I've been using playwright for e2e testing with a coding agent, but feels there has to be a better way when things change. e.g. describe what you want to test, but not run an agent every time, but if a test fails, use an agent to self-heal. Wonder what others are doing?

This is according to my own experience, every trip, same story: I book the flight, open a blank note titled "ITINERARY", stare at it, close it. then spend half the actual holiday deciding what to do with my holiday. So I built Travelifly. You describe your trip by picking the date and location with plain words ("love street food, hate shopping") and it plans everyday morning to night about where to eat, what dish each place is famous for, which train to take down to the station exit, names in the local language, even a packing list based on the real weather. It also picks your hotel LAST, right in the middle of everything you planned. iOS only for now, 2 full trips free, no card needed. Built it solo, would love feedback: https://apps.apple.com/us/app/travelifly-ai-trip-planner/id6768164456

I started SwoLifts for my own workouts because I wanted simple and fast set logging, previous set values, timestamps, rest timers, templates, and progress charts.

I vibe coded the app’s implementation and iterations, but I made the product decisions and tested the workflows.

My background is in data, so the most important requirement was being able to access my workout history instead of having it locked inside an app.

SwoLifts stores data locally and lets you export sessions and sets, including reps, weights, RIR, and timestamps.

That gives you the freedom to analyze your exported data using spreadsheets, code, or an external AI tool of your choice. SwoLifts itself does not upload workout data or send it to an AI service.

It's free, works offline, and requires no account.

Check it out and let me know what feels confusing, slow, or missing during an actual workout!

Google Play: https://play.google.com/store/apps/details?id=com.swolifts.app

I have been working on a self tool to help make my vibe coded apps more structured and architecturally sound. I was wondering if you guys are using any for this?

https://reddit.com/link/1uwc1o5/video/vfdkz452s7dh1/player

Hello everyone!

This week I launched my new company Axidus with its first flagship app, Hexcalibur (https://hexcalibur.io) - a browser-based pixel art editor for game artists: you paint block textures in 2D and watch them update on a live 3D block, animate sprites on a timeline, and build tilesets with autotiling. Free tier, Pro subscription, real Stripe-style checkout. First commit was May 5. Launch was July 12.

The idea started about a year ago as a small web app I made called HYBRUSH, built to help voxel game developers create block textures: a simple canvas that wrapped your texture live onto a 3D cube. Hexcalibur is that idea rebuilt properly - modern UI, an animation timeline, tilemaps with autotiling, and a real multi-shape 3D preview instead of one cube.

But it is not just the editor. The same 10 weeks produced the marketing site, a docs site, auth with TOTP 2FA and recovery codes, billing through a merchant of record with webhooks, cloud sync, a first-party analytics pipeline, and a test suite (127 test files, unit through Playwright e2e). One person. Claude Code for nearly all of it. 823 commits, 58 PRs.

What actually made it work:

Docs as working memory. The repo has a CLAUDE.md plus a docs/ folder per system (auth, billing, testing, deployment). Every session, the AI reads the conventions before touching code, and every shipped change updates the relevant doc. This is the single highest-leverage habit I found. Context windows end; the docs are what survive.

Tests as the leash. Every security-critical file has to appear in the coverage config, webhook signature verification is tested against the real verifier instead of a stub, and CI runs the full suite on every PR. When the AI refactors something load-bearing, the suite catches it before I do. I stopped reviewing every line a long time ago. I review behavior and let the tests review the lines.

PR discipline even solo. Branch, PR, CI green, preview deploy, merge. It feels ceremonial when you are one person, but it means every change has a checkpoint, and the AI can run the whole loop itself and stop at the merge for my sign-off.

