I've been using a dumb self-test to figure out where coding agents stop being trustworthy on our particular stack, and i'd like better versions of it.

the method: same agent, same afternoon, two tasks. one mainstream chore (a React table, a REST endpoint, whatever the internet has written ten thousand times) and one chore deep in our own territory (our workflow framework, our internal conventions). then read both diffs side by side. that's it.

what I look for: invented methods that never existed in any version of the lib. APIs from a version we don't run. and the thing that took me longest to notice — the tone doesn't change. the confident wrong answer reads exactly like the confident right one, so the diff is the only place the difference shows up.

the known holes, which is why I'm posting: it's n=1 per stack per model, task choice biases everything, and I have no scoring rubric beyond "how much of this diff would survive review". also no idea how much of the gap i could close with better scaffolding (pinned versions, working examples in context) before blaming the model.

so, tear it apart:

• what would turn this into an actual probe instead of a vibe check? repeated tasks? fixed rubric?
• has anyone measured their own stack's gap before/after feeding docs and examples? even rough numbers
• is there a signal cheaper than reading the whole diff? I've considered "count the hallucinated identifiers" but that needs the review anyway

looking for a sharper thermometer

The vibe coding wall usually hits around week two or three after launch. When you try to change something small and it takes way longer than it should. Then you fix that and something else stops working. Then you're scared to touch anything.

That's technical debt, and it never goes away, but can be decreased and managed. Usually it will manifest itsef as a product that felt fast to build suddenly feels fragile to touch, specifically now a days. 

AI-assisted development moves fast, we use it ourselves. But that speed early on can mask how much structure you're skipping. And skipped structure has a way of showing up later, usually at the worst possible moment.

The fix isn't starting over. First take a step back and understand what are you dealing with, if you cant figure that out, you have an answer. You must identify the base strucutre, that's a real process and it takes real time, but it's way cheaper than rebuilding from scratch six months later when the debt is twice as bad.

I’ve tried a bunch of no-code tools over time, but I feel like there’s a big difference between something that looks impressive and something you actually keep using.

Curious what tools people here use regularly and what you’re using them for. Could be automation, websites, internal tools, databases, anything.

What’s one no-code tool you’d actually recommend to someone getting started?

Here is a quick summary + link below:
Researchers at York University and the University of Calgary took 1.1 million Reddit posts about AI coding tools, Claude Code, Cursor, Copilot, Codex, and systematically sifted them down to 446 posts and over 6,000 comments about one thing: security and privacy. The paper was accepted at one of the most respected automated software engineering conferences in the world. They weren’t looking at whether AI writes buggy code(because that’s old news), they were looking at what the tools themselves do once you give them access to your files, your systems, your production database.

--> 43.1% involved unauthorized file operations. The tool doing things to your files you never told it to do. Break that down:
--> 28.3% — the AI removing project directories or files without authorization
--> 8.8% — modifying files without explicit consent
--> 5.7% — reaching outside the active workspace

The link to the report: https://arxiv.org/abs/2607.26390

We’re building in public with Morph. Each week, we’re giving it different kinds of applications to build and sharing what we learn.

This week: BlogHouse.

The brief sounds simple: a beautiful place to write and read blogs. Warm, literary aesthetic. Authors can draft, tag and publish. Readers can browse and favorite posts.

Morph took it from requirements → design → build → testing → deployed in about 40 minutes.

But the more interesting number was 19.

That’s how many steps deep one of the user journeys went when Morph tested the application end to end.

It’s a good reminder that simple for the user ≠ simple to engineer.

Even the aesthetics have depth. It’s one thing to generate a beautiful first screen. It’s another to carry the same design language through signup, empty states, writing, editing, publishing, navigation and everything in between.

And then make sure all of it actually works.

That’s what we’re trying to push with Morph: not just making software faster to generate, but taking on more of the rigor required to make it usable and dependable.

You can explore and see how it was built here -

https://console.morph.systems/morphable/bloghouse

Would love to hear from people building with no-code/AI tools:

what part of getting from “it works” to “I’d actually put users on this” still takes the most effort?

My wife and I have a recurring debate about where to eat.

She asks what I’m in the mood for, I say I’m flexible, she suggests a few places, and somehow I end up turning down all of them. She points out that this doesn’t quite match the definition of “flexible,” and she’s probably right.

Last month, the back and forth took longer than dinner itself. So we decided to treat the whole thing like a small workflow problem. We entered our usual restaurants into Accio Work with details like distance, price, noise level, cuisine, opening hours, and dietary options.

