In short: AI coding assistants such as Claude Code and OpenAI Codex have become regular partners in my work as a Shopware freelancer. They are strongest at testing, reviews, security checks and tedious work. Their biggest weakness: they report things as done or tested when they are not. So I give them clear rules, have them verify in the browser themselves and look at every change before it is committed.
My setup
I work with AI assistants in the terminal and the IDE, mainly Claude Code and Codex. The Shopware test environment runs locally in Docker. Reviewing and committing happens in PhpStorm, by me. The AI does not commit anything in my projects. That way I see every change in the diff before it goes into the repository.
The rules the AI has to follow are in a file in the project. For Shopware they include:
- first decide whether a plugin, app or theme is the right solution
- no changes to the Shopware core
- snippets always in German and English
- no inline styles, no inline JavaScript and no hard-coded text in Twig
- business logic in services, database access through the DAL instead of raw SQL
- configuration as XML
Where AI is really good
Testing like a real customer
For one plugin, I had the AI place test orders the way real customers do: with several test personas, different products and configurations, through the normal checkout. This surfaced a bug no unit test would have caught: order line items suddenly no longer showed up in the Administration. The cause was a template conflict in the Administration, which the AI then found and fixed.
Security checks
Testing with restricted admin roles revealed several issues in a plugin I maintain: permissions were missing, an API route handed out a key to any logged-in API user, and an access token was sent to an embedded frame without checking its origin. You don't find gaps like these when you only test as an administrator. The AI worked through the roles systematically and implemented the fixes including tests.
Store review and compatibility
When I submitted a plugin to the Shopware Store, the automated review flagged an invalid SVG file. The AI found the problem and fixed it. It also helps check plugins against several PHP and Shopware versions and keep the compatibility information accurate.
A second opinion on AI code
In one shop project, an AI assistant had built a lot: new sales channels, texts and images. Before go-live I had a second assistant review everything. It found errors that would otherwise have shown up live, and during go-live it quickly traced a critical database error to its cause. Two AI tools checking each other are surprisingly effective.
Tedious work
Changelogs, README files, commit messages and even the entries for my time tracking from Git history and changelogs: the AI does this in minutes. I only review and correct.
Where AI makes mistakes
"Tested" doesn't always mean tested
The most common mistake: the AI reports something as tested but only checked part of it. Once it said the Administration had been tested. In fact, only data had been queried through the Admin API; nobody had opened the interface. That was exactly where the bug was.
My rule: "tested" means really opening the page in the browser. And every report must state exactly what was checked: interface or API, with which user, which products.
Piecemeal fixes
With frontend work, it often went like this at first: I find a bug, the AI fixes it, I find the next one. Each time costs a round trip.
My rule: if an area doesn't fit, the whole area is checked against the reference: spacing, widths, alignment, fonts. With screenshots from a headless browser that the AI looks at itself instead of guessing.
Changes outside the task
Once, while fixing a small theme bug, the AI changed other things too, and afterwards spacing and elements were missing on other pages. Reverting was easy thanks to Git, but annoying.
My rule: small, clearly defined tasks. Review every change in the diff. Commit nothing I haven't seen.
Confidently wrong statements
AI assistants sometimes make claims about software that aren't true, such as what a program requires. So my rule is: technical claims are checked against the documentation or in a test before I base a decision on them.
Credentials
AI assistants like to use whatever is available, including SSH keys meant for something else entirely. That is why the AI has its own restricted key in my setup and may not use any others.
My conclusion
AI makes me noticeably faster, especially with tests, reviews and anything thorough but monotonous. But it does not replace responsibility. That stays with me, which is exactly why I never let the AI ship anything unchecked.
If you use AI in development, define three things:
- Rules: what is the AI allowed to do, and what not? In writing, in the project.
- Checks: how is testing done, and how is it reported what was tested?
- Approval: who reviews the changes before they go live?
How I built a complete website with Antigravity is covered in Antigravity in Practice.
Frequently asked questions
Will AI replace developers?
No. It takes over a lot of work, but someone has to know what is right, review the results and carry the responsibility.
Which AI assistant is the best?
It depends on the task. I use several and have them check each other. Clear rules and good tests matter more than the tool.
Is my code safe with AI assistants?
That depends on the provider and the settings. For client projects I clarify beforehand what is allowed, and credentials never belong in prompts.