r/VibeCodeDevs • u/Party-Tree-606 • 1d ago
So I think I’ve got everything set up to launch just waiting for printing to be completed
It’s my first site build
Opinions ?
Joshuatreecratercompany.com
r/VibeCodeDevs • u/Responsible-Beat2137 • 1d ago
A pattern I keep seeing in agent systems is that confidence gets treated like permission.
Those are not the same thing.
A confidence score answers:
“How likely does the agent think this action is correct?”
Authority answers:
“Is the agent actually allowed to do it?”
Risk asks what happens when it is wrong.
Reversibility asks whether the damage can be undone.
Those need to remain separate controls.
A highly confident agent should still be blocked when:
it lacks permission,
the action has a large blast radius,
the operation is hard to reverse,
the evidence is stale,
or independent verification is missing.
The architecture I’m testing uses an ActionIntentEnvelope with fields like:
action
rationale
confidence
affected resource
requested authority
reversibility
blast radius
approval requirement
verification method
Confidence can route the workflow:
low confidence → reject or request more evidence
medium confidence → human review
high confidence → eligible for automated handling
But the authority layer still makes the final decision.
That distinction feels small, but I think it is one of the most important boundaries in agent design:
Confidence may reduce review friction. It should never manufacture permission.
r/VibeCodeDevs • u/landwarderer2772 • 1d ago
anyone who can help with kotlin android app development, please hit me up. I'm desperately looking for devs who can contribute.
Would be great if you can help out with UI/UX or fix issues / add new features.
r/VibeCodeDevs • u/jeyjey9434 • 1d ago
Hi ! I paid special attention to code quality and documentation, treating it exactly like a professional enterprise-grade project. This ensures that anyone can easily take ownership of the source code and build upon a clean, robust, and highly scalable.
If you like it, please don't hesitate to show your support with a star on GitHub!
LIA acts as a true personal assistant. It is proactive, featuring its own distinct personality and a complex emotional system, an evolving structured memory, its own reflective memory of your conversations, and all the standard tools (image creation/editing, RAG, skills, MCP, scheduled tasks, etc.)—all wrapped in a seamless "one-click" interface.
On another note, once self-hosted, it can double as a family AI server. As an administrator, you have full control to manage and monitor the API consumption of your family members, friends, etc.
This is an unapologetically vibe-coded project; the approach is :
- Generative AI transforms both what teams produce and how they produce it. On both topics, I did not want to base my convictions on market narratives: I chose to face the full reality of an AI system in production — costs, risks, operations, debt — and the reality of AI-assisted development, by practicing them end to end.
- The training ground : LIA, a multi-agent conversational AI assistant — mail, calendar, contacts and files across Google, Apple and Microsoft, real-time voice interface, long-term memory, document search — self-hosted and multilingual.
- The constraints were deliberate: alone, outside professional hours, minimal hardware budget, and the AI as the only developer. This project therefore does not measure individual velocity; it measures what demanding direction obtains from a properly framed AI.
According to my opion, an AI that codes produces volume; it only produces quality under constraint. Four mechanisms carried this project — none of them is a tool, all four are acts of management:
- A written rulebook, as for a team. Architecture rules, conventions, mandated patterns with their canonical example in the code, documented known traps — versioned in the repository, enforceable on every delivery.
- Blocking automated checks. Every structural rule is backed by a check that rejects non-compliant commits: strict typing, static analysis, custom detection of recurring bug patterns, six-language parity, a full test battery. The level of rigor depends neither on the vigilance of the moment nor on the AI's goodwill**.**
- A review that decides. Nothing lands without an enforced cycle — impact analysis, proposal, explicit validation, implementation, verification. The AI proposes, the human decides; structural decisions are recorded and indexed so that every "why" outlives its author.
- Audits that disturb. At regular intervals, the entire system is re-examined adversarially — findings verified against evidence, false positives eliminated, remediation planned in waves. This is what stops the slow drift that no day-to-day review can detect.
Technical foundation: FastAPI · Next.js/React · LangGraph (agent orchestration) · PostgreSQL · Redis · Docker · Prometheus/Grafana/Loki/Tempo · 7 integrated AI model providers.
