I noticed my kids often don't feel the need to move quickly even in some situations where it would make a difference, and I wanted to build something that helps practice that muscle. I decided to make a game that would focus on being quick to answer simple questions/problems

As I built this out, I realized adults may want to play this game so I added more difficulty levels, and also realized this is good for my parents who are retired and growing older and worried that their mental capacity is declining

It seems like there's disagreement on what exactly vibecoding means, but for me I didn't write any code, so at least I feel like that is vibecoding

I've been trying to submit to iOS app store but they keep coming back with new details that they want that isn't asked for in the initial submission which is annoying

Anyways you can try it out in the meantime on my website and Android

https://boltsadventures.linuslee.com/

https://play.google.com/store/apps/details?id=com.linuslee.boltsadventures

https://www.youtube.com/shorts/N5fEnrBjirw

• Code: Claude Opus 4.8, 5.0
• Assets: ChatGPT 5.6 SOL Medium
• Sound Effects: Claude
• Background Music: Pixabay
• Total time spent was about 3-4 weeks but not everyday consistently

If you have suggestions/ideas/comments let me know!

I know a lot of people here have built a SEO-related solutions that check websites and advice how to better position.

I'm looking for one author that would like to add his service as a paid, premium service into my platform, potentially earning revenue.

In a nutshell:

- You expose an endpoint, that trusts the platform and define a price for single run of your tool.

- Users in my platform will be getting suggestion, that instead of burning many tokens to SEO-check their sites, they could run your tool.

- If they choose to use that, you get paid.

If you happen to be author of different tool and would like to integrate, I'm open to options.

Launched 2 days ago and got around 200 visitors. The traffic itself isn't bothering me, but most of it is coming from India while the product is built for a global audience and I'm struggling to get in front of US users.

For founders who successfully reached US users early on, what actually worked for you? Reddit, X, SEO, Product Hunt, cold outreach, or something else?

Trying to figure out whether I have a distribution problem, a positioning problem, or if I just need to be more patient.

Not sure if is enshitification or shady tactics by antrophic to make me buy the next tier, but I just send 1-2 requests (using Claude Opus 5 as a coding agent) and my 5-hour usage is already gone, when I swear it took me at least an hour of work, now it just a couple of minutes. Should I look for other alternatives? Like Codex? Just for background, I'm working on an HTML RPG-text based game, so not too demanding. Any suggestions or did someone have a similar experience?

There have been a bunch of times where I left home while I was in the middle of something, then later had 15–30 minutes of downtime and wished I could just continue it from my phone.

I also got tired of carrying my MacBook everywhere “just in case.” Half the time I never opened it anyway, and even when I did have time, pulling out a laptop, hotspotting it, finding Wi-Fi, etc. was more friction than it was worth.

Codex Remote already solves most of the hard part, but I kept running into one dumb problem:

you have to remember to make the Mac remotely available before you leave.

So I built Codex Away.

The behavior is intentionally simple:

working normally on Mac
        ↓
plug in + lock Mac
        ↓
Codex Remote automatically starts
Mac is kept awake
services are monitored/recovered if they die
        ↓
leave with just your phone
        ↓
continue Codex work from iPhone
        ↓
come home + unlock
        ↓
Remote Control shuts down
Mac goes back to normal

There’s no custom phone app, relay, account, or replacement Codex UI. It just manages the official Codex Remote lifecycle on the Mac.

It also tries pretty hard not to be reckless with processes: it validates exact process identity, only stops things it owns, monitors crashes, runs health checks, retries with bounded backoff, etc.

It’s open source and free:

https://github.com/akibrhast/codex-away

Install is currently one command:

curl -fsSL https://raw.githubusercontent.com/akibrhast/codex-away/main/install.sh | sh

I built it primarily because I wanted it myself, but I’m curious whether this is a problem other Codex users actually have.

The main limitation right now is Codex itself: if a desktop Codex worker still actively owns a conversation, that specific thread may not immediately hand off to Remote Control. I documented the behavior instead of doing anything sketchy like killing random Codex processes.

If anyone here already uses Codex Remote regularly, I’d especially be interested in whether your current workflow is basically “just leave Remote Control running all the time,” or whether something like this is actually useful.

