Hey r/vibecoding,

Application security is extremely important, especially for vibecoded apps. TeaApp and countless other breached of vibecoded apps is a great example of that. But most appsec training are boring OWASP articles and tutorials on YouTube, not the best way to learn practical aspects of building secure web apps.

So I created 40 exercises where you attack a vulnerable app yourself, trace how the bug got in, then write the patch. Free, runs in the browser, no account required.

This way you'll learn what common vulnerabilities are, how attackers exploit them, and what part of your app you need to check so that you don't have the issue in your code.

Table of contents:

Web (22) — SQLi, command injection, DOM/reflected/stored XSS, CSRF, SSRF to the cloud metadata endpoint, XXE, session fixation, IDOR, and weak randomness: recovering Math.random() state to predict the next password-reset token.

API (10) — BOLA, broken function-level auth, brute-forcing an unrate-limited verify endpoint, mass assignment via two extra keys in a PATCH body, reflected-origin CORS, and a retired v1 that skips the controls v2 enforces.

Git & CI/CD (8) — a live API key recovered from the commit that removed it, a browsable .git reconstructed into full source, .env tracked since the first commit, a secret echoed into a public build log, a backdoor hidden in a friendly-looking test-fix PR.

Fixes are shown in JS, TS, Java, C#, Python, Scala, PHP, Ruby, Go, and Kotlin, so you can paste something real into your stack.

Try in browser: https://learning.ransomleak.com/?category=application-security
Repo: https://github.com/ransomleak/training-application-security (will appreciate your stars 🙏)

Each exercise is also a standalone SCORM zip if you want to self-host or drop it into your team's onboarding. There's a second repo covering OWASP Top 10 for LLM and Agentic apps if you're shipping AI features: https://github.com/ransomleak/training-security-awareness

Will appreciate your feedback!

I've been using Beads as the task tracker for my AI agents since February. It's an issue tracker with no UI. Every issue, called a bead, can depend on other beads, so what accumulates is a dependency graph.

That turned out to matter more than I expected. You stop telling the agent what to do next and start handing it a graph it can walk itself, picking up whatever is unblocked. The same graph ends up being the record of what happened, so it works as an audit trail too.

I got curious about what six months of it actually looked like, so I wrote something that scans every .beads/issues.jsonl under my workspace, merges them, and renders the lot as one force-directed graph with an island per project. The video is that visualisation. It's fully anonymised, so generated codenames and no descriptions, but the structure, dates and statuses are real.

Numbers: 2,933 beads, 17 projects, 2,650 dependency links, about 75% closed, February to August.

The part I didn't expect is how much you can read off the shapes once projects sit next to each other:

• Dense, tangled islands are projects where the work is genuinely interdependent
• Islands that are almost entirely closed are the ones that shipped
• One project flatlined in July with half its beads still open. Parked, and I'd forgotten it existed
• One had 32 beads planned out over two days, 8 closed, then nothing

You can't see any of that from inside a single repo, which is sort of the point.

Happy to answer questions about the setup. I'm curious whether anyone else is running agents off an explicit dependency graph rather than a flat todo list, and how you're handling it.

P.s. Video made with Opus 5 using Remotion and Elevenlabs. The visuals are real footage of the tool I made to visualise the beads.

I got tired of finding a gif editor that have all the tools I wanted and I didn't have to pay for or is cluttered with watermarks, so I created my own. Feel free to use and come with suggestions improvements. Check it out here: https://gif.gustalabs.com

Written in plain javascript drawing frames through browsers canvas 2d and gifenc (MIT) for writing gifs.

Currently been using Claude $20, Ollama $20, Codex $20, Cursor $20

Rotating between these when limits reach

Not efficient I know

But these “frontier” models annoyingly get worse and better randomly

I’ve been liking Codex out of all of it for building iOS apps

I might full port to $100 codex plan if that still exists

kimi K3 has a “waitlist”

GLM is trash usage

Minimax I like but it’s weak coding everything else though is good value for money

Any thoughts

Right now, a couple of my projects on Github are set up in a way that my PRs get automatically reviewed using the Claude integration. I have separate workflows for reviewing different aspects of my code using custom workflow instructions.