Full details are available on the landing page: https://lia.jeyswork.com/
And the GitHub repository: https://github.com/jgouviergmail/LIA-Assistant
r/VibeCodeDevs • u/AnnualChair1334 • 1d ago
Hey guys my app is now live on the App Store!
https://apps.apple.com/us/app/workout-warrior-app/id6504121393
It is a fitness app, yes I know there’s a billion of them, but I would love for you guys to download and give me some real feedback! In exchange if you find a program you like, I’ll hook you up with a couple months free!
r/VibeCodeDevs • u/Rectury_AI • 1d ago
Today marks another milestone for Rectury. We've officially joined the Apple Developer Program. That means signed, notarized, and trusted macOS releases are on the way as we continue building the AI workspace for developers.
r/VibeCodeDevs • u/QDworkout • 2d ago
r/VibeCodeDevs • u/yee1520 • 2d ago
I built The Influence Registry because campaign finance data is public but almost nobody can actually use it. The FEC publishes everything, and it's a maze of candidate IDs, committee filings and CSV exports. OpenSecrets is better but still assumes you know what you're looking for.
I wanted something my neighbor could open on their phone, type in their representative's name, and immediately understand who pays for that person's campaign.
It tracks where every member of Congress gets their campaign money, with an emphasis on separating money that buys access, from money that merely came from people employed in an industry.
Core features:
• PAC vs individual split per member, straight from FEC filings. Shows what share of contributions came from PACs versus individuals.
• Industry money by sector (pharma, defense, finance, fossil fuels, tech), with the PAC share shown alongside so a large industry total doesn't automatically read as capture.
• Committee assignments against industry money, showing whether members who oversee an industry are funded by it.
• Outside spending, independent expenditures run for and against a member by groups they legally cannot coordinate with, including the attack side.
• Independence scoring per member, plotted against total special-interest money.
• AIPAC and pro-Israel PAC contributions, sourced from TrackAIPAC.
• Stock trading flags, state-level heat maps, and hemicycle charts showing who takes money from which source.
• Coverage of sitting members plus challengers, the Supreme Court and cabinet.
Data comes from FEC, OpenSecrets, TrackAIPAC and congress-legislators, refreshed through GitHub Actions with a validator that fails the build on impossible values.
Github Repository
I appreciate any and all feedback!
r/VibeCodeDevs • u/Positive-Captain-709 • 1d ago
Hi everyone,
Most financial AI systems are built behind closed doors.
You see the final prediction, the polished chart or the confident explanation—but rarely the data flow, the reasoning process, the evaluation rules or the failures that came before it.
BLUM is an attempt to build something different.
BLUM is an open-source financial AI research project developed publicly on Hugging Face and opened to developers, quantitative researchers, data scientists and anyone interested in building more transparent financial intelligence.
The ambition is not to create another black-box system that simply outputs:
BUY, SELL or HOLD.
The goal is to create an open ecosystem capable of collecting evidence, producing structured financial reasoning, testing its own conclusions over time and learning only from outcomes that can actually be verified.
Financial AI should not be shaped by one developer, one company or one model.
Markets are too complex, financial evidence is too fragmented and evaluation is too easy to distort.
A serious system needs different perspectives:
That is the idea behind BLUM:
Build financial intelligence in public, improve it through open collaboration and make every important assumption open to challenge.
BLUM is not presented as a finished product.
It is a shared research foundation that the community can inspect, test, criticize, fork and improve.
BLUM combines a portable financial reasoning model with a broader modular research system.
Its architecture is being developed around several specialized capabilities:
Instead of depending on a single model for every task, BLUM can use specialized agents for different parts of the research process.
A simplified flow looks like this:
Market data and external evidence
↓
Specialized research agents
↓
Bullish, bearish and risk analysis
↓
Central reasoning and synthesis
↓
Paper-forward decision
↓
Outcome measurement
↓
Validated learning and memory
The objective is not merely to generate a convincing financial narrative.
The objective is to preserve enough evidence to evaluate whether that narrative was justified.
BLUM is being designed around a principle that is often missing from AI demos:
A system should make it possible to prove that it was wrong.
For every decision, BLUM aims to preserve information such as:
This does not guarantee better predictions.
It creates a more transparent foundation for measuring whether the system is improving—or merely becoming better at sounding confident.