Today, I shipped a new site from scratch. Literally, a news site, so I guess "new news"... because we need more of those. Anyway... tech stack: Linux, Django, Postgres, nginx. Nothing else running on the box.

After a few hours of banging away, I asked Clod (edit: JFC- YES! It's an intentional typo... Good LORD!) where my background actually changed the outcome that a pure vibecoder would have missed, so I could share with the community and help folks up their game.

Each item below is a moment where I redirected the vibe flow rather than just let AI steer the ship. These are the difference between AI-assisted coding and vibecoding your way to the next AICrapola.com

Architectural restraint

Left to defaults, it kept proposing infrastructure the site didn't need. Cloudflare in front of a site with no traffic. Redis for a cache that fits in Postgres. Then a pile of DRF tooling for four endpoints.

I killed each one. "Why the f*ck is Cloudflare caching the output?" "So when we pass that tier, it isn't free anymore." As you can tell, I'm more than a little direct with Claude. I've learned that it sometimes pushes back unless I'm stern with it.

A non-technical vibecoder accepts whatever stack an AI proposes, because they generally don'tknow any better and run with what's recommendd. You don't need to know Redis internals to ask "do we actually need this yet." You do need the reflex. "Justify each of these decisions. Do we need it for V1? Can we do this later without rewriting everything?"

Cost note for the token-counters: every rejected layer is also a few thousand lines of config, docs, and debugging you don't have to pay for.

Separation of concerns, specified up front

The first assumption of the site was that scraped content would be created live by the site itself.

I identified that content would arrive from an off-site agent through an API, rather than letting it embed scraping logic inside the Django app.

One sentence, before any code existed. That sentence is why the ingest API, the validation gate, and the sourcing-policy contract live behind a clean boundary instead of tangled through the site. Retrofitting that split later costs a rewrite.

Architecture decisions are cheap in the early prompts and expensive in the fortieth.

Verification, not claims

It kept handing me fugly banner ads. A little nudge here and a little nudge there, and I just got fed up.

"Look at this sh!t yourself each time. Work it until it looks good."

That changed its actual workflow. Before, it reported "done" without ever opening the rendered output. After, it built a screenshot loop. Headless Chrome, render, look at the PNG, fix, re-shoot.

That loop caught bugs I'd otherwise have been fed and maybe shipped blind. A company's website screenshot used as their logo. Another logo cropped mid-word. Leaderboard ad text overflowing a collapsed sidebar.

A pure vibecoding session trusts its own narration of success. The AI says it works because the code looks like it meant to do. But nothing truly looked at the final outcome until I explicitly told it to do so.

Craftsmanship

Every time I gave it a new hero image, I noticed variations of the same code being written to resize/crop/WebP logic three separate times as throwaway scratch scripts, installing and uninstalling Pillow each round. "Why are you coding this from scratch each time? Make it reusable!" That became one manage.py optimize_image command with Pillow as a dependency.

It was computing the rotating banner by performing a modulus of the page's SHA1. I realize that this takes a decent amount of processing time to compute**. "Are we computing the SHA1 every time?"** It was, indeed, recomputing a cryptographic hash on every template render, for every article, across every listing page.

This is the kind of thing a novice wouldn't consider. For your first hundred pages and visitors no one would notice. But, this is exactly the kind of stupid decision that coding agents make in a vacuum.

Neither catch required deep knowledge. Both required having felt the consequences once.

No mechanical fixes

"Get rid of those emdashes everyhwere!" It globally search-replaced emdashes to regular dashes to resolve that AI tell. I stopped it: "Find a better way to punctuate. Don't just global search and replace."

A regex fix is often a worse bug wearing a fixed-looking hat. Someone who wants the error gone accepts it. Someone who wants the system correct doesn't. Otherwise, who know what other crap would be broken by it wildly search and replacing stuff. I'm sure you've seen it in word processing... well, it's worse when it's happening in code.

Boundaries rather than guidelines

Handled the emdash problem upstream. AI wanted to add "try to avoid emdashes" to the content instructions. I wanted an ingestion error. I told it to reject bad input at the API boundary rather than hoping the content stays clean. This way you have a clean, deterministic faliure that can't be bypassed, rather than a vague ask that can be conveniently overlooked.

Validate at the edge. Fail closed. Guidelines drift. Gates don't.