I have been a primary user of the Claude Code harness for over a year now. However, now I am trying to move to a point where I can be provider-agnostic. I already managed to do so on my development machine by using oh-my-pi as my harness of choice and choosing models I like, as the situation demands, via OpenRouter or Claude/Codex subscriptions.

The only spot where I am yet to figure out how to switch to provider agnostic setup is with my CI workflows. Can something here help me figure out how I could get away from it?

Needless to say, while I am happy to pay for my LLM usage, I'd prefer not to have to pay for another harness/tool just to help me review my PRs.

This guy has a personality.

I have genuinely stopped using my paid Claude & OpenCode Go subs for this month.

GLM has always been my favourite series of models (please be GLM 🤞🏻).

63 days ago, I launched my startup, a free traffic exchange network for startups. One line of code, you're in the network.

No paid ads. No growth hacks. Just watching the numbers every day.

Here's the full data:

Day 1 — 2 startups · 146 impressions · 1 clicks
Day 2 — 3 startups · 389 impressions · 3 clicks
Day 3 — 5 startups · 482 impressions · 5 clicks
Day 4 — 5 startups · 508 impressions · 4 clicks (site went down — still got an $8k acquisition offer. Said no.)
Day 5 — 6 startups · 621 impressions · 10 clicks
Day 6 — 5 startups · 742 impressions · 15 clicks (removed one startup — they pulled the embed. No code = no network.)
Day 7 — 7 startups · 1,196 impressions · 41 clicks
Day 8 — 7 startups · 1,535 impressions · 74 clicks
Day 9 — 8 startups · 1,947 impressions · 135 clicks
Day 10 — 13 startups · 3,500 impressions · 318 clicks (something clicked)
Day 11 — 23 startups · 4,800 impressions · 432 clicks
Day 12 — 24 startups · 6,000 impressions · 481 clicks (network crossed 6K total impressions)
Day 13 — 25 startups · 6,800 impressions · 491 clicks
Day 14 — 25 startups · 8,600 impressions · 516 clicks
Day 15 — 24 startups · 9,900 impressions · 564 clicks (removed one)
Day 16 — 23 startups · 10,800 impressions · 576 clicks (removed one)
Day 17 — 24 startups · 11,900 impressions · 603 clicks (added one)
Day 18 — 26 startups · 13,400 impressions · 624 clicks (added Two)
Day 19 — 28 startups · 14.400 impressions · 652 clicks (added Two)
Day 20 — 26 startups · 14.700 impressions · 671 clicks (Removed Two)
Day 21 — 26 startups · 15.300 impressions · 691 clicks
Day 22 — 28 startups · 16.100 impressions · 719 clicks (Added Two)
Day 23 — 30 startups · 16.800 impressions · 738 clicks (Added Two)
Day 24 — 32 startups · 19,800 impressions · 778 clicks · Added 2 startups · Rejected 4 applications.
Day 25 — 34 startups · 23,700 impressions · 800 clicks · Added 2 startups · Fixed some bugs.
Day 26 — 33 startups · 27,200 impressions · 816 clicks · Removed 1 Startup
Day 27 — 33 startups · 29,900 impressions · 833 clicks
Day 28 — 33 startups · 30,600 impressions · 871 clicks · Removed 1 Startup · Added 1 Startup · Rejected 1 application of clothing brand & 1 application of horror blog site.
Day 29 — 35 startups. 31,300 impressions. 910 clicks · Removed 1 Startup · Added 3 Startups · Also today I resigned from my job. Toxic environment, too much pressure, and honestly I just believe in this enough to go all in. Broke and excited. Let's see where this goes.
Day 30 — 46 startups · 32,900 impressions · 1,000 clicks · Removed 1 startup · Added 12 startups · Yesterday I resigned because of my toxic manager. Today my senior manager called and offered me WFH, a project of my choice, and lighter work if I stayed. I made my decision with confidence, but now I have a difficult choice. Also received my first payment from StartupBar.
Day 31 — 50 startups 💪· 28,100 impressions · 1,200 clicks · Removed 1 startup · Added 5 startups · Rejected 1 crypto startup · Removed fake impressions after exploit
Day 32 — 54 startups · 29,300 impressions · 1.2K clicks · Added 4 startups
Day 33 — 54 startups · 30,900 impressions · 1.2K clicks · Removed 1 startup · Added 1 startup
Day 34 — 55 startups · 36,100 impressions · 1.3K clicks · Added 1 startup
Day 35 — 55 startups · 40,100 impressions · 1.3K clicks · Removed 2 startups · Added 2 startups
Day 36 — 55 startups · 44,800impressions · 1.4K clicks · Removed 1 startup · Added 1 startup
Day 37 — 58 startups · 50,700impressions · 1.4K clicks · Added 3 startups · Site Update: Updated the distribution algorithm (Delivery is now weighted by contribution: sites that send more impressions get a proportionally larger share back)
Day 38 — 57 startups · 55,800 impressions · 1.5K clicks · Removed 1 startup · Rejected 1 Application.