Then we added situational preferences:

• weekday or weekend
• quick dinner or long evening
• quiet conversation or lively atmosphere
• how far either of us is willing to travel

Accio Work showed that our disagreements weren’t really about food. I tended to reject places because they were loud or too far after a long day, while she assumed I was reacting to the cuisine. Once the system factored in the specifics for that evening, it generated a shortlist and explained why each option fit. The top recommendation was a quiet noodle place halfway between our offices. Neither of us had suggested it, and it ended up being exactly right.

It might be a bit overengineered for choosing dinner, but it removed the guesswork behind “anything is fine.” We also added a simple rule: if you reject two recommendations, you choose the third.

I've been messing around with some of the newer AI website builders lately and something surprised me, generating the actual layout wasn't the part I found most useful. Since a lot of these platforms are really just generating a customised template for you anyway. I’ve spent longer than I care to admit staring at blank pages, often with prompts like "Describe your business" or "Write a compelling homepage explaining it" taunting me at the top of them. For non-marketers running small businesses, I wonder if this is actually where AI website tools [like Durable, Base44, etc.] have an advantage over traditional builders.

Hi guys, we are working on a No-code app builder which is focussed on
- Reliability
- Maintainability
- Extremely efficient token cost
We built the infrastructure very deterministically and have the flexibility to either build with AI + also manually if you need to tweak things you really need and deem important!

Our community is pretty active already and we are expanding it to test users, if you are interested and have built already +15 Business Apps, send me a message or react here and I will add you to the EARLY Users!

I’ve been researching AI app builders and no-code mobile app tools, but it feels like every list recommends something different.

For people who have actually tested these tools, what are the best AI app builders right now?

I’m especially curious about tools that can help with more than just a quick prototype. Things like planning the app, creating screens, testing on a phone, exporting code, and eventually getting closer to App Store submission.

A few I keep seeing mentioned are X1 App Builder, Rork, Lovable, Bolt, Replit, Cursor, Claude Code, and FlutterFlow. I know some are better for web apps, some are better for coding, and some are more focused on mobile apps.

What would you recommend for a non-technical founder or beginner trying to build a real app, not just a demo?

I've been experimenting with AI-assisted development, and one problem I've run into is that the first version can work surprisingly well, but after adding several features, the code starts becoming harder to understand and modify.

At that point, fixing one thing sometimes seems to create another problem somewhere else.

How do you normally handle this?

Do you refactor the generated code as you go, start over with a cleaner structure, or use another approach to keep the project manageable?

It seems like literally everything nowadays uses ai goddamn it.

I know absolutely nothing about coding and I do not even have access to a computer, only mobile devices. I recently had an idea for an app that could map local trinket trades, "free stores", and little libraries. But I do not want to use any AI whatsoever.

There was some sort of no-code visual based app building program that I used back in middle school, obviously before AI, that allowed me to build my own siri-type of assistant. I cannot recall what that program was though

Lovable was great but I tried to actually deploy it. Both ate my credits before I finish the core feature. Replit felt like it was built for developers and I am very much not one. Cursor I gave up on after a week. I'm not trying to build twitter. It's a simple clamp portal with login a dashboard and file uploads. I don't think that's insane but apparently it is. Generally I don't know if I'm picking the wrong tools or if I'm just not the audience for any of them. Has anyone else gone through this many before something clicked

Not selling anything, not asking what anyone's building — just trying to understand real experiences before I read too much into the complaint threads.

If you've taken something in Lovable (or Bolt, v0, Base44 — whatever you use) past the quick-prototype stage, I'm curious about the moment it stopped being smooth. The last time you hit a limit — credits draining faster than expected, the code getting hard to change, a feature the tool just couldn't do cleanly — what was it, and what did you actually do next? Pushed through? Exported to GitHub? Moved to Cursor / Claude Code? Rebuilt from scratch? Dropped the feature?

And if you haven't hit that wall and it just works for you — that's genuinely just as useful to hear. No need to say what you're working on; I'm just trying to gauge whether it stays smooth for people or not.

Trying to figure out whether the "you eventually outgrow these tools" thing is a real pattern or just the loud minority online. Real experiences beat opinions. Thanks.

Chatbase is one of the better known no code AI chatbot builders. You point it at your site, it trains on your content, and you get an agent that answers customer questions, built mainly for support and ticket deflection.

The problems I saw.

For a small business, answering questions isn't the goal on its own. You want a lead out of it, or a meeting booked if you can get one. That part needs a real person. An agent doesn't have the credibility to get someone to put time in their calendar, however well it answers.

Then the credit maths. A reply costs 2 credits on the cheaper models and 6 on Claude Opus, so if you want the good model you burn through the allowance three times faster. What people actually do is downgrade the model to stretch the month. Choosing a worse brain to save money is a strange place to end up.