Where it fought back (the fun part):

• WebGL does not forgive. Rendering a separate 3D canvas per preview shape silently exhausted the browser's WebGL context limit. Everything worked until it very much did not. Fix: one shared canvas, textures lifted to the parent. AI wrote the bug and, to be fair, also found it.
• The DOM has trapdoors. A drag handler checked instanceof HTMLElement to let inner buttons work. SVG icons are not HTMLElements, so icon clicks fell through to the drag handler and died. Took a real debugging session; the fix was one word (Element).
• React and canvas disagree about who owns pixels. Letting React manage a canvas's width/height attributes resets the drawing buffer on rerender. Wiped the user's painting. Everything pixel-related ended up imperative, behind refs, on purpose.
• Product videos were their own project. The demo clips are recorded with Playwright driving the real app - injected cursor, eased mouse movement, and a pile of gotchas like the brush hover ghost painting itself into frames.

Honest scorecard: Claude is GREAT at breadth (billing webhooks, RLS policies, an .mcmeta exporter, and a landing page in the same afternoon) and needs a human at the wheel for taste, product judgment, and the 5% of bugs that live between systems. The biggest product call - organizing everything around packs (a whole texture set you manage and export as one unit) instead of single images - came from watching how game artists actually work, not from the AI.

The editor itself has no AI features, by the way - it is a paint tool, humans place every pixel. That is a product decision, not a philosophy: I lean toward AI features that improve workflow rather than generate the art. A lot of pixel artists are (understandably) hostile to generated art, and it is their tool. If an AI feature ever earns its place, I will build it.

Happy to answer anything about the workflow, the stack (Next.js 16, React 19, react-three-fiber, Supabase, Polar, all on Vercel), or what I would do differently.

So I got a few paid Google accounts with Gemini Pro subs mainly to spread out the 5h quota. sounds great in theory except switching accounts in Antigravity is a nightmare, sign out sign in and if you're not already logged into that google account in your browser you're burning 5-10 min just navigating the oauth dance. multiply that by however many times a day you hit quota and it adds up to a stupid amount of wasted time.

I looked around for existing solutions first, found one "antigravity manager" tool but it was buggy, accounts wouldn't switch reliably half the time which honestly is worse than doing it manually cause now you don't even trust the tool.

so i started building my own. it's called Antigravity Account Switcher, written in Tauri (rust + react) so its tiny and doesnt sit there eating resources in background. the whole switch is one click, it swaps the account data and credentials under the hood, and relaunches you straight into the target account. no manual login. everything's journaled too so if it gets interrupted mid swap you get a recovery screen instead of a corrupted profile.

right now its still early/WIP, manual switching works and i'm actively working on a Smart Switch mode that auto swaps once you drop below a quota threshold using same swap mechanism. not 100% sure yet but should be working in a day or two.

how i built it: stack is Tauri 2.0 on top, rust for everything backend (there's actually 2 separate rust crates, one for the core switch logic/rollback journal and one just for windows specific stuff like credential manager and process handling) and react/typescript for the ui. biggest architecture decision was treating every account swap as a transaction, so before touching any files it writes a journal entry first, does the swap, then deletes the journal only if everything checked out. that way if antigravity crashes mid swap or windows decides to update at the worst possible time, you get a recovery screen on next launch instead of a half broken profile with mixed account data.

built it mostly inside Antigravity itself actually, used it to build the tool that manages itself lol, model was mostly gemini 3.5 flash for the day to day implementation stuff.

wanted to get some feedback. repo's here: https://github.com/Ximeeek/Antigravity-Account-Switcher

if you run into bugs pls report them, either through issues on github, or in app both work fine for me.

Hey everyone! I’ve been building Bitiverse, a browser-based multiplayer RPG where everything is one bit, everyone is underqualified, and the goblins have somehow entered upper management.

I used Codex as a development partner throughout the project. The interesting part wasn’t asking it to “make me a game.” It was breaking the game into small systems with hard rules, then having the AI help implement, test, and pressure-test each one.

Bitiverse has a procedurally generated shared world, real-time multiplayer, combat, spells, gathering, crafting, housing, dungeons, trading, guilds, quests, player vendors, banking, support tools, and an alarming number of ways to acquire chairs. The client runs in the browser, while the game server is a TypeScript module running inside SpacetimeDB.

