← Back to the main Geek Mode article
What was tested: handing Gemini 3.8 Flash a small (nine-file) WordPress plugin ZIP and asking for a code review, then supplying the same source as plain text. Outcome: Gemini could identify files in the archive but could not reliably read the actual compressed source; once given plain text, it performed a substantive, implementation-specific audit — with some confident factual mistakes.
Attempt 1: the ZIP file directly
Gemini could apparently inspect enough of the ZIP structure to identify filenames and infer the plugin’s architecture, but said the contents were compressed binary data it couldn’t review line by line. It then produced a list of potential WordPress security and architecture problems anyway. Some were sensible things to check, but most of the response read like advice inferred from filenames and common WordPress failure modes rather than findings from the actual implementation — for example, spotting a file named something like class-apmi-gemini-client.php and describing what often goes wrong in a Gemini API client, which is not the same as auditing the real one.
Attempt 2: the same source as plain text
Once the actual source was supplied in a plain-text format, the experience changed completely. Gemini clearly read the code and produced a detailed, implementation-specific audit, referencing real functions, variables and code paths, and it found several legitimate things worth examining.
It also confidently got some things wrong. One “critical” finding claimed Google’s Gemini Interactions API endpoint used by the plugin didn’t exist and should be replaced by the older generateContent contract — incorrect; the current Google API does support the Interactions endpoint and the request/response structures the plugin was using. It also claimed WordPress automatically EXIF-rotates an image simply by constructing the image editor, leading it to diagnose a double-rotation bug that wasn’t actually there.
Still, once Gemini could read the source properly, it was doing real code review. The coding ability was there — the retail file-ingestion workflow got between the request and that ability. The practical workaround: let another AI unpack the codebase into one or more clearly labeled plain-text files, then hand those to Gemini. That works, and it’s exactly the sort of workflow tax that doesn’t show up in a feature matrix — “Supports file uploads” gets a checkmark either way.
The plugin’s source code itself is not published here — it received a separate security/privacy review before any part of it could be made public.
← Previous: iterative UI editing · Back to the main Geek Mode article · Next: plugin audit and repair →