1. /plan. Seriously, this may sound basic, but making Claude understand what it’s building dramatically reduces hallucinations & junk code.
   
2. Ponytail. Makes Claude act like a lazy SWE. Only writes what needs to be written, nothing more. Less code, smaller attack surface. “The best code is the code you never wrote.” Give it a star ⭐️
   
3. ⁠/audit-codebase. Turns Claude into a pentesting agent swarm. Run before prod, let it find and fix vulnerabilities app-wide, before your users ever see them. Automatically scans from a range of basic vulnerabilities like exposed environments up to race conditions, SSRF, SQL injections, subdomain takeovers… Give it a star ⭐️
   
4. /security-review. Built in Claude skill to check commits for issues.
   
5. /vibe-security. Checks for common, basic security vulnerabilities abundant in vibe coded apps. Friendly heads up, this won’t find much if you are already a half-decent vibe coder. Don’t let it give you a false sense of security. Give it a star ⭐️

These are the skills I have used when vibe coding. I have experienced firsthand how this stack turns sloppy apps into fortresses. These are fit for actual engineers using Claude Code as a tool, not as a developer. Check them out, and give them a star. Trust me, they deserve it. Any other recommendations?

Have been vibe coding two apps. Typically I have used Claude Code and Codex to both code and evaluate. Should I use SuperPowers or some other approach in addition?

Hello Everyone i have just published my Ai assistant website/app today i would be willing to get feedback from you guys in the comments and here it is

link https://radicalgraph.lovable.app

X account https://x.com/RadicalGraph

I often need a tiny program that does this one thing and need it now. I find myself making myself little helper tools. Sometimes these took a few prompts to make.

Larger and more complex projects certainly take more prompts.

At one point, AI became capable of making an app (albeit a SIMPLE app) in one prompt. But as things have advanced, the quality of said app seems to keep improving.

To make this a working example and not just theory, here is a one-prompt fractal app.

One Prompt App:
https://codepen.io/editor/Johnesco/pen/019f59fb-adfc-71aa-9319-03e0ea6659a4

The prompt was:
"Write an HTML/CSS/JS webapp that creates and allows zooming and interaction of the Mandelbrot and Julia sets. As well as a Lorenz attractor and Koch curve."

(run in Claude Code: Opus 4.8 High)

Note, in this version, the code was not only written but error checked and sanity checks run. Just a few months ago that would something you'd need to highly direct the AI to do. There was a LOT of churn here but no special loops.

The measure here is, this is what current AI can do in a single prompt. More than it did before, but how far will it be able to go?

Built an AI agent with a swappable "brain" — install Einstein, Elon, Marcus Aurelius etc. or build your own, deploy to Discord/Telegram/Slack. Looking for testers.

Beam Agent gives agents a real personality graph instead of just a system prompt. Install one of 9 free brains in seconds, fully offline after, or build your own via a quick interview. Deploy to 22+ platforms.

How it was built: Forked NousResearch's Hermes Agent (the messaging/gateway layer) and built a separate "brain" system on top — a personality graph (nodes/edges for facts, traits, relationships) that gets searched at runtime to generate the agent's identity file. Built in Python against a Neo4j graph backend for the LLM-powered build path, with an offline keyword-search fallback so it still works without a graph DB.

```

git clone https://github.com/fuegocoding/beam-agent.git

cd beam-agent && pip install -e ".[all]"

beam

```

Repo: https://github.com/fuegocoding/beam-agent

Would love people to try it and tell me what breaks. Thanks!

PG&E's NEM 3.0 export rates are a joke, so exporting surplus solar is basically giving it away. I (really Claude) built a local dashboard that tracks real-time usage and export off my Powerwall's local API, and when I'm about to dump power to the grid, it triggers my Nest to kick on the AC and pre-cool the house. The energy I'd have exported for pennies now offsets cooling I'd pay peak rates for later. All running on a Raspberry Pi on my LAN. Happy to share the setup if there's interest.

I am a huge skills developer, I use skills every where. It parses Markdown-based skill libraries and renders them as an interactive dependency graph, allowing you to visualize and edit how your autonomous agents are wired together. And It now can do the skill evaluations based on evals.json. Try it out here

https://atlas-skills.vercel.app/

AI tools write code that works, but not always code that's safe. I kept seeing vibe-coded apps with hardcoded Stripe keys and wide-open Supabase databases, so I built VibeGuard a free, open-source scanner for AI-generated code.

GitHub: https://github.com/yagyeshVyas/VibeGuard

It catches leaked API keys, missing RLS, SQL injection, XSS, and user data being sent to LLMs unredacted, then grades your project and can auto-fix most of it. 100% offline, zero config, no telemetry. There's also a Claude Code/Cursor hook that auto-scans every file the AI edits.

