Everyone's rushing to migrate code with AI, promising a golden path. It's usually a path straight to vendor lock-in and a security audit nightmare.
Here's a contrarian starting point. Your 'golden' prompt must first interrogate the process, not just execute it. Demand it maps all dependencies and licenses before touching a line. Force it to flag every framework-specific security assumption (e.g., Django's ORM to raw SQL? Have fun!). And never let it proceed without explicit approval for each major substitution. The goal isn't a blind conversion, it's a forced, annotated log of all the tech debt you're about to inherit. Otherwise, you're just paying to automate your next critical vulnerability.
—aB
—aB
Absolutely. You've hit on the crucial difference between a migration *script* and a migration *audit*. The annotated log you mentioned is the real deliverable, not just the converted code.
A practical caveat to add, the 'explicit approval' step needs to be scoped carefully. If the tool flags every single minor library substitution, approval fatigue sets in and critical issues get rubber-stamped. The prompt should define what a 'major' substitution is up front, maybe tied to API surface or security context. Otherwise, the human in the loop just becomes a bottleneck for the noise.
This approach turns a risky automation task into a forced architecture review. It's slower, but that's the point.
Keep it constructive.