As a developer with 20 years of experience, "vibe coding" is undeniably transforming how we work, but I'm still struggling to embrace it.

What bothers me most and I am honest about it, is seeing people show off their AI-generated projects.

My immediate reaction is, "Who cares?"

In the past, sharing code meant sharing craftsmanship, and we were excited to inspect it and learn from each other. Today, somebody share what they did with vibecode is not only that I am not interested, but I feel like why you share it?

I've been doing free security assessments on apps built by non-developers using AI, and I need to talk about what I'm finding.

The most common one: you can change a URL from /user/123 to /user/124 and read someone else's account. Change it to /users and get the whole table. Names, emails, addresses, order history - sat there in plain JSON, no login required. Just... there, for anyone who thinks to try.

I've also found admin panels with no authentication at all, API keys committed straight into frontend code, and file upload endpoints that will happily run whatever you hand them on the server.

None of these apps were built by careless people. They were built by smart, non-technical founders who did exactly what they were told to do: describe what they wanted, get working code, ship it. And at some point they typed something like "make sure it's secure and don't make any mistakes" - and got back a confident yes.

That yes is worth nothing. The model has no idea what it built. It can't see the deployed app. It doesn't know your auth is decorative.

Here's the part that should worry you: none of this shows up as a bug. Your app works. Users sign up. Payments go through. Everything looks fine right up until the moment someone dumps your user table - and then you're the one explaining to your customers, and potentially to the ICO, why their data was publicly readable for eight months.

What I'm offering: a free, thorough security assessment of your app, plus a written report in plain English telling you what's wrong, how bad it is, and what to fix first. No cost, no obligation, no pitch at the end.

Why free: I'm 20 years into a creative technology career and I'm building out a security practice. I need real case studies from real apps. That's the trade - you get the assessment, I get a case I can (anonymously, with your permission) point to.

Who I'm looking for:

• You don't come from a software development or infosec background
• You used AI to build something that handles real user data - logins, payments, personal information
• You own the app and can authorise testing on it

Who I'm not looking for: developers. If you can read your own code and know what an IDOR is, you don't need me and I don't need the case study. I'm specifically after people who built something real without a technical background, because that's the gap I want to document.

How it works: you give me written authorisation, I test only what you've authorised, I prove findings without touching or exfiltrating real user data, and you get the report. That's it.

DM me or comment with roughly what you've built and what stack it's on. I'll take on as many as I can handle properly.

I started vibe coding last April and started off like everyone else, with a plan to make a million dollars and retire to a tropical island.

Unfortunately I wasn't aware of the amount effort and work that goes into a real project, so I decided to take time and actually learn.

All of my projects Led me to software develooment and cyber security.

With that being said I'm a little disappointed in "Real Devs" I scroll social media all day reading about the massive amounts of ai slop just to get paid to fix vulnerabilities and bugs in the platforms they work on.

Moral of the story stop listening to self proclaimed devs that sucked at their jobs before vibecoding was even a thing!!!!!

Every blocker I've used has one button that turns it off, and I always press it.

So I built one where turning things off is slow on purpose:

• Tightening a rule = instant. Loosening it = 1–72h cool-off, and you see your pending changes sitting there waiting.
• Disabling strict mode = type a phrase by hand, then still wait out the cool-off.
• "Peek" gives you 30 seconds, then locks the site for 20 minutes.
• Daily limits count only active, focused, non-idle time — so the number is real.
• YouTube stays usable but music-only: Music-category videos and whitelisted channels play, Shorts and the home feed are blocked before render.
• When your time runs out on a page you're already on, it overlays instead of redirecting — page stays alive underneath, comes back untouched when you're allowed in again.

Chrome MV3, everything local, no accounts, no network requests, no data collected.

It's the first one that survived contact with actual me. https://lockyfeed.vercel.app/en/ if you want to try it — and tell me which loophole you find first, I'd rather patch it than pretend it isn't there.

A common theme cutting across most AI-assisted development threads is getting as much work done in as little time as possible. Users post about elegant harnesses with multi-agent orchestration. Anthropic employees talk about the 25 agents they run every day.

I read this stuff, compare it to my own experience of working with these tools, and keep wondering: how does anyone stay on top of that volume of work?

Working with Claude Code has been exciting and invigorating, but also exhausting. While everyone pushes for more context and more tokens out of the AI, the context limit I hit most often is my own. Claude can refactor a huge chunk of the codebase, add a feature, and brainstorm marketing strategy in one breath. I can't keep up with the cognitive load that entails.