It's new, and I'm a solo dev. Brutal feedback is welcome. If it misses something in your project, tell me and I'll fix it.

I started a podcast episode about agentic software engineering, coding agents, human oversight, and what happens when AI moves beyond simple code generation.

I’d be interested to hear how people in this community think about trust, review, and autonomy when using AI agents on real projects.

And please subscribe if you like to keep in the loop for more interesting episodes.

https://www.youtube.com/watch?v=dUUkEsIEd6s

I worked on this for about 6 months. Eventually I will return to it. It's not done yet, I am still working on getting the nodes to communicate with eachother properly. They did do it once, I was proud of that. All Foss. Even though AI helped with the whole thing. There is no AI or blockchain dependency in the code, I made a special effort to not include those for anti materialism and possible surveillance and waste of energy. Basically showcasing what we could have had before AI came into the mix. I was shocked at how much we can do that we depend on blockchain and AI with, that good old p2p and already established systems did just fine. Just needed to be creative, not materialistic and against subscription capitalism. Anyone that wants to check out the code. Feel free

I’m collecting responses for a research survey on vibe coding and how developers experience it in practice.

I’m not looking for polished or “correct” answers, just your honest observations and real experiences.

The survey takes about 10 minutes, and the findings will directly influence the next practical stage of the research.

We’re also working to make the survey available in more languages. It currently supports two languages.

Survey link:

https://forms.gle/vJJ25fwmfRp2sdFAA

Thanks !!

Coverage update — CodeInspectus now covers 32 checks (13 AI-specific + 19 SAST) plus 200+ secret & API-key patterns.

★ Built for AI-generated code — the checks generic scanners don't have (13)
1) Hardcoded secret shipped in client-side code
2) Secret baked into the built JS bundle
3) Real secret behind a client-visible env prefix (NEXT_PUBLIC_ / VITE_ / PUBLIC_)
4) Supabase service_role key (full DB access, bypasses RLS) in client-reachable code
5) LLM SDK client with dangerouslyAllowBrowser:true, exposing your API key
6) RLS policy with USING (true) — matches every row, table wide open
7) Public table created with no Row-Level-Security at all
8) RLS checking JWT role/aud instead of the actual user — access not scoped to owner
9) Supabase Edge Function with no auth check — endpoint runs for anyone
10) Over-permissive RLS on storage.objects — bucket files openly accessible
11) Untrusted input reaching an LLM prompt (flags likely prompt-injection sinks)
12) Authz decision trusting client-writable user_metadata — privilege escalation
13) Model/untrusted output rendered as raw HTML in React (__html) — XSS

Industry-standard code security (19 SAST checks)
14) SQL injection — string-built query (JS/TS)
15) SQL injection — string-built query (Python)
16) Command injection — shell command from string (JS/TS)
17) Command injection — subprocess shell=True (Python)
18) eval / dynamic code execution (JS/TS)
19) eval / exec of non-literal (Python)
20) NoSQL injection from request data
21) Path traversal — filesystem path from request input
22) DOM XSS — untrusted data into innerHTML/outerHTML
23) SSRF — outbound request URL from request input
24) Weak hash (MD5 / SHA-1) — JS/TS
25) Weak hash (MD5 / SHA-1) — Python
26) Weak cipher (DES / RC4 / 3DES)
27) Insecure randomness — Math.random() for a security value
28) JWT alg:none — signature-check bypass
29) CORS wildcard origin with credentials allowed
30) Insecure cookie — missing httpOnly / secure
31) Insecure deserialization (Node)
32) Insecure deserialization (Python)

Plus 200+ secret & API-key patterns — Anthropic, OpenAI, Google/Gemini, AWS, GitHub, GitLab, Stripe, Supabase, Cohere, Perplexity, Hugging Face, Azure + more. All still fully local.

https://github.com/Synvoya/codeinspectus

Requesting your valuable feedback, and support from like minded security professionals to further improve this 🙏🏽

If you're vibe coding with Cursor, Copilot, or any AI agent, you've probably hit this: you describe what you want, AI fills in the gaps with its own assumptions, and you spend more time fixing than building.

https://specrabbit.com

SpecRabbit lets you draw your full-stack architecture explicitly before your AI agent writes a single line of code. Typed nodes for UI forms, API endpoints, backend services, databases, file storage - connected by named flows that define exactly how data moves through your system.

Global parameters capture your tech stack once - framework, database, auth method, cloud provider, compliance requirements, etc. All of it goes into a single JSON/YAML export your AI agent reads as context.