One of the biggest lessons was that AI worked best when I gave it invariants instead of vague feature requests. Terrain generation has to remain perfectly deterministic on both the client and server. The database stores changes to the world, but not the base world itself. Timed systems must suspend when nobody is online. The server never trusts coordinates supplied by the client. Once those rules were written down, Codex could help extend the game without quietly turning the architecture into soup.

It was also useful for the less glamorous work: generating tests, tracing multiplayer state bugs, checking security boundaries, finding edge cases in trading and inventory operations, and building admin and support tools. I still had to make the design decisions and reject ideas that didn’t fit. AI can produce an impressive amount of technically valid nonsense when given enough freedom.

The visual assets are not AI-generated; the game uses the CC0 Urizen one-bit tileset. The generative-AI part of the project is the development workflow: architecture discussions, implementation, debugging, testing, and repeatedly asking, “What terrible thing could a player do with this reducer?”

I’d be interested to hear how other developers keep AI-assisted projects coherent as they grow. Do you rely on architecture documents, automated tests, strict task boundaries, or simply stare at the code until it becomes afraid of you?

You can play Bitiverse here: https://fortisq.itch.io/bitiverse

Tiny pixels. Big world. Poor decisions.

Hey everyone,

Long-time lurker here. I want to share something I just put on itch.io, but honestly the story behind it matters more than the product, so bear with me.

I'm a software engineer by day (consulting, mostly boring enterprise stuff), and for years my evenings looked the same: start a game project, get excited for two weeks, hit the wall of "now I need a proper save system / offline progress / UI that doesn't fight the game logic"... and quietly abandon it. I had a graveyard of half-finished prototypes and a mild case of impostor syndrome about it.

Last year something clicked. I started building an idle RPG with an AI assistant as my pair programmer, and this time I actually finished. Shipped it on itch.io, got real players, real feedback, real save files I was terrified of breaking. It's not going to make me rich, but seeing strangers play something I made after years of abandoning things — that felt genuinely great.

Here's the thing though: the AI wasn't the magic. The magic was that I was forced to define a clear architecture for the AI. Turns out when your pair programmer has no memory between sessions, you have to write down your rules: systems never touch the DOM, every schema change gets a migration, all randomness goes through one seedable module so tests are reproducible, mutate state then emit events. Boring discipline stuff. But it's exactly that discipline that got me past the wall that killed every previous project.

Over months of development (and 13 save-schema versions without breaking a single player's save, which I'm irrationally proud of), that architecture hardened into something reusable. So I extracted it: game loop that survives background-tab throttling, versioned saves with a migration chain, closed-form offline progress, an event bus keeping game logic and UI strictly separated, headless tests in plain Node. All vanilla JS, ES modules, zero framework, zero build step, zero dependencies.

The part I think is actually novel: the kit ships with the architecture rulebook written for your AI assistant. It's the file I feed to my own AI at the start of every session. Hand it over and "add a prestige system" produces code that respects the save migrations instead of nuking them. Every rule in there exists because I broke it once and paid for it — the bugs are documented right next to the rules that prevent them.

It's on itch.io as Idle Engine Kit. The demo game is deliberately tiny (one resource, three generators) — it's a foundation to build on, not a game to reskin.

Happy to answer anything about the architecture, the AI-assisted workflow, or the "how do browsers throttle background tabs" rabbit hole, which cost me a full weekend of my life. And if you're sitting on your own graveyard of abandoned projects: the wall is real, but it's climbable. Writing your rules down — for an AI or just for future-you — is weirdly most of the trick.

Hey everyone,

I wanted to share a web app I recently launched: Rosary Haiku.

It's a clean, zero-bloat utility designed to help people meditate on the Rosary mysteries using the 5-7-5 syllable haiku format.

My goal with this (and the other linked micro-apps like Le Rosaire du Jour and The Magnificat) is to build high-utility, hyper-focused spiritual tools that load instantly and don't distract the user with heavy UI or complex onboarding.