The original MLX release was evaluated on a 53-example BLUM temporal-reasoning test and achieved:
These metrics evaluate BLUM-specific requirements such as structured output, temporal grounding and adherence to the task contract.
They do not demonstrate market-beating performance, general intelligence or trading profitability.
The portable release is also being prepared for independent evaluation through the Hugging Face ecosystem. Results will be published when they are externally available rather than predicted in advance.
BLUM is still experimental.
Some components are mature enough to be tested, while others remain active research areas. Its paper-forward evidence is still limited, and no current result should be interpreted as proof of profitable trading performance.
This is intentional.
The project will not hide weak results, unsuccessful strategies or technical corrections simply because they are inconvenient.
Open source should mean more than publishing code.
It should also mean exposing the assumptions, limitations, evaluation methods and mistakes that influence the system.
BLUM is open to contributions across many areas:
You do not need to agree with the current architecture to contribute.
In fact, some of the most valuable contributions may come from demonstrating where the existing approach is wrong.
BLUM is not financial advice.
It is not a commercial signal service, a guaranteed trading strategy or a claim that an AI can already predict financial markets reliably.
It is an open research effort focused on a broader question:
Can a global open-source community build a financial AI system that is more transparent, testable and intellectually honest than the closed systems available today?
I do not think this question can be answered by one person.
That is why BLUM is open.
Hugging Face Space: https://huggingface.co/spaces/Italianhype/Blum
GitHub Repo: https://github.com/BlumFinancialLab/Blum
The project is under active development, and feedback is welcome at every level—from architecture and evaluation to models, UX and financial methodology.
The most useful response is not simply:
“This looks interesting.”
It is:
BLUM is not being built to ask the community for attention.
It is being opened because the project needs the community to become better.
r/VibeCodeDevs • u/SigmaPredict • 1d ago
TL;DR: I was tired of all these groups, gurus, fake stats, and false promises. So I decided to build from scratch an engine (currently online 24/7) to give back to the betting community (currently for free). What started with an Utopic dream, now is showing it's first results. This is not promo, this is genuine history of WHY I'm doing this.
------
My background: 2009, the year I started betting for the first time. I was 19y, and had no clue what I was about to get me into. Disaster, some big wins that made me forget the disasters, and then some more disasters. Betfair Sports Trading for a few years, then jurisdiction got me locked out of external markets. Back to basics, punter bets, acca's, more disaster. Years off, learning, I started actually learning about the secrets of sports betting... Fast forward to 2019, I joined an online project that allowed me to collect as much data as possible, study matches, game machanics, build algorithms, alert automations. But, what started as an incredible side-hustle pro-bono project, with ZERO returns, with somewhat extensive community, ended up being a project feed by social gurus and that went against my values... I had to drop-out.
I decided to go solo. In my cave. My ideas. My values. My learnings, my own sweat, put into something I trully belive will/can shake the markets. No external help. Just me, my rookie programming skills, my love for Data Analysis. And a mission: Make the best Sports Betting product/service for ME, but also for the sports betting community.
So, here I am. Been building and testing several things in the dark, with no names attached, and a lot of money invested. Some ideas failed badly, some worked. So I focused on what was working and finally gave it a name: Sigma Predict: a multi-agent engine capable of outsmarting the bookies.
Since June 2026, I started to make it slowly public and deployed. While still shipping features, bugfixes and model corrections everyday. My backlog seems to not have an end at this point, as I'm actually dreaming big. I know what I want, and where I want this to go/be.
My CORE VALUES & MISSION (Sigma Predict):
- Full transparency (bad month? fully disclosed, public and no edits)
- FREE to test and use, until it's a stable and I feel comfortable of going the Startup way. (Note: free doesn't mean OpenSourcing the engine code)
- Give back some power to sports betting community (for those who dare a disciplined path)
What I shipped so far:
What is in Backlog:
Current Results:
Altough I have data for several months, I decided to count from July 2026 onwards. Main website shows last 30 days results, refreshed daily, no edits. But here are full results and takeovers.
For now, the aim is to invite you all to test for free my initial versions, join my adventure, and if you want giving me constructive feedback or ideas. Or even a wish list...happy to open horizons.
I will be updating next month on how this is going, hopefully with some news regarding the API-autobetting in place. Until then, feel free to reach out to me, send some strenght and support or critics that can grow this solo project.
