AI circle-je__.

"Thanks so much for the great suggestion!" "What a great update!" "Thanks so much for the feature!"

 

[Max Fridman]

This is the crux of it.

I gave claude code 2 addons, one that was vibe coded under my strict supervision and one which was hand coded.

Unfortunately it was unable to differentiate between them, which is kind of the point, an AI assisted addon under supervision of a developer who knows what they are doing can still be as quality as one done entirely by hand.

If anyone has some solutions, all ears.

I think it’s impossible to review every single add-on, even if we automate most of the process.

What comes to mind is creating a “verified” program: the developer pays for the verification, a sample of add-ons is selected, their quality is tested, and Xenforo certifies them.

• Xenforo is paid for the time/man-hours spent on verification.
• Verified developers would have their own section in the Resource Manager.
• Users would have a directory of verified add-ons to choose from.
• “Paying for verification” is ultimately a cost but also a benefit in terms of free advertising; it could be a one-time fee or a recurring fee.

Nothing else comes to mind. Ultimately, that’s what the App Store and Play Store do, though they also verify updates. Here, the add-on is evaluated “as-is” at the time of its initial verification.

There are many challenges involved in managing a store. I think, however, that the idea of saying “enough is enough” and abandoning developers (and therefore customers) as other CMS platforms have done is wrong.

 

[mjda]

This is the crux of it.

I gave claude code 2 addons, one that was vibe coded under my strict supervision and one which was hand coded.

Unfortunately it was unable to differentiate between them, which is kind of the point, an AI assisted addon under supervision of a developer who knows what they are doing can still be as quality as one done entirely by hand.

If anyone has some solutions, all ears.

Yeah, I'm in 100% agreement with this. I use AI myself to help diagnose my own code, or even help me code my add-ons. Sometimes AI just knows of a much more efficient way to write a function than how I would've done it. That said, I'm no great developer by any stretch and even I'm not going to just let it run wild and copy/paste everything it shoots out into my site and let it roll. I've seen AI make a lot of mistakes that would have caused issues with my site. Also worth noting that if any damage is done by the code I'm getting from AI, it will only affect my own sites. AI definitely has its place, and an argument could be made that even real developers should be using it to help streamline their development in at least some capacity.

The problem, though, as I said before are the people who are "strictly using AI to code add-ons for them with no actual skill to test the code or diagnose/fix potential issues". Then those people are distributing, and in some cases trying to sell, those add-ons to other people who also don't have the skills or knowledge to know what they're getting is sub-par, at best, and potentially damaging.

But how do you determine who those people are without keeping an eye on all of their add-ons? Who wants to review every add-on that's released on this site? I assume XF doesn't have the resources to do something like that and, even if they did, it's probably not worth it.

There was an add-on released this morning, updated twice within an hour of releasing it, then deleted shortly after. It was obviously not very well tested before being released, and then again not very well tested before being updated the first time. Maybe AI wasn't the issue with that specific add-on (I really have no idea), but I suspect that's the kind of thing we could start seeing a lot more of with all these "vibe coders" who don't really have any developmental skills at all but want to play like they do.

How can that be stopped without discouraging people who actually take the time to know what they're doing from contributing to the community? I have no idea, and nothing I've seen so far in this thread is something that will actually fix the issue either IMO.

 

[Mr Lucky]

If anyone has some solutions, all ears.

Here is something for all of your ears:

What comes to mind is creating a “verified” program: the developer pays for the verification, a sample of add-ons is selected, their quality is tested, and Xenforo certifies them.

 

[mjda]

What comes to mind is creating a “verified” program: the developer pays for the verification, a sample of add-ons is selected, their quality is tested, and Xenforo certifies them.

Great idea, but does XF have the resources to do this? I doubt anyone wants to do this for free, and I also doubt the current staff wants, or needs, any extra duties above what they already have. Even if they do have the extra resources, is it worth it to use them here? What do they have to gain from it, verses what they have to lose by keeping the status quo?

Please don't misunderstand me. I know something needs to be done too. If the problem were so easy to solve, though, I'm certain XF would have already done something.

 

[Mr Lucky]

What do they have to gain from it, verses what they have to lose by keeping the status quo?

What they have to lose is trusted and respected devs deciding they don’t want to put up with being undercut by unskilled addon vibecoders.

Sure you can run a forum with no addons, but I imagine most xenForo customers may start looking elsewhere if they lost those trusted devs.

 

[Forsaken]

This is the crux of it.

I gave claude code 2 addons, one that was vibe coded under my strict supervision and one which was hand coded.

Unfortunately it was unable to differentiate between them, which is kind of the point, an AI assisted addon under supervision of a developer who knows what they are doing can still be as quality as one done entirely by hand.