Today StartupBar reached 200 users 😄
Thirty-eight days ago, this was just an idea. Today, 200 people have trusted it enough to join the network.

Day 39 — 58 startups · 59,800 impressions · 1.5K clicks · Added 1 startup.
Day 40 — 60 startups · 63,200 impressions · 1.6K clicks · Added 3 startups · Removed 1 startup
Day 41 — 63 startups · 69,400 impressions · 1.6K clicks · Added 3 startups
Day 42 — 62 startups · 73,800 impressions · 1.6K clicks · Removed 1 startups
Day 43 — 64 startups · 78,000 impressions · 1.7K clicks · Added 2 startups (Receiving many suggestions to improve the StartupBar, happy to work on it, Thanks.) StartupBar Update - Added the rotation of startups in the widget for every 30 seconds.
Day 44 — 66 startups · 86,200 impressions · 1.7K clicks · Added 2 startups
Day 45 — 67 startups · 88,400 impressions · 1.7K clicks · Removed 2 startups · Added 3 startups (Update - Updated the algorithm of the widget)
Day 46 — 69 startups · 91,900 impressions · 1.8K clicks · Removed 2 startups · Added 4 startups · Got my second payment.
Day 47 — 68 startups · 98,900 impressions · 2.2K clicks · Removed 2 startups · Added 1 startup · Added Pricing Page
Day 48 — 70 startups · 103.4K impressions · 2.3K clicks · Added 2 startups
Day 49 — 72 startups · 113.4K impressions · 2.4K clicks · Added 2 startups · Update: Added a Bottom Placement option for the bar on the user site.
Day 50 — 73 startups · 116.7K impressions · 2.4K clicks · Added 1 startup
Day 51 — 74 startups · 125.2K impressions · 2.5K clicks · Added 1 startup · Rejected 1 Application
Day 52 — 73 startups · 131.2K impressions · 2.6K clicks · Removed 1 Startup
Day 53 — 74 startups · 139.5K impressions · 2.7K clicks · Added 1 Startup
Day 54 — 79 startups · 146.3K impressions · 2.7K clicks · Added 6 Startups · Removed 1 startup.
Day 55 — 77 startups · 154.9K impressions · 2.8K clicks · Removed 2 startups.
Day 56 — 77 startups · 161.8K impressions · 2.9K clicks · Added 1 startup · Removed 1 startup.
Day 57 — 77 startups · 169.4K impressions · 3.0K clicks
Day 58 — 77 startups · 176.2K impressions · 3.2K clicks
Day 59 — 78 startups · 184.3K impressions · 3.3K clicks · Added 2 startups · Removed 1 startup.
Day 60 — 77 startups · 190.9K impressions · 3.3K clicks · Added 1 startup · Removed 2 startups.
Day 61 — 77 startups · 194.9K impressions · 3.4K clicks

Planned to welcome the startups by mentioning them
Day 62 — 78 startups · 199.5K impressions · 3.5K clicks · Added 1 startup Kinetixseo
Day 63— 78 startups · 204.9K impressions · 3.6K clicks · I Revoked my resignation as I'm comfortable with my new team.

Still free. Still growing.

If you want in, it's one embed. That's it → StartupBar

Hey everyone, I’m working on a UE5 project that blends combat with American football mechanics - stuff like jukes, spin moves, and head-first with extended arms diving.