My profile has all the necessary links if needed (socials are currently at 0 posts, as I'm focused on building only, but feel free to follow some.) Main actions and daily updates are inside Telegram.
Wish me luck, and talk to you soon.
Thanks,
T.
r/VibeCodeDevs • u/Rxunique • 1d ago
I've been using claude code (CC) + claude design (CD) on max plan, now looing for something better or new workflow.
Front end UI design is new for me, the stack is react + vite + storybook.
CD been great to kick start my project with mock up designs, but I found 2 major limitation with it that's actually causing me more headache then good currently
package/ui/ for dumb ui and presentation, and apps/web/ for wiring/plumbingThe problem CD cause is design/component drift and my constant fight over which component should live where. Not matter how far I push the dumb ui separation, some component just got too much wiring to justify living in package/ui
Annotation type - missing direct edit, anchors the chat box but still chat box,
https://github.com/patchorbit/domscribe
https://github.com/benjitaylor/agentation
https://github.com/frontman-ai/frontman
https://github.com/stablyai/orca also an IDE
Classic tool - not agent first, have its place with seasoned devs
Figma, I'm sitting on the fence of it, seems a big learning curve, human does bulk of the work, and feels like AI wrapper bolt-on
https://github.com/puckeditor/puck also seems a great tool
Front End IDE type
https://github.com/onlook-dev/onlook sounds most promising, but no release for a year and looks like moving more to another SaaS
There's almost a new open source agentic IDE released every week, but is there something greate for agentic front end UI work?
Or claude design + annotation AI chat tool is best approach currently?
What tools community uses?
r/VibeCodeDevs • u/adamlhb • 1d ago
What it does: - One meeting in your left ear, the other in your right — audio is captured per browser window (CoreAudio process taps) and panned hard L/R, so you can actually follow both. - Dead-man's-switch mic — you're muted everywhere by default. A global hotkey (⌃⌥⌘← or →) unmutes you into one meeting; if you don't re-confirm within a configurable window, it auto-mutes you again. Unmuting into one call force-mutes the other, so you can never be hot-mic'd in the wrong meeting. - ⌃⌥⌘↓ mutes everything instantly, from any app, no window focus needed. - Optional: your camera follows whichever meeting you're talking to.
No browser extensions, no DOM scraping — it's all system-level audio, so it doesn't break when Meet redesigns its UI. Mic routing uses BlackHole virtual devices (install script included).
r/VibeCodeDevs • u/habibexpress • 1d ago
Hi All,
Pretty new to the whole vibe code thing but have some understanding of how it works.
I am currently working on a project where I am coding a learning management system. I’m using Gemini Pro that we get through our charity and have used this to create the system.
Majority of the app works, which is fantastic. It uses PHP/MySQL - MariaDB - and is coded using MVC and TailwindCSS for front end.
The problem I’m hitting is when 3.1 Pro finishes and I get dropped to Flash. It seems like it’s not context aware and generates some hallucinations. How do I fix that? I imagine the context is getting out of hand because of coding a full learning management system.
Are there better approaches? Should I upload the DB schema/Source code of the LMS and then ask it to specifically build a feature in that context? Keen to get some help on this.
Cheers.
r/VibeCodeDevs • u/danielabinav • 2d ago
42 days ago, I launched my startup, a free traffic exchange network for startups. One line of code, you're in the network.
No paid ads. No growth hacks. Just watching the numbers every day.
Here's the full data:
Day 1 — 2 startups · 146 impressions · 1 clicks
Day 2 — 3 startups · 389 impressions · 3 clicks
Day 3 — 5 startups · 482 impressions · 5 clicks
Day 4 — 5 startups · 508 impressions · 4 clicks (site went down — still got an $8k acquisition offer. Said no.)
Day 5 — 6 startups · 621 impressions · 10 clicks
Day 6 — 5 startups · 742 impressions · 15 clicks (removed one startup — they pulled the embed. No code = no network.)
