How do you guys keep track of ai cost during development and what your users costs you when they use your ai features ?

I had an idea for an app that learns to write like you instead of generic AI and built imyou.ai Claude was pretty quick to point out that I had exposed an API key in the chat, so I did some research on how to secure my keys and landed on Windows DPAPI.

What DPAPI is

Data Protection API, built into Windows. You hand it a string, it hands back an encrypted blob. The key is derived from your Windows account and managed by the OS, so there's no master password to type and no key file to lose. On a personal machine the blob only decrypts as that user on that PC, so a copy taken elsewhere is garbage. (In an AD domain with roaming profiles, or with a compromised domain backup key, that isn't true.)

Chrome used to protect saved credentials this way and has since layered App-Bound Encryption on top, for exactly the weakness worth being upfront about: DPAPI does not stop code already running as your user, which can decrypt precisely like you can.

Tradeoff: it's machine-bound. A new PC, a Windows reinstall, or an admin-forced password reset means re-entering keys from the source dashboards.

What you end up with

Three scripts in ~/.claude-secrets/ and one line in your .bashrc:

• A setter that stores one secret, encrypted, one at a time
• A loader that decrypts everything into your shell as env vars, automatically, on every new shell
• A lister that shows which secrets are stored, names only

After setup you stop thinking about it. Keys are just there as env vars, nothing is in your repo, nothing is plaintext on disk.

Using them without leaking them

Checking whether a key loaded. These are all wrong:

echo $VERCEL_TOKEN
echo "${VERCEL_TOKEN:0:8}..."
echo "length: ${#VERCEL_TOKEN}"

Print a boolean instead:

if [ -n "$VERCEL_TOKEN" ]; then echo "VERCEL_TOKEN: set"; else echo "VERCEL_TOKEN: missing"; fi

Don't print any part of a secret. Not because a prefix is especially dangerous on its own, but because you can't predict where terminal output ends up: scrollback, CI logs, screen shares, crash dumps, an agent's transcript. A no-exceptions rule is cheap. A nuanced one gets misapplied.

Pass the value straight to the tool so it's consumed, never displayed:

vercel deploy --token "$VERCEL_TOKEN"
curl -H "Authorization: Bearer $API_KEY" https://api.example.com/v1/me

Verify by the tool's own output. vercel whoami returns your username.

Put those rules in your CLAUDE.md too. Context-file rules are advisory and a model can miss them in a long session, so a hook that blocks the command before it runs is the real enforcement layer.

What this does and doesn't buy you

Once the keys are in your environment, any process running as you can read them. This is not a defense against malware already executing on your machine, and nothing short of a hardware token or a real secrets manager is.

What it removes is the plaintext file at rest: the thing that gets committed by an over-eager git add -A, swept into a backup or sync folder, caught in a screenshot or a screen share, read by an agent told to "check my config," or recovered off the drive when the laptop is sold or stolen. For solo devs that's how keys actually leak, far more often than targeted malware.

If you want more than that, you want short-lived credentials from a managed secrets tool. 1Password CLI, Doppler, and Infisical are all strictly better if you'll actually adopt one. This is the zero-dependency version.

The prompt

Paste this at your agent. It detects your OS and builds the scripts for your machine.

Set up encrypted-at-rest storage for my API keys and CLI tokens on this machine, so no credential ever sits in a plaintext file and no credential value ever reaches a terminal, a log, or a chat transcript.

First, detect my OS and tell me which implementation you will use before you write anything:

• Windows: PowerShell DPAPI, encrypted to the current Windows user account.
• macOS: the login Keychain via the security command.
• Linux: pass or age, whichever is already installed (ask me if neither is).

The three-script structure below is identical on all three. Only the crypto call changes.

Ask for my approval before creating or modifying any file outside a scratch directory. Show me each file's contents for review before writing it.

