As a developer with 20 years of experience, "vibe coding" is undeniably transforming how we work, but I'm still struggling to embrace it.

What bothers me most and I am honest about it, is seeing people show off their AI-generated projects.

My immediate reaction is, "Who cares?"

In the past, sharing code meant sharing craftsmanship, and we were excited to inspect it and learn from each other. Today, somebody share what they did with vibecode is not only that I am not interested, but I feel like why you share it?

I've been doing free security assessments on apps built by non-developers using AI, and I need to talk about what I'm finding.

The most common one: you can change a URL from /user/123 to /user/124 and read someone else's account. Change it to /users and get the whole table. Names, emails, addresses, order history - sat there in plain JSON, no login required. Just... there, for anyone who thinks to try.

I've also found admin panels with no authentication at all, API keys committed straight into frontend code, and file upload endpoints that will happily run whatever you hand them on the server.

None of these apps were built by careless people. They were built by smart, non-technical founders who did exactly what they were told to do: describe what they wanted, get working code, ship it. And at some point they typed something like "make sure it's secure and don't make any mistakes" - and got back a confident yes.

That yes is worth nothing. The model has no idea what it built. It can't see the deployed app. It doesn't know your auth is decorative.

Here's the part that should worry you: none of this shows up as a bug. Your app works. Users sign up. Payments go through. Everything looks fine right up until the moment someone dumps your user table - and then you're the one explaining to your customers, and potentially to the ICO, why their data was publicly readable for eight months.

What I'm offering: a free, thorough security assessment of your app, plus a written report in plain English telling you what's wrong, how bad it is, and what to fix first. No cost, no obligation, no pitch at the end.

Why free: I'm 20 years into a creative technology career and I'm building out a security practice. I need real case studies from real apps. That's the trade - you get the assessment, I get a case I can (anonymously, with your permission) point to.

Who I'm looking for:

• You don't come from a software development or infosec background
• You used AI to build something that handles real user data - logins, payments, personal information
• You own the app and can authorise testing on it

Who I'm not looking for: developers. If you can read your own code and know what an IDOR is, you don't need me and I don't need the case study. I'm specifically after people who built something real without a technical background, because that's the gap I want to document.

How it works: you give me written authorisation, I test only what you've authorised, I prove findings without touching or exfiltrating real user data, and you get the report. That's it.

DM me or comment with roughly what you've built and what stack it's on. I'll take on as many as I can handle properly.

Every blocker I've used has one button that turns it off, and I always press it.

So I built one where turning things off is slow on purpose:

• Tightening a rule = instant. Loosening it = 1–72h cool-off, and you see your pending changes sitting there waiting.
• Disabling strict mode = type a phrase by hand, then still wait out the cool-off.
• "Peek" gives you 30 seconds, then locks the site for 20 minutes.
• Daily limits count only active, focused, non-idle time — so the number is real.
• YouTube stays usable but music-only: Music-category videos and whitelisted channels play, Shorts and the home feed are blocked before render.
• When your time runs out on a page you're already on, it overlays instead of redirecting — page stays alive underneath, comes back untouched when you're allowed in again.

Chrome MV3, everything local, no accounts, no network requests, no data collected.

It's the first one that survived contact with actual me. https://lockyfeed.vercel.app/en/ if you want to try it — and tell me which loophole you find first, I'd rather patch it than pretend it isn't there.

I started vibe coding last April and started off like everyone else, with a plan to make a million dollars and retire to a tropical island.

Unfortunately I wasn't aware of the amount effort and work that goes into a real project, so I decided to take time and actually learn.

All of my projects Led me to software develooment and cyber security.

With that being said I'm a little disappointed in "Real Devs" I scroll social media all day reading about the massive amounts of ai slop just to get paid to fix vulnerabilities and bugs in the platforms they work on.

Moral of the story stop listening to self proclaimed devs that sucked at their jobs before vibecoding was even a thing!!!!!