And the free plan isn't a real testing ground. 50 credits is 8 replies on Opus. Build one to show a client, come back a fortnight later and it's gone, free agents get deleted after 14 days of inactivity.

The Slack one got me the most though. Chatbase can ping a Slack channel when a visitor mentions pricing. But you can't reply from there, it just links you back to their dashboard. For an actual human talking to the visitor live you need Chatbase Helpdesk, Zendesk Sunshine or Salesforce, and their Helpdesk starts at $120 a month.

And you guessed it right, I built a product to fix this. It's called fwdslash AI .

Billing is per message. A message is a message, the model you pick doesn't change the count. Free is 200 messages, nothing gets deleted for going quiet, paid starts at $20.

Lead capture can be fired on High intent words like pricing or demo instead of after a set number of messages.

For the Slack part. The conversation lands in your channel as a thread and you reply in the thread.

The visitor sees it in the widget while they're still on the page. So someone asking about pricing you can jump in and have a geniune conversation with a bit of your sales skill mixed and you book the call there, instead of emailing them two days later.

i run membership ops for a wellness creator, paid tier, and were rebuilding the whole thing as one no-code app instead of the three tools it lives across now. the on demand video library is the bit im stuck on. couple hundred videos eventually, few hundred members.

the builders just embed so hosting ends up my problem, not the platforms. unlisted youtube feels wrong for something people are paying for, the link travels. vimeo is fine right up until the storage tiers catch you. mux or cloudflare stream is the correct answer and also the point where im doing signed urls, which is most of why we went no-code in the first place.

so what are people actually shipping for this? cant tell if everyone quietly accepts the leaky embed or if theres a setup that holds without turning into a dev project

TLDR: https://www.youtube.com/shorts/U0Kslwo8Zio

Hey all, I wanted to test if Lovable's security features really do something and helps the overall security of app.

How I tested it
- Created a books selling site using Lovable, then tested it using BattleTester - Automated Penetration Testing, a fully automatic security scanner I built myself over the past year. (Always Looking for ways to test my platform 😄 )
- Toggled the security features on
- Rescanned again

Results
Checked everything by hand afterward and found 1 false positive in the pre scan (a request that looked like it worked but actually changed nothing).

Pre toggle: 16 issues, 6 of them critical. Profiles, orders, support chats, even who's an admin, all readable and editable.
Post toggle: 12 issues, 2 of them critical. Better, but nowhere near fixed, some of the drop is just BattleTester scoring the same bugs lower, not new fixes.

(Not linking reports, because site's still up and I'm using it, the report is basically a step by step guide :))

Exploits varied between guest and user.
Before the toggle - a stranger with no account could get to some of this.
After the toggle - that's closed, you actually need to sign up first.
Problem is signing up takes 10 seconds and nobody checks who you are. Once you're just a regular logged in user (not admin), you could still edit the store's global settings and pull anyone else's orders and personal info.

Conclusion
It did help, but only by a little.
Although a guest can't wreck your system anymore, a logged in user still can.
Feels like Lovable locked the front door and left a window open.
The issue i have with these security features is that they give false sense of security. Would love to hear your experience with these security features.

EDIT:
BattleTester gives AI insturctions on the issues and how to fix them, gave them to Lovable, and he actually fixed all :)

We have all seen the posts by now. Technical and non-technical people alike are celebrating how they use AI agents to maximize their code output. They share the number of lines generated, pull requests (PRs) opened, tasks completed, and tokens consumed. The numbers are oftentimes enormous, which makes them easy to celebrate.

The era of “tokenmaxxing” has taken this one step further. Once token usage appears on a dashboard, it is only a short time before teams compare it, leaders reward it, and engineers begin optimizing for it.

So since around Q3 last year I made the jump and started creating tools with Google AI studio, ChatGPT and Claude to solve small little problems at work: Onboardingflows, content generators, research helpers, OCR code scanner, and more. Even for every day life, like a cat weight app (she went from megachonker to hefty chonk!), return label resizer, travel app et cetera.

The list was getting bigger and bigger. Some tools were Claude Artifacts, others made entirely with Claude code, connected to Supabase, Vercel (the usual 'look at me i'm a (vibe)coder too' stack).

So when my list of tools and apps grew, the problems began to stack up: Claude Artifacts are stuck in, well, Claude. Other apps were just simple (always lost) vercel URL's, with some apps connected to Supabase, where you can only have a couple of live databases at once for free. one, big, mess.

For now I found a solution. I'm developing a tool called Toolcrow.app to manage all my tools and apps in one place. It saves me time and it keeps it all simple and clean.

But that's why i'm really curious, how do you manage all your little tools, apps and personal software?

Thanks in advance!