If anyone has some solutions, all ears.

Mandatory self disclosure, with action taken on people who are found to be lying; literally the lowest hanging fruit and something that could be done within a small time frame.

Implementing a verification for offering services, which would also cut down on people scamming or offering poor quality work. It does not need to be to the extent that they need to have business license or have insurance, but just vetting the resource provider. This does potentially introduce a caste system for resource providers by making some verified and some not, however anyone who is wanting to earn income or do business on XenForo is going to want to be verified more than likely.

Introduce a resource provider section for verified developers so that their suggestions and reports are separate from the current sections; it is frustrating to have technical suggestion that will never get community support get declined due to "lack of interest" when it is specific to bettering the software or ecosystem.

Introduce community-led code reviews; this I do not know how likely it will happen at this point as most of the people I know who were once willing are either no longer here, or no longer care. The people with the most vested interest in the success of XF outside of XF staff are the resource providers, and they are often the ones who want to ensure that the products being released are of good quality. Accept volunteers for reviewing resources from developers in the community (preferably verified ones if that is implemented).

Try to mend fences with some of the alienated developers who once were heavily invested in the XenForo ecosystem, but have left either due to arguments or disillusionment. Many of the developers who have left were the ones who were willing to help just for the love of the community, and not purely for profit.

most of these were brought up over 10 years ago now, and they're fairly easy to implement.

 

[mjda]

What they have to lose is trusted and respected devs deciding they don’t want to put up with being undercut by unskilled addon vibecoders.

Sure you can run a forum with no addons, but I imagine most xenForo customers may start looking elsewhere if they lost those trusted devs.

I'm not disagreeing with you, and I'd love to hear input from any devs who are among those who plan to leave if nothing is done, but as it stands now I haven't seen any devs talking about leaving because they're being undercut. I think the community here does a pretty good job of letting folks know, at least those who ask, who the devs are here that they should use and can trust.

Also, what you're saying assumes that most XF customers use add-ons by the devs that would leave, and that they would leave XF if those devs left, and that there's another software provider they can switch to that would be better. How many customers did XF lose with all the devs that quit over the years because they got their feelings hurt? My guess is not enough to make a difference. Obviously, I could be completely off-base there but that would be my guess.

Again, I'm not disagreeing with the standard premise that something should be done, and a verification system sounds like a good plan on the surface, but I'm not sure having the trusted devs pay for that verification is a great option. Sounds, to me, like another possible roadblock to getting new developers, who truly have something to offer, involved.

I like the idea of a community based volunteer committee that can "reject" certain developers if they consistently post garbage add-ons, or just certain add-ons if it clearly contains some poorly written code. I guess the only issue I see here is being able to find the volunteers who have the time, knowledge, and can remain unbiased enough to do it. How long before those volunteers get burnt out?

 

[Forsaken]

I'm not disagreeing with you, and I'd love to hear input from any devs who are among those who plan to leave if nothing is done, but as it stands now I haven't seen any devs talking about leaving because they're being undercut. I think the community here does a pretty good job of letting folks know, at least those who ask, who the devs are here that they should use and can trust.

Also, what you're saying assumes that most XF customers use add-ons by the devs that would leave, and that they would leave XF if those devs left, and that there's another software provider they can switch to that would be better. How many customers did XF lose with all the devs that quit over the years because they got their feelings hurt? My guess is not enough to make a difference. Obviously, I could be completely off-base there but that would be my guess.

Again, I'm not disagreeing with the standard premise that something should be done, and a verification system sounds like a good plan on the surface, but I'm not sure having the trusted devs pay for that verification is a great option. Sounds, to me, like another possible roadblock to getting new developers, who truly have something to offer, involved.

I like the idea of a community based volunteer committee that can "reject" certain developers if they consistently post garbage add-ons, or just certain add-ons if it clearly contains some poorly written code. I guess the only issue I see here is being able to find the volunteers who have the time, knowledge, and can remain unbiased enough to do it. How long before those volunteers get burnt out?

Resource providers have left over inaction on scammers or low quality developers who were actively misleading customers, inaction on critical bugs that were not fixed, and lack of communication.

As it is, there really are not that many high quality developers left, and it is mostly those that have invested quite a bit of time and effort into establishing themselves here. What it will do though is prevent new developers (or old developers) from wanting to come back to the community, and if and when long-term issues with vibe coded add-ons come apparent it will likely lead to backlash from the community itself.

The biggest issue with vibe coding is that AI wrote it, it is that the people vibe coding do not understand what is being coded, nor do they know how to maintain their add-ons long term. AI assisted development is mainly dependent on documentation and clear communication which is not something many people are good at doing, especially when AI models are constantly changing and revisions can lead to code and documentation drift.