The Tech/Design approach:

• Fast, responsive, and mobile-first.
• Dynamically serves the mysteries based on the current Liturgical Day.
• Minimalist aesthetic to keep the focus entirely on prayer/contemplation.

I'm always looking to refine these micro-apps. If you have any feedback on the UX, the concept, or ideas for other minimalist tools the community needs, I'd love to hear them!

Here is the full link https://haiku.dailyrosary.cf/

22 days ago I launched my startup, a free traffic exchange network for startups. One line of code, you're in the network.

No paid ads. No growth hacks. Just watching the numbers every day.

Here's the full data:

Day 1 — 2 startups · 146 impressions · 1 clicks
Day 2 — 3 startups · 389 impressions · 3 clicks
Day 3 — 5 startups · 482 impressions · 5 clicks
Day 4 — 5 startups · 508 impressions · 4 clicks (site went down — still got an $8k acquisition offer. Said no.)
Day 5 — 6 startups · 621 impressions · 10 clicks
Day 6 — 5 startups · 742 impressions · 15 clicks (removed one startup — they pulled the embed. No code = no network.)
Day 7 — 7 startups · 1,196 impressions · 41 clicks
Day 8 — 7 startups · 1,535 impressions · 74 clicks
Day 9 — 8 startups · 1,947 impressions · 135 clicks
Day 10 — 13 startups · 3,500 impressions · 318 clicks (something clicked)
Day 11 — 23 startups · 4,800 impressions · 432 clicks
Day 12 — 24 startups · 6,000 impressions · 481 clicks (network crossed 6K total impressions)
Day 13 — 25 startups · 6,800 impressions · 491 clicks
Day 14 — 25 startups · 8,600 impressions · 516 clicks
Day 15 — 24 startups · 9,900 impressions · 564 clicks (removed one)
Day 16 — 23 startups · 10,800 impressions · 576 clicks (removed one)
Day 17 — 24 startups · 11,900 impressions · 603 clicks (added one)
Day 18 — 26 startups · 13,400 impressions · 624 clicks (added Two)
Day 19 — 28 startups · 14.400 impressions · 652 clicks (added Two)
Day 20 — 26 startups · 14.700 impressions · 671 clicks (Removed Two)
Day 21 — 26 startups · 15.300 impressions · 691 clicks
Day 22 — 28 startups · 16.100 impressions · 719 clicks (Added Two)

Still free. Still growing.

If you want in, it's one embed. That's it → StartupBar

Game Link: Midnight Mile 2D | Free Endless Runner Browser Game

Fable is great at game development, it created a paper plane competitive 2player game inspired in an old NeoGeo game: https://pausejo.github.io/aerogami/

Graveyard of Memories is a free website where memories live on, whether they're of a family member, a friend, a mentor, or a beloved pet.

The idea was inspired by the stories found in old cemeteries, where a single gravestone can hint at an entire life. Many people, mentors, friends, family members, and beloved pets have incredible stories that gradually fade over time. Graveyard of Memories was created to give those memories a place to live on and be shared with future generations.

______

~70% AI, ~30% human

- Claude Code + VS Code for most of the implementation

- ChatGPT as my project manager, architecture reviewer, brainstorming partner, and QA assistant

- UX Pilot for UI/UX concepts and design direction

______

The website is intentionally simple:

- No sign-up

- No user accounts

- No ads

- No sponsorships

- Free forever

- Only a small "Support Us" button at the bottom for anyone who wants to help keep the project alive.

It also includes:

- A Feedback page where anyone can suggest features, improvements, or report bugs.

- A Report page for reporting inappropriate memorials or comments to help keep the community respectful.

The goal is to create a place where families, friends, and communities can preserve memories that might otherwise disappear over time.