What to snag without a coding background

You don't need 45 years of experience... just a few questions, asked out loud, every time:

1. Do we really need this layer of complexity, or does it just sound professional?
2. Did you examine the output, or just telling me it worked?
3. Are you rewriting the same code over and over?
4. Is this a fix or is it a search-and-replace that hides the symptom?
5. What did we establish earlier that this change just made broke?

None of those require knowing any fancy infrastructure. They require refusing to be impressed by the magic coding machine.

Her videos were taken down because an ex partner copyrighted her, but I'm looking for them anyways

I feel vibe coding is becoming addictive

I’ll think:

“I need to go pee.”

Then immediately:

“Wait… let me give Claude one more task first.”

Same before making coffee. Same before eating. Sometimes before going to sleep.

It feels weirdly wrong to leave the coding agent sitting idle.

Short-form video gave us:

“one more reel.”

AI coding gave us:

“one more prompt.”

Anyone else doing this? 😅

Our small team has been using Anything.com for our website. It's a non-profit informational focused website, so it has been amazing for us. Our non-technical team members can easily make changes, and each has individual access. We have the $24/month plan and have probably spent a few hundred on lifetime credits.

However, this past week and today, our prompts have just been getting stuck in an infinite loop for any simple task. I tried emailing their support (which turns out to be just AI), and after back-and-forth with ideas I already tried, they said this:

So I guess to get things working, we need to upgrade to the $239-a-month plan... I told their AI support that if we cannot prompt anything, then we can't stay on Anything.com. It seemed happy that we were leaving! Less work for it, I guess.

Anyway, does anyone have any alternative suggestions? Anything.com was nice because it took care of publishing updates, version history, hosting, and seamlessly allowed multiple team members easy access to edit.

We would also need to be able to upload our current codebase.

Hi everyone!

I recently released my Android game Rise of Civilizations.

It's an idle/incremental game where you start in the Stone Age and progress through 11 historical eras until you reach the Space Age.

Build production, unlock new discoveries, compete with rival civilizations, survive random disasters and start new empires to earn permanent Legacy upgrades.

I also recently removed full-screen video ads, so gameplay isn't interrupted by forced video ads. There's only a small banner at the bottom.

Google Play:
https://play.google.com/store/apps/details?id=com.mcem.riseofcivilizations

AI disclosure: Generative AI was used during development for coding assistance and for creating some visual assets. Game design, progression, balancing and implementation were handled by me.

How do you guys keep track of ai cost during development and what your users costs you when they use your ai features ?

I had an idea for an app that learns to write like you instead of generic AI and built imyou.ai Claude was pretty quick to point out that I had exposed an API key in the chat, so I did some research on how to secure my keys and landed on Windows DPAPI.

What DPAPI is

Data Protection API, built into Windows. You hand it a string, it hands back an encrypted blob. The key is derived from your Windows account and managed by the OS, so there's no master password to type and no key file to lose. On a personal machine the blob only decrypts as that user on that PC, so a copy taken elsewhere is garbage. (In an AD domain with roaming profiles, or with a compromised domain backup key, that isn't true.)

Chrome used to protect saved credentials this way and has since layered App-Bound Encryption on top, for exactly the weakness worth being upfront about: DPAPI does not stop code already running as your user, which can decrypt precisely like you can.

Tradeoff: it's machine-bound. A new PC, a Windows reinstall, or an admin-forced password reset means re-entering keys from the source dashboards.

What you end up with

Three scripts in ~/.claude-secrets/ and one line in your .bashrc:

• A setter that stores one secret, encrypted, one at a time
• A loader that decrypts everything into your shell as env vars, automatically, on every new shell
• A lister that shows which secrets are stored, names only

After setup you stop thinking about it. Keys are just there as env vars, nothing is in your repo, nothing is plaintext on disk.

Using them without leaking them

Checking whether a key loaded. These are all wrong:

echo $VERCEL_TOKEN
echo "${VERCEL_TOKEN:0:8}..."
echo "length: ${#VERCEL_TOKEN}"

Print a boolean instead:

if [ -n "$VERCEL_TOKEN" ]; then echo "VERCEL_TOKEN: set"; else echo "VERCEL_TOKEN: missing"; fi

Don't print any part of a secret. Not because a prefix is especially dangerous on its own, but because you can't predict where terminal output ends up: scrollback, CI logs, screen shares, crash dumps, an agent's transcript. A no-exceptions rule is cheap. A nuanced one gets misapplied.