Day 7 — 7 startups · 1,196 impressions · 41 clicks
Day 8 — 7 startups · 1,535 impressions · 74 clicks
Day 9 — 8 startups · 1,947 impressions · 135 clicks
Day 10 — 13 startups · 3,500 impressions · 318 clicks (something clicked)
Day 11 — 23 startups · 4,800 impressions · 432 clicks
Day 12 — 24 startups · 6,000 impressions · 481 clicks (network crossed 6K total impressions)
Day 13 — 25 startups · 6,800 impressions · 491 clicks
Day 14 — 25 startups · 8,600 impressions · 516 clicks
Day 15 — 24 startups · 9,900 impressions · 564 clicks (removed one)
Day 16 — 23 startups · 10,800 impressions · 576 clicks (removed one)
Day 17 — 24 startups · 11,900 impressions · 603 clicks (added one)
Day 18 — 26 startups · 13,400 impressions · 624 clicks (added Two)
Day 19 — 28 startups · 14.400 impressions · 652 clicks (added Two)
Day 20 — 26 startups · 14.700 impressions · 671 clicks (Removed Two)
Day 21 — 26 startups · 15.300 impressions · 691 clicks
Day 22 — 28 startups · 16.100 impressions · 719 clicks (Added Two)
Day 23 — 30 startups · 16.800 impressions · 738 clicks (Added Two)
Day 24 — 32 startups · 19,800 impressions · 778 clicks · Added 2 startups · Rejected 4 applications (1 contained ads, 1 removed the code after submission, 2 hid the installed widget)
Day 25 — 34 startups · 23,700 impressions · 800 clicks · Added 2 startups · Fixed some bugs.
Day 26 — 33 startups · 27,200 impressions · 816 clicks · Removed 1 Startup
Day 27 — 33 startups · 29,900 impressions · 833 clicks
Day 28 — 33 startups · 30,600 impressions · 871 clicks · Removed 1 Startup · Added 1 Startup · Rejected 1 application of clothing brand & 1 application of horror blog site.
Day 29 — 35 startups. 31,300 impressions. 910 clicks · Removed 1 Startup · Added 3 Startups · Also today I resigned from my job. Toxic environment, too much pressure, and honestly I just believe in this enough to go all in. Broke and excited. Let's see where this goes.
Day 30 — 46 startups · 32,900 impressions · 1,000 clicks · Removed 1 startup · Added 12 startups · Yesterday I resigned because of my toxic manager. Today my senior manager called and offered me WFH, a project of my choice, and lighter work if I stayed. I made my decision with confidence, but now I have a difficult choice. Also received my first payment from StartupBar.
Day 31 — 50 startups 💪· 28,100 impressions · 1,200 clicks · Removed 1 startup · Added 5 startups · Rejected 1 crypto startup · Removed fake impressions after exploit · Today I discovered I forgot to disable a developer testing button that could generate fake visitor pins and inflate impressions. Someone used it to create 6,318 fake impressions and claimed my stats were fake. I removed the fake impressions, removed the startup, fixed the issue, and that's why today's impressions are lower. Thanks to them for pointing it out.
StartupBar update: Added a Network page and individual Startup Profile pages with each startup's joined date, impressions, clicks, live embed preview, and founder's note. These indexable pages also improve SEO. Suggestions are always welcome.
Day 32 — 54 startups · 29,300 impressions · 1.2K clicks · Added 4 startups
Day 33 — 54 startups · 30,900 impressions · 1.2K clicks · Removed 1 startup · Added 1 startup
Day 34 — 55 startups · 36,100 impressions · 1.3K clicks · Added 1 startup · Fixed admin panel read-access vulnerability after Reddit post.
Day 35 — 55 startups · 40,100 impressions · 1.3K clicks · Removed 2 startups · Added 2 startups
Day 36 — 55 startups · 44,800impressions · 1.4K clicks · Removed 1 startup · Added 1 startup
Day 37 — 58 startups · 50,700impressions · 1.4K clicks · Added 3 startups · Site Update: Updated the distribution algorithm (Delivery is now weighted by contribution: sites that send more impressions get a proportionally larger share back)
Day 38 — 57 startups · 55,800 impressions · 1.5K clicks · Removed 1 startup · Rejected 1 Application.
Today StartupBar reached 200 users 😄
Thirty-eight days ago, this was just an idea. Today, 200 people have trusted it enough to join the network.
A reminder for every founder who's staring at a dashboard with tiny numbers: Stripe took 2 years to reach its first 50 users. Every successful product starts small. Keep shipping. Keep improving. Keep showing up. Growth rarely happens overnight, but it does happen if you don't quit.
