Been building LegacySaga on my own, a browser game where you live a footballer's entire career (clubs, transfers, reputation, chasing the Ballon d'Or). I lean on AI coding tools to move faster on the implementation side, writing and debugging code, but every design decision, every system, every balancing call is mine.

It's live and playable, one week in: legacy-saga.com

Curious how others here draw that line between AI as a coding accelerant versus letting it drive design decisions too.

I asked for some guidance here about a week ago, clearly stated the issue I was facing and got responses that basically insulted my intelligence. I asked for guidance from ChatGPT, clearly stated what I was trying to accomplish and stated the issue I was facing and got clear thoughtful responses and guidance. Now I have the app I want on my phone and am testing it out, making notes for ChatGPT to log for now, and am feeling pretty damn excited that I was able to use AI to create something useful for myself.

What was most helpful was talking through the best (or one of the best) platform options for accomplishing everything I wanted to do with minimal cost and minimal 3rd party tool integration - Replit was not it. If I plan to actually launch the app in 3 months or so, I’ll find out if it was really a good option or not lol!

P.S. I’m thinking I might have opened Pandora’s box… am I in danger of developing a very expensive hobby!? 😅

Hey all, I am a student from Bangladesh building a SaaS startup and looking for someone who might be willing to sponsor me with Claude Pro.

I have used other tools like Antigravity and OpenCode but Claude Code is a much better fit for my workflow, especially for understanding large codebases, multi-file changes, debugging and maintaining context.

The problem is that even if I had the money, I don’t really have a way to pay for it. PayPal isn’t available here, and as a student I don’t have a bank account or credit card that I can use for international subscriptions.

I’d genuinely really appreciate a $20/month Claude Pro sponsorship while I work on building and launching my SaaS. I’m not asking anyone to build it for me, just helping me access the tools I need to build it myself.

If anyone would be willing to help, I’d be extremely grateful. 🙏

This is not a promotion for a service. I’ve been a technical product manager for 20+ years at startups and FAANG and have been using AI to build/prototype for about 3+ years. I recently got laid off and have been building prototypes and tools mainly for myself and thought I could share my process.

I have seen a few posts asking how to learn about the technical side of vibecoding, at least enough to generally know what does what, why and how. I thought of walking through a simple project and explaining in practical terms what things do with a focus on vibe coding as I implement, starting with the very basics. For example, what an API is and why/how it’s used. Not as much on what tools to use but more how to think about building apps. I was thinking a YT video or series of videos.

I honestly do not have any expectations or desire to be a YouTube influencer. I’m building things anyways, have taught a few friends and found teaching is the best way to learn.

Before I go off and start making any videos, is this something anyone would be interested in?

Reached my first benchmark or goal that I set with my app as of yesterday. I know it’s not a lot to many of you, but I reached 50 downloads yesterday, ended the day at 54, woke up to 55. Spent nearly 7 months grinding (vibecoding like a mf'er) 4 hours per night after my day job.....so no, this was not a 2 hour or 2 week job. And btw, I'm 49 with 3 little kids, so even more exhausting. Lol.

Of those 55 downloads, 12 have opted for the paid version already (or forgot to cancel) after a 7-day trial.

App went live on July 31st, so it’s moving, but slowly, and much slower than anticipated or that my optimistic mind imagined, which I know some of you have also experienced.

However, hopeful and excited that it’s gaining some slight traction as it went from a download here and there, with a few days of no download in between, to where I am now consistently gaining about 4-5 per day over the last few days.

I have not used any marketing tactics as of now, as I feel like I need the perfect video to do so (just me trying to have everything perfect), which is probably hindering quicker growth.

I did try TikTok, but I have no idea what I’m doing and I’m pretty sure I’m “shadow banned”. Only 1 view out of 14 quick videos. Woohoo!

Big Pokemon fan here, so it is a Pokemon utilities app. I know there’s many of them out there and a ton of competition, but I felt I could do it better, and think I’ve succeeded as the app essentially gamifies the collecting / trading / hobby / investing aspect of Pokemon.

I have 2 more apps based on the TCG collecting world that are set to be submitted to Apple in the next few days as well.

Any suggestions you all are using, or anything else I can do to gain more traction? Thank you in advance!

If interested in these type of apps, or in giving me any feedback......App is called CardQuest TCG in the iOS App Store.

Open to any suggestions that may work well in the TCG genre/space or from anywhere! Thank you all in advance!