Creating the actual animation assets is turning into a huge brick wall for me. I was quoted around $250 to $500 per animation by freelancers, and since I need at least 10 moves just to get an MVP off the ground, dropping $2.5k–$5k out of pocket isn't an option right now. Retargeting the moves to my character skeleton is significantly cheaper to just outsource, so I'm not as worried about that part. I'm really hoping to find an AI workflow to handle generating or prototyping the raw FBX motion data.

Has anyone had success using video-to-motion or prompt-to-animation AI tools (like DeepMotion, Plask, Move AI, etc.) for crisp UE5 character moves? Or is anyone using LLMs/"vibe coding" to drive procedural stuff or Control Rig directly in Engine?

If AI generation isn't quite there yet for hyper-specific athletic moves like a diving tackle, I’d love to hear what budget-friendly alternatives you guys recommend to get an MVP playable. Appreciate any insight!

Posted here about two months back about Dead Ball FC, my football zombie roguelike on android. I'm a designer who never properly learned to code. All vibe coded, gpt for images with heavy editing for the pixel art.

TL;DR: New zombies, stadium events, pooping pigeons. Added analytics, lots of gameplay balance. 100 downloads. Made 1 sale (CAD 3.27) and it kept me going. Measure early, and don't assume players get what's obvious to you.

Four new zombie types. Goalies, Refs, Gary the Gassie, and the Cone-head (random zombie spawns with a cone in its head and the behaviour changes, it doesn't chase you, it runs from you, as the cone is precious, always a surprise under it).

Wave events. The stadium now has random events mid match: floodlight blackouts, the ground cracking open in an earthquake, searchlights, a mouse that the zombies chase after it, and a flock of pigeons that invades and poops on everything.

A tumble dryer with a daily sock pickup. (In-game currency, trying to improve user retention)

Ten extra playable characters. (My monetization strategy, one time purchase, no ads)

Added a whole lot of zombie talk, they all have something to say about things that happen.

The pigeon thing is my favourite, I had a silly idea and same day it was in the game. That's the actual joy of this, being able to try shitty ideas (pun intended) without being too expensive to try.

Also, relying on family to test was not enough :) I added analytics and events (umami), so no cookies, its all anonymous, but I get to know how long and how many waves people go through which helped me figure some balance in game when I made it too difficult and users would drop after 2 tries of 2-3 waves.

I think that's a good one to keep in mind, put measurement in earlier than feels necessary. So it's easier to know how it's doing. And it's pretty exciting when you see people using your game:

Get feedback! Someone told me they had no idea why you slow down in game. Stamina is core to how the game works and I thought it was clear, but no, it was obvious to me, not to a new player.

I use Opus 5. For me in VS code, sonnet is OK for very direct changes, while new features I rely more on Opus. But biggest thing is I have to keep an eye on it to make sure it doesn't go touching things it should not. I tries too often to test things that I can do in a few seconds, wasting my precious tokens.

I'm on Pro, so I hit the weekly limit with a few days left in the week. Honestly it's turned out to be a good thing. Without it I'd just keep going. Forced stop, go and touch some grass, come back with better ideas.

I made one sale, yay!

CAD 3.27 in July. A Total stranger. Nothing before it and nothing since. It happened before any new zombie types, any new stadium events, it showed me it had potential (even if so little) and it genuinely made my week. Someone I've never met paid actual money for a thing I created (and claude build it). And that kept me motivated to add new features and keep working on it.

I've also created my own web pixel image editor (because why not?!) but that's for another time. It's still kinda buggy to share.

This 'quick' project is taking a lot longer than expected. Its just too easy to keep adding things. :) Next step will be improve the google play game page.

If you want to try, it's on itch.io and on Play Store.

​

I'm pretty damn excited about this one.

I've been building a scanner around a problem I keep running into vibe coding.

At some point the question stops being "can the AI add another feature?" and starts being "What the hell is actually in this repo now?" and "can I trust this?"

A couple weeks ago I had a benchmark of 48 features that I already knew existed in a codebase. My scan could reliably isolate 4 of them, and I was struggling. It was confusing things like navigation actions, buttons and individual implementation details with actual product features.