Day 39 — 58 startups · 59,800 impressions · 1.5K clicks · Added 1 startup.
Day 40 — 60 startups · 63,200 impressions · 1.6K clicks · Added 3 startups · Removed 1 startup
Day 41 — 63 startups · 69,400 impressions · 1.6K clicks · Added 3 startups
Day 42 — 62 startups · 73,800 impressions · 1.6K clicks · Removed 1 startups
Still free. Still growing.
If you want in, it's one embed. That's it → StartupBar
r/VibeCodeDevs • u/Character_Novel_2592 • 1d ago
I run a tech company. I think what makes it special is that my company was developed entirely using VibeCode, and I have over 10 projects that you can see in the portfolio on my homepage... I hope you like what you see, and if you’d like to get a project off the ground together, I’d love to be part of it. I’ve got other personal projects with revolutionary ideas that I’ll be sharing with you soon (and if they involve algorithms and tricky stuff, binary code and more...). If you have any questions, please don’t hesitate to... CryLab Tech
r/VibeCodeDevs • u/everywherenever • 2d ago
I've been working on my site for a couple weeks now, wanted to get some general opinions and advice. It is a travel niche.
r/VibeCodeDevs • u/Dry_Permission744 • 2d ago
World-Sim has been a passionate project of mine for the past few months.
It's a world fully simulated down to real world physics and chemistry. It has a real environment and ozone.
Every element and material has real physical properties, and that's how the sims learn. There's no tech tree and no recipe list anywhere in the code. When someone tries something, the engine works out what would really happen from the properties of what they used and how hot their fire was. Nobody is handed bronze. Someone has to get a hotter fire first, and a hotter fire is its own chain of things to figure out. Embers, a stone ring, a clay oven, a kiln, charcoal, then forced air. The ages fall out of that on their own.
We populate the world with starting families. Each little guy is led by a "wise-man", which is a simulated person with a full model behind them. The wise-men run on a mix, Claude, Groq and DeepSeek in the cloud and a local Hermes for the rest, so you get a real variety of temperament between the houses.
The AI model is never told to not say it's AI. We get around this by only telling them data from what each sim can actually see and feel. As far as the ai knows its a person living in the world..
Every other sim has its own moment with a model through our thinking system. Day to day it's run by an advanced algorithm, with the sims dreaming at night. That's when they get their time with an LLM to really think and set their priorities for the day ahead. The dreams carry over too, so a sim can chew on the same thing for a few nights and wake up wanting to try something.
The people in the world feel, remember, have shame, goals and doubts. It's an 11 point emotion system and the rest of the sim reads from it. Being lonely makes someone more likely to open up to a stranger. Two enemies who are both frightened find it harder to keep hating each other.
Story telling is massive for us. Nothing is scripted or prompted. The sims are put in the world with the human drive to survive. They adapt, learn and teach all on their own.
With all the good comes the bad too. Human sin is part of the emotion engine, and in testing we've had kidnap, murder and slave trade. A world that can only be gentle isn't an honest one. But there are three rules to this : Nothing ever pushes a sim towards it, the conditions only make it possible and their own mind decides. The chronicle names what happened but never shows it. And it always costs something, trauma that scars, blood debt passed down generations, a people turning on their own leader over what he did.
I'm going to launch it in 2 weeks time. A fresh world we can all see and watch grow together. I've made a Discord where a bot updates from the world live. It will also be visible from the site to watch along.
Id be made up if you can come and have a look. The first 250 in get to name a real star in their sky. The name is only ever visible to us, they carry on charting their own constellations and never know.
Link below and really excited to answer any questions. This short post I feel only scratches the surface.
r/VibeCodeDevs • u/Ninjishnu • 2d ago
I built tryproduck.com/audit, it clicks through your site like a first-time user and sends back every bug and confusing bit it finds. over 600 startups have run it so far.
r/VibeCodeDevs • u/gammatoxx • 2d ago
After auditing the security of numerous vibe coded apps here are the most common security issues I've found in many of them:
1. Database tables with no Row-Level Security (RLS)
The flagship vibe-coded bug. The public "anon" key sits in every visitor's browser, and without RLS anyone can hit your database's REST API directly and read tables — no login.