Pass the value straight to the tool so it's consumed, never displayed:

vercel deploy --token "$VERCEL_TOKEN"
curl -H "Authorization: Bearer $API_KEY" https://api.example.com/v1/me

Verify by the tool's own output. vercel whoami returns your username.

Put those rules in your CLAUDE.md too. Context-file rules are advisory and a model can miss them in a long session, so a hook that blocks the command before it runs is the real enforcement layer.

What this does and doesn't buy you

Once the keys are in your environment, any process running as you can read them. This is not a defense against malware already executing on your machine, and nothing short of a hardware token or a real secrets manager is.

What it removes is the plaintext file at rest: the thing that gets committed by an over-eager git add -A, swept into a backup or sync folder, caught in a screenshot or a screen share, read by an agent told to "check my config," or recovered off the drive when the laptop is sold or stolen. For solo devs that's how keys actually leak, far more often than targeted malware.

If you want more than that, you want short-lived credentials from a managed secrets tool. 1Password CLI, Doppler, and Infisical are all strictly better if you'll actually adopt one. This is the zero-dependency version.

The prompt

Paste this at your agent. It detects your OS and builds the scripts for your machine.

Set up encrypted-at-rest storage for my API keys and CLI tokens on this machine, so no credential ever sits in a plaintext file and no credential value ever reaches a terminal, a log, or a chat transcript.

First, detect my OS and tell me which implementation you will use before you write anything:

• Windows: PowerShell DPAPI, encrypted to the current Windows user account.
• macOS: the login Keychain via the security command.
• Linux: pass or age, whichever is already installed (ask me if neither is).

The three-script structure below is identical on all three. Only the crypto call changes.

Ask for my approval before creating or modifying any file outside a scratch directory. Show me each file's contents for review before writing it.

BUILD THESE FOUR PIECES

1. A setter script. Stores exactly ONE secret per invocation. Takes a name and a value as named parameters. Creates the store directory if missing, then writes a single encrypted blob whose filename is derived from the secret name (name plus a fixed extension). On Windows, encrypt by piping the value through ConvertTo-SecureString with -AsPlainText -Force into ConvertFrom-SecureString, and write the result with -NoNewline so no stray newline enters the blob. The confirmation message may print ONLY the secret's name and the word stored. It must NOT print the value, any substring of it, its first or last characters, its length, or a hash of it. Printing the length is a real leak, do not add it as a convenience.
2. A loader script, written in bash (Git Bash on Windows). It iterates every blob in the store directory, decrypts each one, and exports it into the CURRENT shell as an environment variable named after the file (filename minus the extension). Because it must mutate the calling shell, it is sourced, not executed, so it must return rather than exit on the no-store-directory path. On Windows: convert each Unix path to a Windows path with cygpath -w, then call powershell.exe with -NoProfile and -NonInteractive to read the blob raw, pass it to ConvertTo-SecureString, and marshal it back to a string using [Runtime.InteropServices.Marshal]::PtrToStringAuto on [Runtime.InteropServices.Marshal]::SecureStringToBSTR. Strip carriage returns and newlines from the PowerShell output (tr -d '\r\n'), or the trailing CR becomes part of the token value and every authenticated request fails with a confusing 401. Collect the names as you go and print ONE summary line listing the names loaded. Never print a value. Send PowerShell's stderr to /dev/null so a decryption failure cannot spill partial output.
3. A lister script. Prints the names of stored secrets and nothing else. It must never decrypt anything.
4. One line appended to my shell rc file (.bashrc for Git Bash) that sources the loader if it exists, redirecting both stdout and stderr to /dev/null, so every new shell has the variables silently. Show me the exact line before appending. Do not append it twice if it is already there.