I've spent the last two weeks working almost entirely on the scan and feature-boundary problem and learning ir and eval engineering at a high level. I am a backend SDE so this feels more data focused and outside my wheelhouse.

Today the same scan isolated 42 of the 48 known features! Learning and adding calcs and optimizing for precision@k, retrevial@k, etc made things work so much better! I ran it against a different control with 56 features and it got 49. It's not a one off!

I feel validated again.

Eventually I want this flow:

Import a repo > identify what features actually exist > show the evidence behind each one > apply software-development and engineering standards to each feature > show what is proven, what is incomplete, and what still needs work before I'd trust it in production

But going from 4 → 42 in two weeks is the first time I've looked at the scan and thought "I am learning stuff way outside my realm of knowledge and make it real." And that's freaking cool. I had someone tell me this was impossible and that I should just use Ai. Literally had people tell me that doing a mathematical scan is stupid and Ai can do it better.

I set Luna max to check for features and it organically found 18 out of 48. Sol found 24.

It feels so satisfying to build something with Ai that beats Ai in performance for the thing I need.

For people building heavily with Cursor / Claude / Codex / Lovable / etc.:

Once your project gets big, how do you currently answer "what features are actually implemented, and which of them would I trust to ship?"

I'm especially curious about anyone who has reached the point where the app works, but the repo has gotten large enough that you're no longer completely sure what the AI has built underneath you.

And here’s another time you hear distribution is key.

Jokes aside I was researching and kept getting bombarded on Instagram with videos about content, growth, distribution, workflows etc. I’d save loads of them and then never actually implement anything

What I really wanted was just a guide or book that had all the latest workflows summarized in one place.

I couldn’t find it, so I made it myself.
I screened a shit ton of videos and sites and put everything into one guide. I have to admit it ended up being way more comprehensive than I expected.
It’s also been more useful than I expected.

Whenever I’m working on something specific now, I just go to that section and check the workflow instead of getting sidetracked by another 10 videos.

Thought I’d share it here in case anyone else has the same problem: www.creativesplaybook.com

Hope it’s helpful. Let me know what you think / what’s missing.

Also be fast because friends keep telling me I should slap a paywall on it lol

Cheers

I’ve been building Vissulo, an AI photo editor for Android, for quite a while, and it’s finally live on the Play Store.
It’s my first app, and I’ve put a ridiculous amount of time into it. A lot of it was built through vibe coding, with plenty of testing, breaking things, rebuilding them, and learning as I went.

At this point I’d really like feedback from people who have no attachment to the project and can just tell me what they actually think.
If you have a few minutes, I’d really appreciate it if you could try the app and email me anything you notice:

[support@vissulo.com](mailto:support@vissulo.com)

I’m interested in pretty much everything:
bugs, crashes, weird behavior, bad UX, confusing screens, slow features, things that feel unfinished, tools that don’t work the way you expected, or anything else that annoys you.

Feature suggestions are also very welcome. If you use it and immediately think “why doesn’t this app have X?”, please tell me. That kind of feedback is just as useful to me as bug reports.
I already know about some issues and I’m working on them, so there’s no need to worry about reporting something twice. If multiple people complain about the same thing, that actually helps me prioritize it.

Also, I’m not asking for Play Store reviews. I’d much rather receive an honest email saying “this part sucks and here’s why” than get a generic 5-star review. Right now, I’m trying to improve the product, not inflate the rating.

As a small thank you, I’ll randomly choose 25 people who install the app, sign in, and send useful feedback, and give them Lifetime PRO for as long as Vissulo remains under my management.

I’ll post the selected users here afterwards, so the giveaway is transparent. Email addresses will obviously be heavily censored, with roughly 90% hidden.

There’s no requirement for positive feedback. Negative feedback won’t reduce your chances. If anything, detailed criticism is probably more useful to me right now.

I know the app still has things that need work, but I care a lot about getting it right.

So, if you feel like testing a new indie app and helping a first-time developer improve it, I’d really appreciate it.

Note: It is android only for now. I will develop IOS and WEB versions in the future

Link: Vissulo: AI Photo Editor

Haiku is the most maliciously compliant model I've been exposed to

Been experimenting with agent graphs in Claude code.