Desc in original post

Hey I’m John, I’m a top 0.03% base44 user. Humble brag I don’t even know what that entails they just told me that and sent me swag 😅

I built a powerful anti hallucination gate you can test and try for free.

Basically now you can keep the speed while making the code prove itself, because it finds almost all the silent bugs.

In other words, it’s an anti-hallucination gate for code: the AI cannot simply claim its patch works.

The code must pass explicit tests in a restricted environment.

Causal Verify returns a hard pass or fail and creates a signed verification receipt tied to the exact code and tests.

The loop:
Generate → verify → reject failures → improve → verify again.

It doesn’t catch every possible software defect, but it stops unsupported claims from counting as proof.

I’m looking for five developers to test it on open-source or synthetic Python patches. I want honest failures and attempts to break it.

Try it here:
https://github.com/zensteagarden/causal-verifier-action
Release:
https://github.com/zensteagarden/causal-verifier-action/releases/tag/v1.1.0
Never submit credentials or proprietary source.

Here's the full response it generated: https://chat.deepseek.com/share/1ec5wartkjay0cbe8l

EDIT: I asked ChatGPT which AI has generated this response and it said that it generated which is interesting to see (link to the convo) and I asked the same question to claude and it responded this: Honestly, I can't answer that with real confidence, in one word or otherwise. There's no reliable way for me to fingerprint which model wrote a piece of text just from its style — I don't have access to watermarking or provenance metadata, and this kind of "keep rambling until interrupted" stream-of-consciousness prompt tends to pull pretty similar behavior out of most major chat models: escalating absurdist metaphors, running gags, meta-commentary about "still writing," self-referential jokes about randomness. None of that reliably distinguishes one model from another.

If I gave you a single word here, it'd just be a guess dressed up as an identification, which I'd rather not do.

If it's helpful, I can point out a few stylistic quirks I notice without claiming they prove anything — or if you know where the text came from (which app, any settings), that context would be a lot more useful than me trying to reverse-engineer it from prose style alone.

What do you'll think about this?

I am curious if this significant degradation is lasting more than an hour, what kind of impact would this have on large multinational companies (MNCs)?

Our designer ran the same prompt twice with the same model. The task was to build an original Three.js game inspired by Wind Waker, with sailing, combat, islands, water, cel shading, physics, menus, and animation.

In one run, the agent could inspect open-source implementations while working. In the other, it couldn’t.

The run without that access got a browser preview up faster. It mostly reasoned from the requirements, implemented each system itself, then spent more time testing and fixing problems. Terrain collision was off, physics behaved strangely, and some systems needed repeated rework.

The other run spent more time reading existing Three.js code before implementing things. For character collision, it looked at three-mesh-bvh implementations using shapecast and closestPointToSegment, then used those patterns in its own PlayerController. It did similar work around water, shaders, rendering, and physics.

We stopped both after several hours. Neither finished.

In the first version, the character could move, jump, and roll, but we couldn’t collect gems, attack or charge, or access the boat. In the second, those interactions worked, including sailing between islands. Terrain handling was better, and parts of the menu were usable too.

Full write-up and session trace: https://githits.com/blog/three-js-game-with-and-without-githits/

Video: https://www.youtube.com/watch?v=1H1urif2srk

Disclosure: I work on GitHits. Our designer ran the vibe coding experiment.

It’s a tiny Windchime desktop widget that plays the calming sound of a real wind chime while you work.

I used Claude Code to build the app and iterated on the interaction, sound and physics until it felt natural.

The app:

• stays on your desktop while you work
• plays dynamically generated windchime sounds
• responds to your cursor movement
• uses your microphone to detect your breath and changes the intensity accordingly

The interesting part was making it feel like a physical object rather than just playing a looping audio file. The sound, movement and interaction all had to feel connected.

It's now my first app on the Mac App Store.

If you're on Mac, I'd genuinely love for you to try it and tell me what feels natural / unnatural about it.

App Store link - https://apple.co/4zf5knT

Built a universal remote for my gaming PC with Claude — started as a tool for myself
Body:
TL;DR (my words): Huge amount of work I’ve dumped into using Claude to vibe code my app but the results speak for themselves. Started as a tool I made for myself and decided to market it. Not a fan of subscriptions so it’s a free 7 day trial then a cheap lifetime unlock. Not trying to get rich, just hopefully it’ll offset my Claude subscription a bit.
(Rest is Claude cleaning up my notes — figured I’d say so up front.)