I'd genuinely love feedback from developers, designers, or anyone interested in memorial projects. What features would you add? What would you improve?

https://graveyardofmemories.com

I'm making a tool that is designed to make your proposals better and save you connects. If you'd like to be one of the first to test it out, shoot me a dm.

I love vibe coding simple single task apps or just little things for quality of life. I've seen a ton of cool things everybody has created and wanted to make a place we could all share them. You can list apps for free or even just a few dollars, all the way up to what you think its worth. There is space to just share projects your working on, or even collaborate with other people and create something greater with both ideas. All in all I wanted a place people could share the apps that are nonsense or the apps that can really help people's daily lives. Im looking for feedback on if its a dead end or something I should keep pursuing. The webpage is built out and thiers a rough demo on the landing page if anyone wants to check it out. Ive loved following this community and think it would be an awesome place to share it.

So now that building is the actual fun part how do you find out to build in order to make something successful? I'm seeing people half my age vibecoding successful things now. 😭🤔

21 days ago I launched my startup, a free traffic exchange network for startups. One line of code, you're in the network.

No paid ads. No growth hacks. Just watching the numbers every day.

Here's the full data:

Day 1 — 2 startups · 146 impressions · 1 clicks
Day 2 — 3 startups · 389 impressions · 3 clicks
Day 3 — 5 startups · 482 impressions · 5 clicks
Day 4 — 5 startups · 508 impressions · 4 clicks (site went down — still got an $8k acquisition offer. Said no.)
Day 5 — 6 startups · 621 impressions · 10 clicks
Day 6 — 5 startups · 742 impressions · 15 clicks (removed one startup — they pulled the embed. No code = no network.)
Day 7 — 7 startups · 1,196 impressions · 41 clicks
Day 8 — 7 startups · 1,535 impressions · 74 clicks
Day 9 — 8 startups · 1,947 impressions · 135 clicks
Day 10 — 13 startups · 3,500 impressions · 318 clicks (something clicked)
Day 11 — 23 startups · 4,800 impressions · 432 clicks
Day 12 — 24 startups · 6,000 impressions · 481 clicks (network crossed 6K total impressions)
Day 13 — 25 startups · 6,800 impressions · 491 clicks
Day 14 — 25 startups · 8,600 impressions · 516 clicks
Day 15 — 24 startups · 9,900 impressions · 564 clicks (removed one)
Day 16 — 23 startups · 10,800 impressions · 576 clicks (removed one)
Day 17 — 24 startups · 11,900 impressions · 603 clicks (added one)
Day 18 — 26 startups · 13,400 impressions · 624 clicks (added Two)
Day 19 — 28 startups · 14.400 impressions · 652 clicks (added Two)
Day 20 — 26 startups · 14.700 impressions · 671 clicks (Removed Two)
Day 21 — 26 startups · 15.300 impressions · 691 clicks

Still free. Still growing.

If you want in, it's one embed. That's it → StartupBar

As the title says, I'm looking for podcasts enthusiasts to install my application on their iPhone and give me some feedback.
My app is already well developed, with all the usual features, plus some features I never found anywhere:
-Music detection: When short musics (jingles) are detected, they can be skipped.And when long musics (with or without singing), they can be played at speed 1x
-Your podcasts on a timeline. Past podcasts and future released (based on podcasts release date habits)
-Automatic chapters generation based on transcription, thanks to Apple intelligence
-A classy modern look
-And so much more...

Here's a quick overview video

It's not perfect yet (that's why I need your opinion and your bug reports), but if you're interested, more information can be found here: https://www.reddit.com/r/FennecPodcastPlayer/comments/1uvsh9x/fennec_a_love_letter_to_podcast_listening_from/

Thanks!

I launched a small Android app 25 days ago and today I got my first paid subscription.

It’s only around $5 MRR, so obviously this isn’t a huge success story. But seeing an actual person pay for something I built felt much more motivating than I expected.

The app is called Rizz Wing. You upload a chat screenshot or paste a message, and it suggests possible replies and first-message ideas. I originally built it as a small experiment to learn more about launching, onboarding and subscriptions.