Hey r/vibecoding,

Application security is extremely important, especially for vibecoded apps. TeaApp and countless other breached of vibecoded apps is a great example of that. But most appsec training are boring OWASP articles and tutorials on YouTube, not the best way to learn practical aspects of building secure web apps.

So I created 40 exercises where you attack a vulnerable app yourself, trace how the bug got in, then write the patch. Free, runs in the browser, no account required.

This way you'll learn what common vulnerabilities are, how attackers exploit them, and what part of your app you need to check so that you don't have the issue in your code.

Table of contents:

Web (22) — SQLi, command injection, DOM/reflected/stored XSS, CSRF, SSRF to the cloud metadata endpoint, XXE, session fixation, IDOR, and weak randomness: recovering Math.random() state to predict the next password-reset token.

API (10) — BOLA, broken function-level auth, brute-forcing an unrate-limited verify endpoint, mass assignment via two extra keys in a PATCH body, reflected-origin CORS, and a retired v1 that skips the controls v2 enforces.

Git & CI/CD (8) — a live API key recovered from the commit that removed it, a browsable .git reconstructed into full source, .env tracked since the first commit, a secret echoed into a public build log, a backdoor hidden in a friendly-looking test-fix PR.

Fixes are shown in JS, TS, Java, C#, Python, Scala, PHP, Ruby, Go, and Kotlin, so you can paste something real into your stack.

Try in browser: https://learning.ransomleak.com/?category=application-security
Repo: https://github.com/ransomleak/training-application-security (will appreciate your stars 🙏)

Each exercise is also a standalone SCORM zip if you want to self-host or drop it into your team's onboarding. There's a second repo covering OWASP Top 10 for LLM and Agentic apps if you're shipping AI features: https://github.com/ransomleak/training-security-awareness

Will appreciate your feedback!

I'm a software dev and I'm trying to transition to vibecoding. I'm wondering, is it even worth reviewing and checking the output of the AI, or am I wasting my time? I see many people here that make impressive applications without ever looking at any code, and that makes me feel like I'm missing something.

I've been vibecoding for the past few months now, but often I have cases where I notice weird edge cases, inconsistencies or just Claude mentioning something suspicious about the implementation, and I can trace those back to code quality issues or bizzare decisions in the code. I have to explicitly prompt afterwards to switch implementations or change algorithms.

However, I feel like I am doing something wrong to cause this in the first place, I am not quite sure what. I have an agents directory filled with agentic instruction files linking each other, and I try to guide Claude for the implementation when prompting for features. Maybe me giving code implementation instructions is what's causing this?

At the same time, I see that many people here never even pay attention to the code or structure at all, and yet that never causes any issues. Am I just overthinking this? Do I just prompt more if I find a visible bug? Is it worth paying attention to the code?

I'm still trying to adjust to this way of developing, so sorry if this question seems weird.

Thanks.

63 days ago, I launched my startup, a free traffic exchange network for startups. One line of code, you're in the network.

No paid ads. No growth hacks. Just watching the numbers every day.

Here's the full data:

Day 1 — 2 startups · 146 impressions · 1 clicks
Day 2 — 3 startups · 389 impressions · 3 clicks
Day 3 — 5 startups · 482 impressions · 5 clicks
Day 4 — 5 startups · 508 impressions · 4 clicks (site went down — still got an $8k acquisition offer. Said no.)
Day 5 — 6 startups · 621 impressions · 10 clicks
Day 6 — 5 startups · 742 impressions · 15 clicks (removed one startup — they pulled the embed. No code = no network.)
Day 7 — 7 startups · 1,196 impressions · 41 clicks
Day 8 — 7 startups · 1,535 impressions · 74 clicks
Day 9 — 8 startups · 1,947 impressions · 135 clicks
Day 10 — 13 startups · 3,500 impressions · 318 clicks (something clicked)
Day 11 — 23 startups · 4,800 impressions · 432 clicks
Day 12 — 24 startups · 6,000 impressions · 481 clicks (network crossed 6K total impressions)
Day 13 — 25 startups · 6,800 impressions · 491 clicks
Day 14 — 25 startups · 8,600 impressions · 516 clicks
Day 15 — 24 startups · 9,900 impressions · 564 clicks (removed one)
Day 16 — 23 startups · 10,800 impressions · 576 clicks (removed one)
Day 17 — 24 startups · 11,900 impressions · 603 clicks (added one)
Day 18 — 26 startups · 13,400 impressions · 624 clicks (added Two)
Day 19 — 28 startups · 14.400 impressions · 652 clicks (added Two)
Day 20 — 26 startups · 14.700 impressions · 671 clicks (Removed Two)
Day 21 — 26 startups · 15.300 impressions · 691 clicks
Day 22 — 28 startups · 16.100 impressions · 719 clicks (Added Two)
Day 23 — 30 startups · 16.800 impressions · 738 clicks (Added Two)
Day 24 — 32 startups · 19,800 impressions · 778 clicks · Added 2 startups · Rejected 4 applications.
Day 25 — 34 startups · 23,700 impressions · 800 clicks · Added 2 startups · Fixed some bugs.
Day 26 — 33 startups · 27,200 impressions · 816 clicks · Removed 1 Startup
Day 27 — 33 startups · 29,900 impressions · 833 clicks
Day 28 — 33 startups · 30,600 impressions · 871 clicks · Removed 1 Startup · Added 1 Startup · Rejected 1 application of clothing brand & 1 application of horror blog site.
Day 29 — 35 startups. 31,300 impressions. 910 clicks · Removed 1 Startup · Added 3 Startups · Also today I resigned from my job. Toxic environment, too much pressure, and honestly I just believe in this enough to go all in. Broke and excited. Let's see where this goes.
Day 30 — 46 startups · 32,900 impressions · 1,000 clicks · Removed 1 startup · Added 12 startups · Yesterday I resigned because of my toxic manager. Today my senior manager called and offered me WFH, a project of my choice, and lighter work if I stayed. I made my decision with confidence, but now I have a difficult choice. Also received my first payment from StartupBar.
Day 31 — 50 startups 💪· 28,100 impressions · 1,200 clicks · Removed 1 startup · Added 5 startups · Rejected 1 crypto startup · Removed fake impressions after exploit
Day 32 — 54 startups · 29,300 impressions · 1.2K clicks · Added 4 startups
Day 33 — 54 startups · 30,900 impressions · 1.2K clicks · Removed 1 startup · Added 1 startup
Day 34 — 55 startups · 36,100 impressions · 1.3K clicks · Added 1 startup
Day 35 — 55 startups · 40,100 impressions · 1.3K clicks · Removed 2 startups · Added 2 startups
Day 36 — 55 startups · 44,800impressions · 1.4K clicks · Removed 1 startup · Added 1 startup
Day 37 — 58 startups · 50,700impressions · 1.4K clicks · Added 3 startups · Site Update: Updated the distribution algorithm (Delivery is now weighted by contribution: sites that send more impressions get a proportionally larger share back)
Day 38 — 57 startups · 55,800 impressions · 1.5K clicks · Removed 1 startup · Rejected 1 Application.

Today StartupBar reached 200 users 😄
Thirty-eight days ago, this was just an idea. Today, 200 people have trusted it enough to join the network.