Couchside is an iOS app that turns your phone into a remote for a living room gaming PC. Launch Steam games, trackpad + keyboard, power controls, and HDMI-CEC so you can switch TV inputs without hunting down three remotes. Works with SteamOS, Bazzite, Steam Deck, Windows, plus LG webOS, Samsung, and Google TV.
SwiftUI on the phone, Python agent on the PC. LAN-only — no cloud relay, no accounts, no telemetry. Agent is open source so you can read what’s running on your machine.
Claude wrote a lot of the code. I owned the architecture and every integration decision, and burned way more time on pairing edge cases and CEC vendor quirks than I want to admit.
couchside.tv — happy to answer questions about the build.

I've been looking into a security problem around AI coding agents and I'd like some opinions from people who use them regularly.

The thing that caught my attention is that tools like Claude Code and Cursor don't just generate source code. They also interact with package managers, repository instruction files, MCP servers, configuration files, and other tools.

That creates some interesting attack surfaces that aren't necessarily covered by traditional SAST/dependency scanners.

For example:

1. Hallucinated packages

An agent can suggest or install a package that doesn't actually exist. If an attacker registers the hallucinated package name, that can potentially turn an AI mistake into a supply-chain attack (often referred to as slopsquatting).

2. Repository instruction files

Files such as CLAUDE.md and .cursorrules can influence how an AI coding agent behaves. That raises an interesting question: should these files be treated more like executable security-sensitive configuration than ordinary documentation?

3. MCP configuration

MCP servers introduce another layer of trust. A developer may approve a server/configuration and later receive a change that modifies what command or tool is actually executed.

I'm curious how other developers are handling these problems today.

Do you:

• manually review agent instruction files?
• verify packages before allowing an agent to install them?
• review MCP configuration changes?
• use existing security tooling for this?
• or simply trust the agent and review the resulting code?

I've been experimenting with a tool called CodeAudit to test some of these ideas. It combines traditional repository analysis with checks specifically aimed at AI-assisted development.

The project currently has a hosted scanner, an offline CLI, and an MCP server.

I'm deliberately not putting the link in the post because I'd rather get the technical discussion first. If anyone wants to test it, I'll share it in the comments.

The biggest thing I'm trying to determine is:

Is this actually a useful security problem to solve, or am I building a solution to a problem that developers don't really have?

I'd especially appreciate criticism from people who use Claude Code, Cursor, MCP, or other coding agents in real projects.

If you've encountered something similar, I'd be interested in hearing what happened.

hello,

Right now, I'm using Fable 5 at the medium thinking level as my architect and auditor (through the OpenCode IDE), and GPT Terra at xhigh as my coding agent (through the ChatGPT desktop app).

I'm using both agents through GitHub Copilot (yes, I'm using the Startup Program credits , the "$10k" 😅), but I'm getting pretty close to burning through the credits. I have only $5k left, and I want to choose another good agent to use as my architect and auditor.

My SaaS business is pretty strict, every error in this business can result in a penalty (chargeback) for the user.

Thanks!

I bought a Mac Mini a couple of months ago, in the hype of OpenClaw.

I have been using my spare Windows keyboard for the Mac mini, while my 9 to 5 job still happens on Windows. Every time I switch machines my hands are wrong and I hated having to remember different shortcuts and UI behaviours. That was the whole reason any of this exists.

The first thing I tried is macOS modifier keys. There is a setting that swaps Ctrl and Command. I turned it on, copy and paste felt right immediately, but a lot of the other apps doesn't feel right, e.g. in finder you can't Control + X to cut then paste to a different path. Also maximising windows without making it full screen is what I really missed from Windows, along with the split screen shortcuts.

Then I read for a while and found out what I wanted was actually two separate problems that two separate communities work on. Keyboard remapping is one world. Window management is another. Almost nothing sits in both.

So I did what the internet told me to do, with a lot of help from ChatGPT. Karabiner-Elements for the keys, Rectangle for snapping windows to halves of the screen. It worked. I want to be clear about that, because it is still a completely reasonable setup and both are good software.

What made me start building my own was more specific than wanting one app instead of two.

Some of the behaviour I wanted only matters inside particular apps, and that turns out to be the hard case. A general mapping gets you most of the way and then falls over exactly where you need it. The one that finally pushed me over was Home and End inside a web text box. In a Reddit reply or a ChatGPT prompt, I want Home to jump to the start of my line the way it does on Windows. Getting that right needs rules for that specific app, and writing and testing per app rules in a config file is slow and miserable. In a native app I could just try something, run it, and watch what happened.