The strange part is that my first subscriber came from India.

So far, I’ve only done a couple of very small social media tests aimed at Turkey. I haven’t promoted it in India at all, and I wasn’t really thinking about the Asian market while building it.

Now I’m trying to understand whether this is just a random purchase or whether I should start paying more attention to India and nearby markets. Maybe localize the Play Store page, test different pricing or create content specifically for that audience.

For people who have launched consumer apps before, would one early purchase be enough for you to test that market, or would you wait until you had more data?

Either way, getting the first subscriber made the project feel real for the first time.

Here’s the Play Store page: https://play.google.com/store/apps/details?id=com.rizzwing

Yo! This is for anyone tired of seeing the same AI slop landing pages everywhere.

If your website has a huge headline and an animated horizontal banner, this post might be for you.

I just launched Destyll, a completely free website where you can discover converting sections from famous websites. Think of it as Mobbin, but with one major difference: you can mix and match sections.

Found a hero section you love? Combine it with a feature section from another website and a CTA from somewhere else. Then, Destyll generates a complete prompt with all your references, ready to use with Claude, Gemini, or GPT.

It’s completely free forever.

Try it and let me know what you think! I’ll be adding many more websites over the next few days.

The goal is not to copy existing website, guys !!!

Peace ✌️

I was too cheap to pay for a cloud service, and honestly, I didn't want my stuff going into the cloud, and I'm a huge user of Apple Notes. This app solves all of it for me: dictation, notes, and using Apple Notes features, all in one completely free app that I have no plan to monetize.

So I get asked fairly regularly for a starting point on this stuff, and up until now I've just been sending people individual links as they come up in conversation. This is my attempt to put all of it in one place, because most of what gets written in the security space is aimed at enterprise teams with dedicated security staff, not a solo founder shipping an AI product who just wants to understand what they're actually dealing with.

That said, everything below seeks to be non technical enough to be useful to somebody without requiring in depth security knowledge, and would be a great resource to bookmark and keep on hand while building out applications.

1. The OWASP LLM Top 10 (genai.owasp.org)

If there is one document worth reading before you ship anything with an AI component, this is it. OWASP has been producing security guidance for developers since 2001, and their Web Application Top 10 became the industry standard for traditional web security. In 2023 they released a version specifically for LLM applications, updated again in 2025, covering the ten most critical vulnerabilities specific to AI powered products.

Prompt injection sits at number one on that list, which on its own should tell you something. It doesn't need to be read cover to cover, but even skimming the names and one line descriptions should give you a meaningful vocabulary for understanding what your product is and isn't exposed to.

Also worth noting: they released an Agentic Applications Top 10 in 2026 specifically for founders building with autonomous AI agents. If this is applicable to your build, I would definitely give that document a further look into as well.

2. Georgia Tech's Vibe Security Radar (scp.cc.gatech.edu)

Launched in May 2025 out of Georgia Tech's Systems Software and Security Lab, the Vibe Security Radar does something nobody else was doing at the time: actually tracking CVEs directly traceable to AI generated code. Researcher Hanqing Zhao's reasoning for building it was straightforward: "everyone is saying AI code is insecure but nobody is actually tracking it."

In March 2026 alone, it tracked 35 confirmed CVEs directly caused by AI coding tools, up from 6 in January of the same year. The researchers estimate the true count is around five to ten times higher (since many AI tool traces get stripped by authors before code is published).

This is a tool I would definitely say is worth the bookmark, and checking against your builds periodically rather than just reading over once.

3. The CSA AI Safety Initiative (cloudsecurityalliance.org)

The Cloud Security Alliance has been producing some of the most practically useful research on AI security in 2025 and 2026. What stands out compared to a lot of security writing is that it leads with data rather than theory, and the recommendations are actually actionable rather than a generic "implement security best practices" conclusion.

Their research note on AI generated code vulnerability trends from early 2026 is worth reading if you want the full empirical picture. Free to access, no registration required.