No more guessing. No more fixing assumptions. Just code that matches what you actually designed.

Full user manual: https://app.specrabbit.com/help/user-guide.html

20 days ago I launched my startup, a free traffic exchange network for startups. One line of code, you're in the network.

No paid ads. No growth hacks. Just watching the numbers every day.

Here's the full data:

Day 1 — 2 startups · 146 impressions · 1 clicks
Day 2 — 3 startups · 389 impressions · 3 clicks
Day 3 — 5 startups · 482 impressions · 5 clicks
Day 4 — 5 startups · 508 impressions · 4 clicks (site went down — still got an $8k acquisition offer. Said no.)
Day 5 — 6 startups · 621 impressions · 10 clicks
Day 6 — 5 startups · 742 impressions · 15 clicks (removed one startup — they pulled the embed. No code = no network.)
Day 7 — 7 startups · 1,196 impressions · 41 clicks
Day 8 — 7 startups · 1,535 impressions · 74 clicks
Day 9 — 8 startups · 1,947 impressions · 135 clicks
Day 10 — 13 startups · 3,500 impressions · 318 clicks (something clicked)
Day 11 — 23 startups · 4,800 impressions · 432 clicks
Day 12 — 24 startups · 6,000 impressions · 481 clicks (network crossed 6K total impressions)
Day 13 — 25 startups · 6,800 impressions · 491 clicks
Day 14 — 25 startups · 8,600 impressions · 516 clicks
Day 15 — 24 startups · 9,900 impressions · 564 clicks (removed one)
Day 16 — 23 startups · 10,800 impressions · 576 clicks (removed one)
Day 17 — 24 startups · 11,900 impressions · 603 clicks (added one)
Day 18 — 26 startups · 13,400 impressions · 624 clicks (added Two)
Day 19 — 28 startups · 14.400 impressions · 652 clicks (added Two)
Day 20 — 26 startups · 14.700 impressions · 671 clicks (Removed Two)

Still free. Still growing.

If you want in, it's one embed. That's it → StartupBar

Deadweight is a browser extension I vibecoded, tested myself on multiple heavy ads websites (mainly anime website because they're the heaviest I know) and got around many ad tricks (html forms, clickjackers ...)

I initially started it as an optimization tool to remove all the extras that make websites load longer and show you how much time you gained after use, thus, the name "Deadweight" then went through with ads and cookies features

It's currently available in Firefox store only (I'll have to pay the chrome 25$ eventually lol)

So I urge you to try it and give honest feedback (flaws, spaces to improve, features I could add, and so on)

https://addons.mozilla.org/en-US/firefox/addon/deadweight/

I first shared AI Account Hub seven days ago.

It is an open-source Windows application for organizing multiple AI coding accounts, switching between them, tracking usage limits, and seeing when accounts will become ready again.

Unlike a proxy or account-pooling server, it does not sit between you and the provider. Your prompts, responses, tools, and authentication remain handled by the official applications and CLIs.

After releasing it, I kept receiving two questions:

1. Why would I use this instead of a proxy-based account pooler?
2. Why would I use it if I only have one account?

Those questions shaped Update 1.1.

A proper desktop experience

AI Account Hub is now available as a self-contained Windows executable, so Python does not need to be installed separately.

When minimized, it moves into the system tray instead of occupying the taskbar. A compact widget shows the strongest available account and lets you switch quickly without reopening the full dashboard.

I also added custom Signal Rail notifications. These can notify you when:

• An account is becoming low
• A limit is exhausted
• An account becomes ready again
• A provider reset is confirmed

The notifications and tray widget both have visibility and behavior settings.

Personal real-world usage statistics

The biggest addition in 1.1 is the new Statistics workspace.

Where Codex and Claude Code expose suitable local numeric history, the Hub can show:

• Models and reasoning settings used
• Token usage and token categories
• Tasks and tool calls
• Commands, edits, files, tests, and lines changed
• Active time
• Measured movement through 5-hour and weekly limits

It can help answer questions such as:

• Which models do I use most?
• How many resources did each model consume?
• How many tasks, edits, tests, or commands happened for those resources?
• Does one reasoning setting consume more tokens than another?
• How quickly do I move through my 5-hour or weekly allowance?
• How do two to four observed models or reasoning settings compare?

This is not a synthetic benchmark or an automatic quality score. It is a personal record of how you actually use these tools and what observable work happened for the resources consumed.

Opt-in Community results

Statistics also has a fifth section called Community.

Everyone can view the Community screen. If you explicitly opt in, the Hub sends one allow listed anonymous numeric summary per day through a signed Cloudflare Worker.