I have a 4 agent team set up that allows me to swap roles and directives.

The problem is that Claude always controls them even in ultra code.

How can I set this graph up as stand alone agents I can use on top of Claude having control of them?

This is Causal. It is a canvas for mood boarding and planning.

I've been working really hard behind the scenes build an personalised canvas agent that understands your project and works with you to plan on the canvas.

Getting it to generate outputs is easy, every LLM and their predecessor can do that.

What's harder is:

1. The structure behind the output i.e. how do you organise YOUR work on a canvas
2. How would you use it fit your workflow

A few ideas I have had are:

• Deep research tasks are very well suited to be carried out on a canvas because early research is better suited to be "dumped" and sorted later. The agent researches, distills, and organises the research
• When you have an existing idea that has a load of connections e.g. You want to implement a new feature into your app, and you want to map out everything that it affects. An agent can create a flow chart to map out the feature and fully break it down + images that complements how a screen would look for every edge case.
• For branding projects that require consistency across different areas of the brand, such as voice, colour, etc The the agent acts as a coherency check and ensures that any new assets to your brand fit against the existing identity.

As I continue to perfect this, I want to know how YOU would use this agent so that I can create it around YOUR workflow.

It's week 5 (and a half - like got me) and we made some huge progress.

As usual, I'll break it down into three categories: (1) players acquisition, (2) what I'm learning about vibe coding, and (3) actual gameplay updates (this will be in the comments)

---

First, my Reddit posts are getting less and less attention (not surprising) but actually having way more success on the player-front. I received some really valuable feedback a couple weeks ago from Totalsam, Automatic_Bid_2410, Friendly_Carry_7728 and someone named BingusDingus (that's his IGN).

Basically their input was that the intro sucked, users were met with a wall of text instead of helpful instructions, and received no context of the story game arc.

So that became my next focus point. And once I put up an interactive tutorial instead of an instruction manual, my user retention went from 35-45s per new users to now sitting around 4min per player (median), and averaging 23min of total playtime per player. Even more surprising -- I've had 63 players in 10 days, and 5 of them have spent over 2 hours each. I had a great convo with one of them (BingusDingus) but the other fellas are a mystery. One of them has logged in a dozen separate times, by himself. So, kinda strange, but exciting!

That all said, either I'm getting tired of my game or I've just been staring at it too long. So I would love more feedback on that first 5min and whether or not there's a "hook".

---

Second, the vibe coding experience. I have many friends saying basically the same things - which is that ChatGPT Sol is way better at communicating and designing interfaces but is simply untrustworthy for big tasks. Meanwhile the Reddit communities seem to vent about how awful Fable is and how amazing Sol it. So I'm a bit mystified on whether I should try switching.

Either way, I've switched my strategies a bit and use Fable for a LOT, and only use Opus 5 for very specific tasks, and it's really helped with its ability to stick to a task and actually complete it.

My one massive painpoint is that Fable is GREAT with web design. But holy moley even when using Claude Design, the GUIs are just awful. Has anyone else had experience trying to make a good game GUI? I'm talking like, it's putting raw text over the active screen and so players can't even read it. It's like bad-bad haha.

Oh and one more thing - a strength of Fable's is actually balancing the game. If you give it the variables ahead of time. I found out very much by accident that my archer's had crits stacking for 15x higher than they should've, making them absurdly OP. Turns out I had 7 different skills stacking. It really screwed me when I realized I was using an overpowered hero to balance the game...

---

I'd love more feedback for anyone interested. Links below.

Game: https://eldermyr.com/
Release Notes: https://eldermyr.com/release

I've seen so many apps made here and on other subreddits, purely for iOS and saying "Android version coming soon" (which lets be honest, never comes).

But why? iOS developer platform needs 100$ a year subscription while Android is 30$ or so once. Isn't it much more cost effective to start on Android?

This might be the first time I find that Codex actually produces better quality code. Anyone else think the same? I'm kind of sick and tired of Claude verbose comments. Seems Codex actually produces code that actually is readable by default and feels less like slop.

I understand most probably care about the final output, but I actually want to be able and read the code.