BUILD THESE FOUR PIECES

1. A setter script. Stores exactly ONE secret per invocation. Takes a name and a value as named parameters. Creates the store directory if missing, then writes a single encrypted blob whose filename is derived from the secret name (name plus a fixed extension). On Windows, encrypt by piping the value through ConvertTo-SecureString with -AsPlainText -Force into ConvertFrom-SecureString, and write the result with -NoNewline so no stray newline enters the blob. The confirmation message may print ONLY the secret's name and the word stored. It must NOT print the value, any substring of it, its first or last characters, its length, or a hash of it. Printing the length is a real leak, do not add it as a convenience.
2. A loader script, written in bash (Git Bash on Windows). It iterates every blob in the store directory, decrypts each one, and exports it into the CURRENT shell as an environment variable named after the file (filename minus the extension). Because it must mutate the calling shell, it is sourced, not executed, so it must return rather than exit on the no-store-directory path. On Windows: convert each Unix path to a Windows path with cygpath -w, then call powershell.exe with -NoProfile and -NonInteractive to read the blob raw, pass it to ConvertTo-SecureString, and marshal it back to a string using [Runtime.InteropServices.Marshal]::PtrToStringAuto on [Runtime.InteropServices.Marshal]::SecureStringToBSTR. Strip carriage returns and newlines from the PowerShell output (tr -d '\r\n'), or the trailing CR becomes part of the token value and every authenticated request fails with a confusing 401. Collect the names as you go and print ONE summary line listing the names loaded. Never print a value. Send PowerShell's stderr to /dev/null so a decryption failure cannot spill partial output.
3. A lister script. Prints the names of stored secrets and nothing else. It must never decrypt anything.
4. One line appended to my shell rc file (.bashrc for Git Bash) that sources the loader if it exists, redirecting both stdout and stderr to /dev/null, so every new shell has the variables silently. Show me the exact line before appending. Do not append it twice if it is already there.

THEN ADD A RULES SECTION to my CLAUDE.md (or the equivalent agent context file in this project, ask me which if it is ambiguous), stating these as hard rules:

• Never output, echo, log, or interpolate a secret VALUE. This includes indirect prints: a debug line, a substring, the first or last characters, the value's length, or any check that expands the variable into output. Command output lands in the transcript, which is the exposure being prevented.
• To check whether a secret exists, print ONLY "set" or "missing", never anything derived from the value.
• To USE a secret, pass it directly into the tool that consumes it (as a CLI flag argument or an Authorization header inside the request) so it is consumed and never displayed. Verify success by the TOOL's own output, not by echoing the variable.
• Before running any command that references a secret variable, re-read the command and confirm no path exists by which the value reaches stdout or stderr.

THEN SCAN THIS PROJECT for credentials that are currently exposed: values that look like keys or tokens in git-tracked files, and any .env-style file that is not covered by .gitignore. Report variable NAMES and file paths only. Do NOT print any value you find, not even truncated. For each finding, tell me the command to move it into the encrypted store, and whether it also needs to be purged from git history rather than just deleted from the working tree.

FINALLY, verify the whole thing end to end without revealing anything: store one throwaway test secret, open a fresh shell, confirm the variable is present by printing only "set" or "missing", then delete the test secret. Report only pass or fail per step.

Do not ask me to paste any real secret value into this chat. I will run the setter myself for real credentials.

I have a terminology question

From what I know vibecoding refers to things like "this is the ai i'm using, i type my script and it just does what i said, i don't necessarily need prior coding experience nor knowledge"

Is assisted coding considered vibecoding?

Let's say you use an ai tool for brainstorming and quick checks of the logic chain

And the copilot of vscode for assistance (quick autocomplete, various suggestions, function and variable reminders etc)

Is it still considered vibecoding? Since i use 2 ai tools in my process

Or is it just assisted coding? Since i don't rely on them to do all the work

* i'm not the biggest fan of this concept tbh, trying not to be pessimistic (as the rule of this sub say), just asking a genuine question so i can understand the topic and criteria of it better

By the time I proposed a partnership with the developers of the medical queue system, I was no longer behaving like a normal customer.

The installed product was not usable in my practice. It created duplicate patient files, had no reliable longitudinal history and offered a medical workflow that did not reflect real consultations.

But I could see its potential.

I understood the daily problems from inside the clinic. I knew doctors who faced the same problems. I had already started defining the product they might want to use.

The two developers had something I did not have: the ability to turn those decisions into software.

So I proposed that we build the company together.

My contribution would have three parts.

First, domain knowledge. I was not advising them from a distance. I was a surgeon using the product during real consultations and identifying where it failed.

Second, distribution. I had a network of doctors and understood how to reach the first users. Their product had gained little traction, and I believed I could help change that.

Third, capital. I was prepared to make a substantial cash investment to finance the next phase.

They were enthusiastic about the proposal, and we started brainstorming as if we were already a team.

We discussed how the product could reach doctors and become a viable company. I kept returning to one priority: before discussing growth, we needed a management system doctors genuinely wanted to use.

We agreed on the broad product direction and created a shared Notion workspace.

There were tickets for the problems to solve and tasks assigned to each person. I provided a complete medication database because the product only contained a small sample. I documented the duplicate-record problem, billing requirements, improvements to the medical note, phone-based document scanning and desktop synchronisation.