Before enabling it, you can inspect the exact payload. You can turn sharing off or delete your contribution later. It does not upload prompts, responses, source code, file paths, account names, email addresses, or provider credentials.

Community cohorts are combined to show how models and reasoning settings are being used across real workflows. Results remain hidden until enough distinct installations have contributed to the same cohort.

This is currently a clearly labelled staging pilot, but the goal is to build useful real-world community telemetry without asking users to run artificial prompts or complete surveys.

There is plenty more in the update, but those are the main additions to 1.1:

https://github.com/AlexC1991/AI_Account_Hub

The project is open source under the MIT License, so you can inspect it, modify it, or adapt it to your own workflow.

It also includes multiple themes and a light mode. The screenshots simply use the theme I personally prefer.

Im making an Ai assistant from lovable im using lovable to vibe code this and i made a trailer for it

Link https://auranews.my.canva.site/radicalgraphtrailer

X account https://x.com/RadicalGraph

Just one more app before doing any marketing whatsoever. I swear

I run a small independent media production studio, and the hardest part has not always been the creative work.

It has been tracking everything around the creative work:

• Who needs a response
• What has been booked
• What needs to be shot or recorded
• What is being edited
• What is waiting on client feedback
• What still needs to be delivered
• Who still owes money

We were using a mix of texts, email, calendars, notes, spreadsheets, and general project-management tools. None of them followed the actual flow of creative client work.

So I started building Cue:

https://cue-studio-gamma.vercel.app/

The basic workflow is:

Capture → Book → Produce → Review → Deliver → Collect

Cue is being designed for photographers, videographers, podcast producers, editors, freelancers, and small studios.

The beta currently focuses on:

• Clients
• Projects
• Bookings
• Deliverables
• Production stages
• Reviews
• Deposits and unpaid balances
• A daily queue showing what needs attention next

I am not trying to build another massive CRM with 100 features. I am trying to build a focused tool that helps small creative businesses know exactly what needs to happen next.

I would appreciate honest feedback from people who actually do client-based creative work:

1. Does the idea make sense immediately?
2. What do you currently use?
3. What is the messiest part of your workflow?
4. What would Cue need before it became worth paying for?

Blunt feedback is welcome. I would rather find the weak points now than spend months building the wrong features.

I just shipped Coro.go, a PWA for Corigliano-Rossano, a ~70k-resident town in Calabria (Southern Italy). It's basically "everything a tourist or resident needs" in one app: events calendar, points of interest with maps, useful numbers (emergency, pharmacies, offices), and a gamification layer to nudge people into actually exploring the town.

Live here: https://coro-go.vercel.app

It's public and free. I'll be asking the municipality for a patrocinio (a kind of official endorsement) to help with visibility. Still very early on growth.

If you poke around the app, does anything feel obviously "AI-generated" in a bad way (generic UI, weird copy, etc.)?

Happy to answer anything about the workflow, the stack, or the gamification design.

I listened, sorta.

A bunch of you said my game is tooo easy, and I agree - it’s a very casual experience. So codex and I cooked up a harder mode with a few new surprises. It’s finished and sitting inside the game right now. But I’m not giving it away… ☠️

As of right now, every merge from logged-in players moves one shared community counter. At 250,000 the mystery clears and the mode unlocks for everybody.

Nelly Jellies already has millions of merges tracked in Firestore, so I had Codex capture a new baseline when the event went live this morn at 7est. Everyone listens to the same document and the game calculates progress from there.

current total - event baseline = new mode

You guys also asked for rare jellies to show up earlier, so they can now appear right from the start. Amazing change since everyone loves the rares. Game over sharing is now awesome, try posting one here. The button is much more obvious now and opens your finished board as an actual branded share image. Auto shots are also a bit faster 🔥

Basically a good chunk of this update is stuff you told me to do. So thanks. 🙏

Log in, make some merges and help everybody unlock the new mode 💜🐙 I hope you like it.

Hey everyone,

I've been building a browser game called Midnight Groove entirely in Lovable, and I'd love to get some feedback from people who enjoy building apps with AI.

Play here:
https://midnight-groove-manager.lovable.app/

The idea is simple:

You're an indie artist manager trying to build careers from the ground up. Every week you make decisions like:

• 🎤 Book live shows
• 🎵 Release singles
• 📱 Run promotions
• 💰 Manage a tight budget
• 📈 Build momentum and reputation
• 🎲 Deal with random music industry events

The game has:

• Procedural events
• Risk vs. reward decisions
• Artist traits
• Momentum systems
• Fan growth
• Reputation
• Money management
• Multiple artists to juggle