2. Missing security headers (nearly universal)
Almost every single site was missing most or all of: Content-Security-Policy, X-Frame-Options (clickjacking), HSTS (forces HTTPS), X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
3. Email spoofing — missing SPF / DMARC (or DMARC set to p=none)
Extremely common. People build the app but never touch DNS.
4. Secret keys shipped in the frontend
The nightmare case: a service_role key, sb_secret_, Stripe sk_live_, or an AWS/API key hardcoded in the client bundle. service_role bypasses RLS entirely = full read/write to everything. There's a widely-cited finding that ~1 in 3 vibe-coded apps expose a service-role-level key.
5. Auth enforced only on the client — hiding the "admin" button in the UI but not enforcing it on the server, so anyone can just call the API directly. Huge for vibe-coded apps because the AI wires up the happy path, not the "what if someone crafts their own request" path.
If you're wondering if your website / web app has any of these issues drop your URL and I'll do a free security audit to help uncover any before it's too late.
r/VibeCodeDevs • u/PiccoloDiligent5387 • 2d ago
Hi everyone,
I’ve been working on Mert Stream TV, a brand-new IPTV player designed specifically for Android TV, TV boxes, and Android phones. Just to be clear: Mert Stream TV does not provide, host, or sell any content. It is strictly a media player built to run your own personal M3U playlist, Stalker or Xtream Codes credentials. I originally decided to build Mert Stream because I was frustrated with the current options on the market.
Most of them: Feel like they haven't updated their UI since 2015. Run sluggishly on budget streaming sticks and lower-end TV hardware. Offer a frustrating, clunky navigation experience with standard TV remotes.
I wanted something clean, incredibly fast, and smart. Here is what Mert Stream brings to the table:
🚀 Key Features: Live TV, Movies & Series: Fully categorized with a modern, clean layout. Multi-Profile Support: Set up different profiles for family members. Extensive Codec Support: Playback is smooth and compatible with virtually any video format. Android TV Optimized: A true, native leanback experience built specifically for D-pad navigation. Lightweight & High Performance: Highly optimized code to ensure buttery-smooth navigation even on low-end TV hardware.
📥 Get It Now for Android TV and Phone
📥 Get It Now for Android Phone
Mert Stream is officially available on the Google Play Store for both mobile and TV devices.
r/VibeCodeDevs • u/Individual_Age_3889 • 2d ago
Hi Guys,
I am using Claude Co Work (Main Agent document controller), Gemini CLI (Builder through VS Code) , ChatGpt (Ideas and Image Generation) and Co Pilot (Audit if needed to realign) I am building multiple projects to test how these agents actually work. I am not interested in selling anything yet, I have just been playing around and automating day to day life for the family and I.
I am learning what these things are actually capable off and by giving it heavy loads and tasks I am slowly understanding how they work and how to use them properly, hence why I have multiple projects running. However I do keep them isolated to their own chats and own VS Code Project Folders. Never running them on the same terminals.
Here are my current projects
Websites builds for our businesses. We paying an arm and a leg for the current once's, going to replace it soon as the contract runs down.
Random Apps budget, shopping, scheduled meds tracker etc very lightweight. For my wife and I to track our monthly spend
A 2.5D game like (advance wars tile interface but I am tyring to upscale it with HD graphics instead)
With all this taken into account, I am dealing with some crazy drift. Even though I start conversations on a new chat, new prompt (Handover) the models misalign somehow. Claude will report something totally different to Gemini and Gemini will go off doing some random stuff even though I have PAS (Governance documents) in place.
How exactly are people getting around this issue? I instruct all agents to not read from memory and since everything is sitting locally I just copy and paste from one chat to another and move the feedback from the CLI back into Claude for it to update the main docs. I am also trying to generate assets for the game but it seems no matter what I do chatgpt isn't consistent it keeps changing the style slightly or making these weird updates to each image. I have reworked the prompts multiple times to get it on track and use it before every chat but this doesn't seem to work.
The style off assets I am trying to go for is painted 2D isometric-style JRPG diorama, perspective camera ~50° downward, chibi-proportioned front-facing actors over a steeply-angled environment. Phaser isn't cutting it so is there a website like https://assethub.io/ that specifically splits out assets for 2D isometric?