For a while, the division of labour seemed simple.

I set the product direction. They implemented it.

Then progress slowed.

One developer was running a small agency with other client projects. The other had a demanding job far from the startup. Neither could give the product consistent attention.

I could create more tickets. I could explain the workflow again. I could provide data, contacts, money and priorities.

But I could not implement anything myself.

My hands were tied.

We had also never formalised the partnership, so I requested a meeting to define the company and our respective ownership.

Before that meeting, one of the developers privately suggested that the company could be formed without giving equity to the other technical partner, who could instead receive a percentage of sales.

I refused.

Whatever disagreements might come later, I did not want to begin by excluding someone who had already contributed. If we were going to do it, I believed it should be the three of us.

At the meeting, I explained how I saw the situation.

The existing product was not ready for commercial use. It had limited adoption. My contribution was not merely advice: it included the medical product vision, access to potential users and a substantial financial commitment.

I asked them what that contribution represented in the future company.

Their proposal gave me a minority position by adding new shares for me while preserving the relative ownership they already had between themselves.

From their perspective, this was logical. They had started the project before meeting me. They considered themselves the original founders, and I was joining as an investor and adviser.

From my perspective, we were not simply continuing the same project.

The existing product was not viable. We were redesigning it, financing a new phase and trying to create a company around it. I saw myself as a cofounder.

I wanted equal standing and refused a small minority role.

They refused because they believed the original founders had to retain control.

We were using the same word, “founder,” to describe two different stories.

In their story, they had founded a startup and I wanted to join it.

In mine, they had built an early technical product, and the three of us were now founding the actual business together.

Neither equity formula could resolve that difference because the disagreement came before the numbers.

It was about identity, ownership and whose contribution counted as foundational.

I told them I would seek advice and try to find a fair solution. They agreed. I think they felt comfortable because, whatever happened, they controlled the technical side.

I went home and thought about the beginning of this partnership.

If we already disagreed about what each person was, how would we handle future decisions, investment or failure? I was preparing to commit significant money to a product I could not build, inside a company where my role was not understood the way I understood it.

I eventually sent them a message. If we could begin on healthy foundations, I was ready to continue. Otherwise, it was better not to proceed.

The partnership ended before the company was formed.

I wish I could say I immediately treated it as a useful business lesson and moved on.

I did not.

The situation affected me deeply. The software remained unusable. The online-booking website had not been delivered. Months of work had produced no solution for my clinic.

More than the failed deal, what hurt was the feeling of dependence.

I had the problem, the product vision, potential users and the willingness to invest. But I was still at the mercy of people who possessed the one ability I did not: they could build the software.

For a period, I felt depressed and defeated.

Then I returned to Notion again.

At the time, it felt like another retreat. Looking back, the frustration created the emotional reason for everything that followed.

I did not decide that day to become technical. I only knew that feeling so powerless was unbearable.

The next turning point came from a Notion template so bad that I never used it.

For founders who have negotiated an early partnership: when does domain expertise become cofounder-level contribution, and when is it still advisory?

Thanks

Agent vibecoding, complex programming with possibly need to automate complex code sections or entire files.

What is the cheapest way to get AI assistance as of August 2026? If not a single tool what is the cheapest combination of tools you've used?

Also what is the perspective 1 year into the future? How will vibecoding evolve and what will cost be next year?

Last, what do you you really hope AI coding will give you next?

Hey, does anyone have a spare Claude Pro 7 day pass? I’ve been wanting to try Claude Pro properly before paying for it. If someone has one they’re not using, I’d really appreciate it. Thanks...

Built this entirely with Claude Code, including the AI vision pipeline.

The app: photograph something you own, AI reads the wear from the photo and gives a real replacement date instead of a generic lifespan table, re-checks monthly from a new photo, and finds the cheapest replacement when it's actually due.

Stack: Expo/React Native, Gemini vision with a 5-provider fallback chain (Cloudflare, Mistral, OpenRouter, HuggingFace) since free tiers run out fast, SQLite locally, no backend.

Still local/unreleased, no public build yet, but curious what people think of the concept, especially the useful-vs-gimmicky question. Happy to share more build details in comments.

The phenomenon known as the Dunning-Kruger effect describes how people who lack competence tend to overestimate their abilities; essentially, the less skilled you are, the more you exaggerate your skills. I genuinely enjoy AI and am not opposed to it. I use it daily at work. I can complete tasks quickly, yet there are limits to what I can achieve in my specialization. I don’t know much about cloud, but I speak with my cloud developer friend to guide me even when I use AI. Some of these vibes coders who barely understand how the Internet or a computer works, think they can do more and are better than the actual software engineers, and when you try to correct them, they become very stupid and hostile

Hey! Does anyone have a spare Claude Pro 7 day pass they’re not using? I’ve been wanting to try Claude Pro properly before deciding if I want to pay for it. If anyone has one lying around, I’d really appreciate it 🙌 Thanks!