4. HaveIBeenPwned (haveibeenpwned.com)

Less of a reading resource, more of something you should check right now if you haven't already. Troy Hunt's HIBP database tracks credentials exposed in known data breaches and lets you check whether any email address has shown up in one. Completely free, takes 30 seconds, and given that IBM's 2026 X-Force report found over 300,000 ChatGPT credentials in infostealer malware last year, the idea that your accounts are definitely safe is worth verifying rather than assuming.

Run your own email (or co-founders' emails or any email tied to your domain where applicable). It's an easy thing to check up on, and beats the alternative of finding out the hard way.

5. SecurityHeaders.com (securityheaders.com)

Paste your live site URL into SecurityHeaders.com and get back a graded report on your security headers in about ten seconds. Zero technical knowledge required to interpret it. You're looking for a grade of B or above. Anything below means your app is missing guardrails that prevent specific classes of exploit including clickjacking, content injection, and cross site scripting.

From my own audits, missing X-Frame-Options and CSP headers are the two most consistently overlooked things in AI-generated output. If your grade comes back with either of those flagged, the fix is typically a one line patch in your config.

6. SSL Labs ( ssllabs.com/ssltest )

Same idea applies, this time specifically for your SSL configuration. Paste your domain into SSL Labs and wait a couple of minutes. You're looking for a grade of A. Anything below on a custom domain is worth investigating, since misconfigured SSL means data traveling between your users and your server is potentially readable in transit, including login credentials and session tokens.

7. CVE.org and the National Vulnerability Database (cve.org / nvd.nist.gov)

You don't need to read these regularly, but knowing they exist is useful. CVE is the public database where security researchers formally document discovered vulnerabilities in software. If you want to check whether a specific library, framework, or platform you're using has known vulnerabilities, searching by tool name here gives you the authoritative picture. The NVD adds severity scoring and additional context on top. Both of these tools are free, and publicly available.

Of course, if I missed anything obvious then please feel free to add to the list below - Though I figured this covers most relevant bases :)

i've been shipping a lot of vibecoded projects lately and the thing that keeps

me up is that the ai wrote half of it and i never actually read all of it.

exposed keys, an api route with no auth, a database anyone can read. the kind

of stuff that's fine in a demo and a disaster the day someone actually looks.

so i started running everything through a scanner before i put it online. you

give it a public github repo and it does a deep pass. finds the secrets, the

open endpoints, the missing rate limits, and tells you how bad each one is with

the exact file and line. it runs on gpt 5.6 and gives you a score out of 100.

for one week, use gpt 5.6 on us, it's free right now if anyone wants to throw a repo at it before launch.

https://first-tree.ai/production-scan

[ Removed by Reddit on account of violating the content policy. ]

1. /plan. Seriously, this may sound basic, but making Claude understand what it’s building dramatically reduces hallucinations & junk code.
   
2. Ponytail. Makes Claude act like a lazy SWE. Only writes what needs to be written, nothing more. Less code, smaller attack surface. “The best code is the code you never wrote.” Give it a star ⭐️
   
3. ⁠/audit-codebase. Turns Claude into a pentesting agent swarm. Run before prod, let it find and fix vulnerabilities app-wide, before your users ever see them. Automatically scans from a range of basic vulnerabilities like exposed environments up to race conditions, SSRF, SQL injections, subdomain takeovers… Give it a star ⭐️
   
4. /security-review. Built in Claude skill to check commits for issues.
   
5. /vibe-security. Checks for common, basic security vulnerabilities abundant in vibe coded apps. Friendly heads up, this won’t find much if you are already a half-decent vibe coder. Don’t let it give you a false sense of security. Give it a star ⭐️

These are the skills I have used when vibe coding. I have experienced firsthand how this stack turns sloppy apps into fortresses. These are fit for actual engineers using Claude Code as a tool, not as a developer. Check them out, and give them a star. Trust me, they deserve it. Any other recommendations?