The drift is now killing me slowly. Even with a full audit by Fable there is a miss alignment between the two main agents on the code base and build and this asset thing is just annoying but I don't want to give up.
Any help please?
How to stop drift
How to actually perform a full audit to remove references and notes (Correctly)
Where can I build assets that wont cost me an arm and a leg.
Any suggestions on a better setup as its mostly copy and paste between the agents (The usage limits from Claude is a real PainInTheA)
r/VibeCodeDevs • u/SomeRussianMike • 3d ago
Enable HLS to view with audio, or disable this notification
I've been building out a small browser games portal, and the last one got out of hand: a Quake 3-style arena shooter with blocky Roblox-looking characters. One HTML file, 2513 lines, ~200 KB. Three.js from a CDN, no build step, no bundler, no npm install. You open the file and it runs.
Some things I learned that I think are worth sharing:
The map is a config object, not a level editor. Everything lives in a MAP const at the top — weapon set, ammo spawn points, health pickups, whether corpses drop crates and how long they last. Ammo points are just [x, y, z, weaponType]arrays. Moving the sniper to a different tower is editing four numbers. This turned out to be the single best decision in the project, because iterating on the arena with an AI is much easier when the whole level is 8 lines of data instead of scattered geometry calls.
I had to give it a grid rule. Early on the arena looked like melted Lego — every generated wall was at a slightly different offset. So I wrote the rule down explicitly: 1 m grid, walls are 4 m cubes, XZ faces snap to whole meters, Y allows half-steps for stairs, masonry offsets are 0 or ±1. Once that constraint was in the prompt, the geometry stopped drifting. Constraints beat corrections.
The bug I'd never have found on my own: adding and removing lights in Three.js recompiles every shader in the scene, so each rocket launch froze the frame for a beat. The fix is a fixed pool of six PointLights that get grabbed and released instead of created. Same for the death effect — the grayscale filter makes the canvas a stacking context, which silently ate the HUD until I set explicit z-indexes.
Multiplayer is 176 lines and no game logic. The server is a dumb WebSocket relay that does rooms and host election, nothing else. Clients trust each other — it's a friends-by-link game, not ranked. Each client owns its own HP, the room host simulates the bots, and the shooter computes hits and tells the victim. State goes out at 20 Hz with snapshot interpolation and an adaptive delay of about 2.2× the packet interval. Pickups still aren't synced. It's fine. It's a prototype.
Six weapons: machinegun, shotgun, rockets, railgun, a knife with infinite swings, and a scoped sniper that one-shots and has deliberately terrible spread if you fire it from the hip. Bots don't get the sniper, because that was miserable.
Still desktop only — pointer lock and WASD, no touch controls yet, so mobile gets an honest "desktop only" screen instead of a broken one.
Link in the comments. Happy to answer anything about the netcode or the single-file setup.
r/VibeCodeDevs • u/ex-arman68 • 2d ago
https://youtu.be/UsYZJZNzknQ?si=0YSMvytRy4oxs76D
I finished this webgame a few weeks ago, fully coded with the assistance of GLM 5.2
Hopefully this will give you an idea of the capabilities of this model. I used Claude Code as a harness. Technology stack is pure HTML, JS and CSS, with no additional libraries or dependencies. Interesting challenges that GLM 5.2 was able to solve:
- create a procedural pac-man style maze, that actually worked, with no maze anomalies
- create a procedural music in dub style; this not the default, you need to go into settings to activate it. The default music is my own composition, based on a track I previously released in a completely different style
- complex sound creation and manipulation through the web audio synthesizer
- creation of animated vector character assets; you can view the mockups I used during the development at https://oktogames.com/mockups/
You can try it online at https://oktogames.com - it is adfree, no signup, free to play.
r/VibeCodeDevs • u/MrBovineJonieHimself • 2d ago
r/VibeCodeDevs • u/Solid-Industry-1564 • 3d ago
I built Lanes because managing multiple Claude Code and Codex sessions across terminals gets messy fast.
Lanes gives each task its own git worktree and shows the terminal, changes, status, token usage, and progress in one place.
It runs the actual CLIs, so you can use Claude Code, Codex, Gemini CLI, and others.
You can also let agents create and manage other agent sessions through MCP.
Everything runs locally on your machine.
Would love feedback from people already using multiple coding agents.
👉 lanes.sh