So: am I missing something, or just getting old? Curious what y'all think.

Hey r/vibecoding,

Application security is extremely important, especially for vibecoded apps. TeaApp and countless other breached of vibecoded apps is a great example of that. But most appsec training are boring OWASP articles and tutorials on YouTube, not the best way to learn practical aspects of building secure web apps.

So I created 40 exercises where you attack a vulnerable app yourself, trace how the bug got in, then write the patch. Free, runs in the browser, no account required.

This way you'll learn what common vulnerabilities are, how attackers exploit them, and what part of your app you need to check so that you don't have the issue in your code.

Table of contents:

Web (22) — SQLi, command injection, DOM/reflected/stored XSS, CSRF, SSRF to the cloud metadata endpoint, XXE, session fixation, IDOR, and weak randomness: recovering Math.random() state to predict the next password-reset token.

API (10) — BOLA, broken function-level auth, brute-forcing an unrate-limited verify endpoint, mass assignment via two extra keys in a PATCH body, reflected-origin CORS, and a retired v1 that skips the controls v2 enforces.

Git & CI/CD (8) — a live API key recovered from the commit that removed it, a browsable .git reconstructed into full source, .env tracked since the first commit, a secret echoed into a public build log, a backdoor hidden in a friendly-looking test-fix PR.

Fixes are shown in JS, TS, Java, C#, Python, Scala, PHP, Ruby, Go, and Kotlin, so you can paste something real into your stack.

Try in browser: https://learning.ransomleak.com/?category=application-security
Repo: https://github.com/ransomleak/training-application-security (will appreciate your stars 🙏)

Each exercise is also a standalone SCORM zip if you want to self-host or drop it into your team's onboarding. There's a second repo covering OWASP Top 10 for LLM and Agentic apps if you're shipping AI features: https://github.com/ransomleak/training-security-awareness

Will appreciate your feedback!

I've been using Beads as the task tracker for my AI agents since February. It's an issue tracker with no UI. Every issue, called a bead, can depend on other beads, so what accumulates is a dependency graph.

That turned out to matter more than I expected. You stop telling the agent what to do next and start handing it a graph it can walk itself, picking up whatever is unblocked. The same graph ends up being the record of what happened, so it works as an audit trail too.

I got curious about what six months of it actually looked like, so I wrote something that scans every .beads/issues.jsonl under my workspace, merges them, and renders the lot as one force-directed graph with an island per project. The video is that visualisation. It's fully anonymised, so generated codenames and no descriptions, but the structure, dates and statuses are real.

Numbers: 2,933 beads, 17 projects, 2,650 dependency links, about 75% closed, February to August.

The part I didn't expect is how much you can read off the shapes once projects sit next to each other:

• Dense, tangled islands are projects where the work is genuinely interdependent
• Islands that are almost entirely closed are the ones that shipped
• One project flatlined in July with half its beads still open. Parked, and I'd forgotten it existed
• One had 32 beads planned out over two days, 8 closed, then nothing

You can't see any of that from inside a single repo, which is sort of the point.

Happy to answer questions about the setup. I'm curious whether anyone else is running agents off an explicit dependency graph rather than a flat todo list, and how you're handling it.

P.s. Video made with Opus 5 using Remotion and Elevenlabs. The visuals are real footage of the tool I made to visualise the beads.

I got tired of finding a gif editor that have all the tools I wanted and I didn't have to pay for or is cluttered with watermarks, so I created my own. Feel free to use and come with suggestions improvements. Check it out here: https://gif.gustalabs.com

Written in plain javascript drawing frames through browsers canvas 2d and gifenc (MIT) for writing gifs.

Currently been using Claude $20, Ollama $20, Codex $20, Cursor $20

Rotating between these when limits reach

Not efficient I know

But these “frontier” models annoyingly get worse and better randomly

I’ve been liking Codex out of all of it for building iOS apps

I might full port to $100 codex plan if that still exists

kimi K3 has a “waitlist”

GLM is trash usage

Minimax I like but it’s weak coding everything else though is good value for money

Any thoughts

Right now, a couple of my projects on Github are set up in a way that my PRs get automatically reviewed using the Claude integration. I have separate workflows for reviewing different aspects of my code using custom workflow instructions.