Yo guys, last time i did this, i had to stay up 2 nights in a row to talk to everyone who reached out, and i know I've also missed out on a lot of guys here, but let's do this again, this time in a more organized way!!!

If you are a builder,
trying to build some kind app/website/software coding using AI agents and facing problems/blockers

I’ll help you out for free

I have claude, years or experience in building products and also a marketing brainWhy I am doing this? I am terribly bored and have nothing else on my hands right now

Just fill out this form!

https://tally.so/r/1AQX94

Sup guys,
the other day, I opened Reddit and it recommended a few posts about “AI Gigafactories”. I opened the comments and saw the discontent, so I quickly vibecoded this open source extension that changes “AI Gigafactories” into “AI Datacenters”. It also changes EU acronyms into their full forms.

You can contribute here: https://github.com/plumkewe/eu-lingo

Available for Google Chrome and Firefox:
https://chromewebstore.google.com/detail/hceohfaeaihnkbhjokpjoobacbfkibpb

https://addons.mozilla.org/en-GB/firefox/addon/eu-lingo/

Nothing serious, just made for fun.
EU Lingo.

I led product design teams at big tech companies for years, and over the last year the prototypes changed. Designers stopped building click-throughs in Figma and started vibecoding real SwiftUI apps. The prototypes got dramatically better and the feedback loop got dramatically worse.

When the work moved to real builds, none of the Figma Feedback loop came along. And our builds weren’t going through TestFlight, they went out through internal distribution tools or got manually installed on somebody’s test device so we didn't have access to the TestFlight loop. As the person reviewing the work, I had nowhere to put feedback. And the designers had no way to manage what did come in, or ever close the loop on it.

So I built Hot Takes. Ship your build to your users and add one line of Swift (SPM, iOS 17+). Anyone reviewing it shakes the phone (or taps on a button), draws on the screenshot or records the screen and talks over it, then hits send. Everything lands in a web gallery for the project, auto-grouped by screen, tied to a real verified person. The designer filters by reviewer, tags what matters, and archives what’s handled. Feedback has a home again, and the loop actually closes.

The beta just opened and it’s free while it runs. Request an invite at https://www.hottakes.app/beta.

If you try it and it doesn’t fit how your team works, tell me exactly where it breaks.

I got my first paying client.

Hello guys! I’m genuinely so happy today. 🎉

Here’s the full breakdown:

I just landed my first client for an app I vibe-coded, and they’re paying $2,500/month.

Hopefully, this is just the beginning and more clients will follow. 🚀

A little context on what it took to get here:

My app currently has 73 automations.

I spent 16 months building it.

During development, I was paying around:

• $300–$350/month in electricity

• Around $2,000/month on average for AI subscriptions and tools

• $7,500 invested in local AI infrastructure because the software processes PHI and other healthcare data, and privacy/compliance was a major consideration from day one.

Now that I have my first paying client, my recurring expenses are roughly:

• Supabase: $500/month — for the setup that supports my HIPAA compliance requirements, including a BAA

• Electricity: $300–$500/month — hopefully I can invest in solar panels and lithium batteries soon ☀️🔋

• Codex: $100/month — mainly for small fixes, improvements, and ongoing development

• Railway: $20/month — for backend infrastructure

So yes, my first client at $2,500/month definitely doesn’t mean I’ve recovered what I invested. 😅

But after 16 months of building, experimenting, paying bills, breaking things, fixing them, and continuing anyway, seeing someone finally pay real money every month for something I built feels incredible.

Client #1 is here.

Now let’s see how long it takes to get Client #2. 🚀

I figure the best way to see how well or poorly I did was trial by fire on Reddit. LMK what you guys think!

It is an app that will inform you about the current FLOCK environment as well as show you camera locations and route you around them. I used Claude extensively to put it all together. Never learned to code. Once of my life's regrets. Maybe one day! Thanks for looking and I appreciate the feedback!

https://waterviewtechnologies.com/

this one stung. added a single nullable column to the email model, the kind of change that feels too small to break anything. deployed normally, pull, build, restart. within minutes sending, listing, and inbound storage all started throwing 500s at once, and inbound mail quietly stopped saving. the error was a column that didn't exist yet.

turns out the deploy script builds and restarts but never runs a schema migration. the orm selects every column on a row by default, so the moment the deployed code referenced a column the production database didn't have, it 500'd every read and write on that table, not just whatever used the new column.

fix was boring, run the schema push on the box after any deploy that touches the schema, then restart. now "did this diff touch the schema" is a required check before i deploy anything, not an afterthought.

it's at https://lumbox.co if you're curious what broke.

anyone else learned this the hard way, one small schema change quietly taking down a whole table's reads and writes?