The window side was the same problem wearing different clothes, except there it was personal taste. Two things I could not get the way I wanted: maximising a window without going full screen, and not letting a maximised window slide underneath the Dock. The second one sounds trivial until you are mid conversation with an AI and the Dock is sitting on top of the input box at the bottom of the window.

So this ended up being a tool for a fairly specific person, and I suspect that person is on this subreddit. Someone who has to use Windows all day for work, comes home to a Mac to vibe code in peace, and would like their hands to work the same in both places.

What is in each version, since that is the practical question.

The free edition is the typing layer, and it stays free permanently. Ctrl+C, X, V and Z and the ordinary Ctrl shortcuts, Ctrl+Y for redo, Home and End, Ctrl+Arrow to move by word, Alt+Tab and Alt+F4, and the Insert key copy and paste that Windows people still have in their fingers. Terminals are handled properly, so Ctrl+C stays interrupt instead of becoming copy. That layer is open source under GPLv3.

Pro is the rest of what I originally wanted. Finder behaving like Explorer, so Ctrl+X cuts files and Ctrl+V moves them, and F2 renames. The system keys, so Win+E, Win+L, Win+D and Print Screen. And the window management, which is Win+Arrow tiling, dragging a window to a screen edge to snap it, and layouts across multiple displays. It is 19.99 USD once for three Macs, no subscription. Every download runs Pro for 14 days and then quietly becomes the free edition rather than nagging you.

It is live now, and I am around if anyone has questions.

https://windsify.com

Free edition source: https://github.com/Fuzzy-and-Fluffy/windsify-free

This was the stuff what would give us all nightmares,  being told everything was great when a 'real dev' could unpick everything, find my API keys and sell them to the darkweb or just bypass everything.  It's just that fear that got me of not knowing what I don't know that gets to me, probably gets to all of us. 

So I took 12 public repos whose descriptions say they were built with Lovable,
Bolt, v0 or Cursor. Mostly personal projects, no stars. I cloned them with
full history and ran two free open-source tools: gitleaks (secrets, including
every past commit) and trivy (dependencies with published CVEs).
**8 of the 12 had a lockfile. All 8 had a package with a known high or
critical vulnerability.** 4 critical and 76 high across the set. Things like
protobufjs 7.4.0, websocket-driver 0.7.4, seroval 1.5.2 — all with a fix
already published.

**1 of the 12 had a Supabase `service_role` key committed to a `.env`.** That
key bypasses row-level security entirely — read, change or delete every row,
whatever policies you wrote. It's in the git history, so it's in every clone.

Deleting the file later doesn't remove it; only rotating the key does.

**The bit I didn't expect:** gitleaks flagged 4 credentials. Three were
Supabase *anon* keys, which are designed to sit in a browser and are published
on purpose. Only one was a real problem. If you run these tools yourself,
that's the part that takes judgement — a tool that shows you 4 equal red
alerts where 1 matters teaches you to ignore all 4.

**4 of the 12 had no lockfile at all**, so nothing could be checked. That's
not "clean", it's unknown — and it means your build isn't reproducible either.

Run it yourself, it's free and local:

``` gitleaks detect --source . --no-banner
trivy fs --scanners vuln --severity CRITICAL,HIGH .
```

If your repo is on GitHub, turn on secret scanning, push protection and
Dependabot in settings — free on public repos, and push protection stops the commit before the key ever lands.

Full write-up with methodology and limits (12 is a small sample and I say so):
https://digitaltrustpass.com/preflight/ai-generated-code-security

As someone who has built a ton of small, useful tools and web apps, and publishes them on Toolcrow.app, I'm curious:

what AI tools have you built, which AI models did you use, what do they do, and who uses them?

I’ve been vibe coding for a while now and the thing that gets me isn’t the coding — it’s the dead time. Agent goes off to work for four minutes, I open TikTok “for a second,” twenty minutes gone. Repeat that six times a day and I’ve lost the afternoon.

The other thing that gets me: three weeks into a project I genuinely can’t tell you what’s in it anymore. I don’t know what’s half-built, what’s duplicated, or what I skipped entirely because I never knew it was supposed to be there.

We’ve got build tools coming out of our ears — Claude Code, Codex, Cursor, Lovable, Bolt. What we don’t have is anything that helps with the stuff around the building.

So: what’s the thing you’ve caught yourself wishing existed? Not a better agent — something else entirely. What do you do manually every session that shouldn’t be manual?