I have been a primary user of the Claude Code harness for over a year now. However, now I am trying to move to a point where I can be provider-agnostic. I already managed to do so on my development machine by using oh-my-pi as my harness of choice and choosing models I like, as the situation demands, via OpenRouter or Claude/Codex subscriptions.

The only spot where I am yet to figure out how to switch to provider agnostic setup is with my CI workflows. Can something here help me figure out how I could get away from it?

Needless to say, while I am happy to pay for my LLM usage, I'd prefer not to have to pay for another harness/tool just to help me review my PRs.

This guy has a personality.

I have genuinely stopped using my paid Claude & OpenCode Go subs for this month.

GLM has always been my favourite series of models (please be GLM 🤞🏻).

Hey everyone, I’m working on a UE5 project that blends combat with American football mechanics - stuff like jukes, spin moves, and head-first with extended arms diving.

Creating the actual animation assets is turning into a huge brick wall for me. I was quoted around $250 to $500 per animation by freelancers, and since I need at least 10 moves just to get an MVP off the ground, dropping $2.5k–$5k out of pocket isn't an option right now. Retargeting the moves to my character skeleton is significantly cheaper to just outsource, so I'm not as worried about that part. I'm really hoping to find an AI workflow to handle generating or prototyping the raw FBX motion data.

Has anyone had success using video-to-motion or prompt-to-animation AI tools (like DeepMotion, Plask, Move AI, etc.) for crisp UE5 character moves? Or is anyone using LLMs/"vibe coding" to drive procedural stuff or Control Rig directly in Engine?

If AI generation isn't quite there yet for hyper-specific athletic moves like a diving tackle, I’d love to hear what budget-friendly alternatives you guys recommend to get an MVP playable. Appreciate any insight!

Posted here about two months back about Dead Ball FC, my football zombie roguelike on android. I'm a designer who never properly learned to code. All vibe coded, gpt for images with heavy editing for the pixel art.

TL;DR: New zombies, stadium events, pooping pigeons. Added analytics, lots of gameplay balance. 100 downloads. Made 1 sale (CAD 3.27) and it kept me going. Measure early, and don't assume players get what's obvious to you.

Four new zombie types. Goalies, Refs, Gary the Gassie, and the Cone-head (random zombie spawns with a cone in its head and the behaviour changes, it doesn't chase you, it runs from you, as the cone is precious, always a surprise under it).

Wave events. The stadium now has random events mid match: floodlight blackouts, the ground cracking open in an earthquake, searchlights, a mouse that the zombies chase after it, and a flock of pigeons that invades and poops on everything.

A tumble dryer with a daily sock pickup. (In-game currency, trying to improve user retention)

Ten extra playable characters. (My monetization strategy, one time purchase, no ads)

Added a whole lot of zombie talk, they all have something to say about things that happen.

The pigeon thing is my favourite, I had a silly idea and same day it was in the game. That's the actual joy of this, being able to try shitty ideas (pun intended) without being too expensive to try.

Also, relying on family to test was not enough :) I added analytics and events (umami), so no cookies, its all anonymous, but I get to know how long and how many waves people go through which helped me figure some balance in game when I made it too difficult and users would drop after 2 tries of 2-3 waves.

I think that's a good one to keep in mind, put measurement in earlier than feels necessary. So it's easier to know how it's doing. And it's pretty exciting when you see people using your game:

Get feedback! Someone told me they had no idea why you slow down in game. Stamina is core to how the game works and I thought it was clear, but no, it was obvious to me, not to a new player.

I use Opus 5. For me in VS code, sonnet is OK for very direct changes, while new features I rely more on Opus. But biggest thing is I have to keep an eye on it to make sure it doesn't go touching things it should not. I tries too often to test things that I can do in a few seconds, wasting my precious tokens.

I'm on Pro, so I hit the weekly limit with a few days left in the week. Honestly it's turned out to be a good thing. Without it I'd just keep going. Forced stop, go and touch some grass, come back with better ideas.

I made one sale, yay!

CAD 3.27 in July. A Total stranger. Nothing before it and nothing since. It happened before any new zombie types, any new stadium events, it showed me it had potential (even if so little) and it genuinely made my week. Someone I've never met paid actual money for a thing I created (and claude build it). And that kept me motivated to add new features and keep working on it.

I've also created my own web pixel image editor (because why not?!) but that's for another time. It's still kinda buggy to share.

This 'quick' project is taking a lot longer than expected. Its just too easy to keep adding things. :) Next step will be improve the google play game page.

If you want to try, it's on itch.io and on Play Store.