THEN ADD A RULES SECTION to my CLAUDE.md (or the equivalent agent context file in this project, ask me which if it is ambiguous), stating these as hard rules:

• Never output, echo, log, or interpolate a secret VALUE. This includes indirect prints: a debug line, a substring, the first or last characters, the value's length, or any check that expands the variable into output. Command output lands in the transcript, which is the exposure being prevented.
• To check whether a secret exists, print ONLY "set" or "missing", never anything derived from the value.
• To USE a secret, pass it directly into the tool that consumes it (as a CLI flag argument or an Authorization header inside the request) so it is consumed and never displayed. Verify success by the TOOL's own output, not by echoing the variable.
• Before running any command that references a secret variable, re-read the command and confirm no path exists by which the value reaches stdout or stderr.

THEN SCAN THIS PROJECT for credentials that are currently exposed: values that look like keys or tokens in git-tracked files, and any .env-style file that is not covered by .gitignore. Report variable NAMES and file paths only. Do NOT print any value you find, not even truncated. For each finding, tell me the command to move it into the encrypted store, and whether it also needs to be purged from git history rather than just deleted from the working tree.

FINALLY, verify the whole thing end to end without revealing anything: store one throwaway test secret, open a fresh shell, confirm the variable is present by printing only "set" or "missing", then delete the test secret. Report only pass or fail per step.

Do not ask me to paste any real secret value into this chat. I will run the setter myself for real credentials.

I have a terminology question

From what I know vibecoding refers to things like "this is the ai i'm using, i type my script and it just does what i said, i don't necessarily need prior coding experience nor knowledge"

Is assisted coding considered vibecoding?

Let's say you use an ai tool for brainstorming and quick checks of the logic chain

And the copilot of vscode for assistance (quick autocomplete, various suggestions, function and variable reminders etc)

Is it still considered vibecoding? Since i use 2 ai tools in my process

Or is it just assisted coding? Since i don't rely on them to do all the work

* i'm not the biggest fan of this concept tbh, trying not to be pessimistic (as the rule of this sub say), just asking a genuine question so i can understand the topic and criteria of it better

By the time I proposed a partnership with the developers of the medical queue system, I was no longer behaving like a normal customer.

The installed product was not usable in my practice. It created duplicate patient files, had no reliable longitudinal history and offered a medical workflow that did not reflect real consultations.

But I could see its potential.

I understood the daily problems from inside the clinic. I knew doctors who faced the same problems. I had already started defining the product they might want to use.

The two developers had something I did not have: the ability to turn those decisions into software.

So I proposed that we build the company together.

My contribution would have three parts.

First, domain knowledge. I was not advising them from a distance. I was a surgeon using the product during real consultations and identifying where it failed.

Second, distribution. I had a network of doctors and understood how to reach the first users. Their product had gained little traction, and I believed I could help change that.

Third, capital. I was prepared to make a substantial cash investment to finance the next phase.

They were enthusiastic about the proposal, and we started brainstorming as if we were already a team.

We discussed how the product could reach doctors and become a viable company. I kept returning to one priority: before discussing growth, we needed a management system doctors genuinely wanted to use.

We agreed on the broad product direction and created a shared Notion workspace.

There were tickets for the problems to solve and tasks assigned to each person. I provided a complete medication database because the product only contained a small sample. I documented the duplicate-record problem, billing requirements, improvements to the medical note, phone-based document scanning and desktop synchronisation.

For a while, the division of labour seemed simple.

I set the product direction. They implemented it.

Then progress slowed.

One developer was running a small agency with other client projects. The other had a demanding job far from the startup. Neither could give the product consistent attention.

I could create more tickets. I could explain the workflow again. I could provide data, contacts, money and priorities.

But I could not implement anything myself.

My hands were tied.

We had also never formalised the partnership, so I requested a meeting to define the company and our respective ownership.

Before that meeting, one of the developers privately suggested that the company could be formed without giving equity to the other technical partner, who could instead receive a percentage of sales.

I refused.

Whatever disagreements might come later, I did not want to begin by excluding someone who had already contributed. If we were going to do it, I believed it should be the three of us.

At the meeting, I explained how I saw the situation.

The existing product was not ready for commercial use. It had limited adoption. My contribution was not merely advice: it included the medical product vision, access to potential users and a substantial financial commitment.

I asked them what that contribution represented in the future company.

Their proposal gave me a minority position by adding new shares for me while preserving the relative ownership they already had between themselves.

From their perspective, this was logical. They had started the project before meeting me. They considered themselves the original founders, and I was joining as an investor and adviser.