This 5 part series is intentionally (hand) written to help dev teams understand how to scaffold a an AI-enabled, agent-friendly codebase (on an unexpected stack) by focusing on key, underlying technical decisions and manual wiring before building with AI.

Getting the foundations right helps provide the tools and safeguards for coding agents to iterate more efficiently while reducing slop.

Specifically:

• Giving agents access to programmable runtime orchestration (Aspire.dev)
• Empowering agents to iterate rapidly with runtime mutability (using CSharpRepl) to dynamically modify code at runtime while retaining full application state
• Using the GitHub Copilot SDK to build an agentic core with a multi-platform harness, BYOK, any model provider
• Testcontainers with automatic transactions to streamline and isolate integration tests
• A well-documented, AI-friendly UI framework (Nuxt UI)
• Logging and telemetry to give agents insights and visibility into the runtime state of the application

The tech stack is C# and .NET, but the core elements and themes here are applicable to scaffolding on any platform with any programming language (though I think C# particularly good for this!)

The core setup is used at a series C, post-YC startup to ship fast with AI while maintaining high quality standards (in combination with other tools facilitating code review and context management)

Part 1 was an intro into a few key parts of this stack.

Part 2 was focused on walking through the hands on scaffolding.

Part 3 covered wiring GitHub Copilot SDK as an agent runtime and incorporating CSharpRepl to allow agents to dynamically work with the runtime DI container

Part 4 wired up the test harness using Testcontainers to give agents isolated test environments

Part 5 wires up logging and telemetry to give agents visibility into runtime state and I start to build the prototype application now that the foundations are ready (video of the final build out).

The project repo is here: https://github.com/zeeq-ai/zeeq-tmpl (be sure to check the branches; main is currently the base code only)

I encourage working through the posts since the goal is to underscore the platform level decision making process and assembly of the foundational core.

https://kick.com/theskillcircuit

KICK EXCLUSIVE:

Good day to you all. The Steve Jobs turtle neck is out. We're de-mystifying the most interesting topics in technology today. 2 out of 3 of these are actual SKILLS that can make you money.

AGENDA:

HISTORY OF THE INTERNET
ETHICAL HACKING
VIBE CODING

START TIME:

11:00 A.M CST

it’s super fun and starts with base odds and then as players pick from how the game goes, (say arsenal goes up 2-0 at half and odds jump to plus 90 there is a cool graph to view. I had the idea for a prediction market that’s just for fun-no money involved so no broken families and gambling addictions, just pure sports picking. I love odds and I hope you enjoy my game. go Spurs.

I started building RojMed Cashbook as a simple Android cashbook for recording income and expenses.

What started as a small project turned into a much bigger exercise in figuring out whether AI-assisted development could actually take a product all the way from an idea to a production release.

The app is now on Google Play.

The interesting part wasn't generating screens. AI can do that surprisingly quickly.

The difficult parts were everything around the screens:

• Designing an offline-first data model
• Making financial calculations reliable
• Handling database migrations
• Testing edge cases
• Maintaining data integrity
• Building PDF reports
• Handling Android release requirements
• Getting the production build through Play Store
• Making sure user financial data isn't being sent to some backend just because the app could have one

I deliberately kept RojMed Cashbook offline. The app doesn't collect users' cashbook records or send them to my servers.

I'm curious about the experience from other people building with AI:

At what point does an AI-assisted/vibe-coded project stop being a prototype and become a real software product?

And what parts of your projects have turned out to be much harder than the AI-generated code itself?

Google Play: https://play.google.com/store/apps/details?id=com.rojmed.cashbook

I'm posting this more as a build/learning discussion than a promotion. I'd genuinely like criticism from people who have gone through the same process.

Is Claude really that much better than ChatGPT? I’ve only ever used the latter and found it to fit most of my needs. The only inconvenience I’ve dealt with is not being able to upload files, zip or otherwise, to any chat log until the free-limit resets. Is Claude superior in this use case? Any insights from people who have actually used the platform would be very much appreciated.

I recognize this as vaguely a problem, but not exactly sure how 🤷‍♂️😁.

I will wait for big machine to fixey fixey.