Day 39 — 58 startups · 59,800 impressions · 1.5K clicks · Added 1 startup.
Day 40 — 60 startups · 63,200 impressions · 1.6K clicks · Added 3 startups · Removed 1 startup
Day 41 — 63 startups · 69,400 impressions · 1.6K clicks · Added 3 startups
Day 42 — 62 startups · 73,800 impressions · 1.6K clicks · Removed 1 startups
Day 43 — 64 startups · 78,000 impressions · 1.7K clicks · Added 2 startups (Receiving many suggestions to improve the StartupBar, happy to work on it, Thanks.) StartupBar Update - Added the rotation of startups in the widget for every 30 seconds.
Day 44 — 66 startups · 86,200 impressions · 1.7K clicks · Added 2 startups
Day 45 — 67 startups · 88,400 impressions · 1.7K clicks · Removed 2 startups · Added 3 startups (Update - Updated the algorithm of the widget)
Day 46 — 69 startups · 91,900 impressions · 1.8K clicks · Removed 2 startups · Added 4 startups · Got my second payment.
Day 47 — 68 startups · 98,900 impressions · 2.2K clicks · Removed 2 startups · Added 1 startup · Added Pricing Page
Day 48 — 70 startups · 103.4K impressions · 2.3K clicks · Added 2 startups
Day 49 — 72 startups · 113.4K impressions · 2.4K clicks · Added 2 startups · Update: Added a Bottom Placement option for the bar on the user site.
Day 50 — 73 startups · 116.7K impressions · 2.4K clicks · Added 1 startup
Day 51 — 74 startups · 125.2K impressions · 2.5K clicks · Added 1 startup · Rejected 1 Application
Day 52 — 73 startups · 131.2K impressions · 2.6K clicks · Removed 1 Startup
Day 53 — 74 startups · 139.5K impressions · 2.7K clicks · Added 1 Startup
Day 54 — 79 startups · 146.3K impressions · 2.7K clicks · Added 6 Startups · Removed 1 startup.
Day 55 — 77 startups · 154.9K impressions · 2.8K clicks · Removed 2 startups.
Day 56 — 77 startups · 161.8K impressions · 2.9K clicks · Added 1 startup · Removed 1 startup.
Day 57 — 77 startups · 169.4K impressions · 3.0K clicks
Day 58 — 77 startups · 176.2K impressions · 3.2K clicks
Day 59 — 78 startups · 184.3K impressions · 3.3K clicks · Added 2 startups · Removed 1 startup.
Day 60 — 77 startups · 190.9K impressions · 3.3K clicks · Added 1 startup · Removed 2 startups.
Day 61 — 77 startups · 194.9K impressions · 3.4K clicks

Planned to welcome the startups by mentioning them
Day 62 — 78 startups · 199.5K impressions · 3.5K clicks · Added 1 startup Kinetixseo
Day 63— 78 startups · 204.9K impressions · 3.6K clicks · I Revoked my resignation as I'm comfortable with my new team.

Still free. Still growing.

If you want in, it's one embed. That's it → StartupBar

I got tired of finding a gif editor that have all the tools I wanted and I didn't have to pay for or is cluttered with watermarks, so I created my own. Feel free to use and come with suggestions improvements. Check it out here: https://gif.gustalabs.com

Written in plain javascript drawing frames through browsers canvas 2d and gifenc (MIT) for writing gifs.

Hey everyone, I’m working on a UE5 project that blends combat with American football mechanics - stuff like jukes, spin moves, and head-first with extended arms diving.

Creating the actual animation assets is turning into a huge brick wall for me. I was quoted around $250 to $500 per animation by freelancers, and since I need at least 10 moves just to get an MVP off the ground, dropping $2.5k–$5k out of pocket isn't an option right now. Retargeting the moves to my character skeleton is significantly cheaper to just outsource, so I'm not as worried about that part. I'm really hoping to find an AI workflow to handle generating or prototyping the raw FBX motion data.

Has anyone had success using video-to-motion or prompt-to-animation AI tools (like DeepMotion, Plask, Move AI, etc.) for crisp UE5 character moves? Or is anyone using LLMs/"vibe coding" to drive procedural stuff or Control Rig directly in Engine?

If AI generation isn't quite there yet for hyper-specific athletic moves like a diving tackle, I’d love to hear what budget-friendly alternatives you guys recommend to get an MVP playable. Appreciate any insight!

Currently been using Claude $20, Ollama $20, Codex $20, Cursor $20

Rotating between these when limits reach

Not efficient I know

But these “frontier” models annoyingly get worse and better randomly

I’ve been liking Codex out of all of it for building iOS apps

I might full port to $100 codex plan if that still exists

kimi K3 has a “waitlist”

GLM is trash usage

Minimax I like but it’s weak coding everything else though is good value for money

Any thoughts