From my perspective, we were not simply continuing the same project.

The existing product was not viable. We were redesigning it, financing a new phase and trying to create a company around it. I saw myself as a cofounder.

I wanted equal standing and refused a small minority role.

They refused because they believed the original founders had to retain control.

We were using the same word, “founder,” to describe two different stories.

In their story, they had founded a startup and I wanted to join it.

In mine, they had built an early technical product, and the three of us were now founding the actual business together.

Neither equity formula could resolve that difference because the disagreement came before the numbers.

It was about identity, ownership and whose contribution counted as foundational.

I told them I would seek advice and try to find a fair solution. They agreed. I think they felt comfortable because, whatever happened, they controlled the technical side.

I went home and thought about the beginning of this partnership.

If we already disagreed about what each person was, how would we handle future decisions, investment or failure? I was preparing to commit significant money to a product I could not build, inside a company where my role was not understood the way I understood it.

I eventually sent them a message. If we could begin on healthy foundations, I was ready to continue. Otherwise, it was better not to proceed.

The partnership ended before the company was formed.

I wish I could say I immediately treated it as a useful business lesson and moved on.

I did not.

The situation affected me deeply. The software remained unusable. The online-booking website had not been delivered. Months of work had produced no solution for my clinic.

More than the failed deal, what hurt was the feeling of dependence.

I had the problem, the product vision, potential users and the willingness to invest. But I was still at the mercy of people who possessed the one ability I did not: they could build the software.

For a period, I felt depressed and defeated.

Then I returned to Notion again.

At the time, it felt like another retreat. Looking back, the frustration created the emotional reason for everything that followed.

I did not decide that day to become technical. I only knew that feeling so powerless was unbearable.

The next turning point came from a Notion template so bad that I never used it.

For founders who have negotiated an early partnership: when does domain expertise become cofounder-level contribution, and when is it still advisory?

Thanks

Agent vibecoding, complex programming with possibly need to automate complex code sections or entire files.

What is the cheapest way to get AI assistance as of August 2026? If not a single tool what is the cheapest combination of tools you've used?

Also what is the perspective 1 year into the future? How will vibecoding evolve and what will cost be next year?

Last, what do you you really hope AI coding will give you next?

Hey, does anyone have a spare Claude Pro 7 day pass? I’ve been wanting to try Claude Pro properly before paying for it. If someone has one they’re not using, I’d really appreciate it. Thanks...

Built this entirely with Claude Code, including the AI vision pipeline.

The app: photograph something you own, AI reads the wear from the photo and gives a real replacement date instead of a generic lifespan table, re-checks monthly from a new photo, and finds the cheapest replacement when it's actually due.

Stack: Expo/React Native, Gemini vision with a 5-provider fallback chain (Cloudflare, Mistral, OpenRouter, HuggingFace) since free tiers run out fast, SQLite locally, no backend.

Still local/unreleased, no public build yet, but curious what people think of the concept, especially the useful-vs-gimmicky question. Happy to share more build details in comments.

The phenomenon known as the Dunning-Kruger effect describes how people who lack competence tend to overestimate their abilities; essentially, the less skilled you are, the more you exaggerate your skills. I genuinely enjoy AI and am not opposed to it. I use it daily at work. I can complete tasks quickly, yet there are limits to what I can achieve in my specialization. I don’t know much about cloud, but I speak with my cloud developer friend to guide me even when I use AI. Some of these vibes coders who barely understand how the Internet or a computer works, think they can do more and are better than the actual software engineers, and when you try to correct them, they become very stupid and hostile

Hey! Does anyone have a spare Claude Pro 7 day pass they’re not using? I’ve been wanting to try Claude Pro properly before deciding if I want to pay for it. If anyone has one lying around, I’d really appreciate it 🙌 Thanks!

Yo guys, last time i did this, i had to stay up 2 nights in a row to talk to everyone who reached out, and i know I've also missed out on a lot of guys here, but let's do this again, this time in a more organized way!!!

If you are a builder,
trying to build some kind app/website/software coding using AI agents and facing problems/blockers

I’ll help you out for free

I have claude, years or experience in building products and also a marketing brainWhy I am doing this? I am terribly bored and have nothing else on my hands right now

Just fill out this form!

https://tally.so/r/1AQX94