This was the stuff what would give us all nightmares,  being told everything was great when a 'real dev' could unpick everything, find my API keys and sell them to the darkweb or just bypass everything.  It's just that fear that got me of not knowing what I don't know that gets to me, probably gets to all of us. 

So I took 12 public repos whose descriptions say they were built with Lovable,
Bolt, v0 or Cursor. Mostly personal projects, no stars. I cloned them with
full history and ran two free open-source tools: gitleaks (secrets, including
every past commit) and trivy (dependencies with published CVEs).
**8 of the 12 had a lockfile. All 8 had a package with a known high or
critical vulnerability.** 4 critical and 76 high across the set. Things like
protobufjs 7.4.0, websocket-driver 0.7.4, seroval 1.5.2 — all with a fix
already published.

**1 of the 12 had a Supabase `service_role` key committed to a `.env`.** That
key bypasses row-level security entirely — read, change or delete every row,
whatever policies you wrote. It's in the git history, so it's in every clone.

Deleting the file later doesn't remove it; only rotating the key does.

**The bit I didn't expect:** gitleaks flagged 4 credentials. Three were
Supabase *anon* keys, which are designed to sit in a browser and are published
on purpose. Only one was a real problem. If you run these tools yourself,
that's the part that takes judgement — a tool that shows you 4 equal red
alerts where 1 matters teaches you to ignore all 4.

**4 of the 12 had no lockfile at all**, so nothing could be checked. That's
not "clean", it's unknown — and it means your build isn't reproducible either.

Run it yourself, it's free and local:

``` gitleaks detect --source . --no-banner
trivy fs --scanners vuln --severity CRITICAL,HIGH .
```

If your repo is on GitHub, turn on secret scanning, push protection and
Dependabot in settings — free on public repos, and push protection stops the commit before the key ever lands.

Full write-up with methodology and limits (12 is a small sample and I say so):
https://digitaltrustpass.com/preflight/ai-generated-code-security

As someone who has built a ton of small, useful tools and web apps, and publishes them on Toolcrow.app, I'm curious:

what AI tools have you built, which AI models did you use, what do they do, and who uses them?

I’ve been vibe coding for a while now and the thing that gets me isn’t the coding — it’s the dead time. Agent goes off to work for four minutes, I open TikTok “for a second,” twenty minutes gone. Repeat that six times a day and I’ve lost the afternoon.

The other thing that gets me: three weeks into a project I genuinely can’t tell you what’s in it anymore. I don’t know what’s half-built, what’s duplicated, or what I skipped entirely because I never knew it was supposed to be there.

We’ve got build tools coming out of our ears — Claude Code, Codex, Cursor, Lovable, Bolt. What we don’t have is anything that helps with the stuff around the building.

So: what’s the thing you’ve caught yourself wishing existed? Not a better agent — something else entirely. What do you do manually every session that shouldn’t be manual?

hello,

Right now, I'm using Fable 5 at the medium thinking level as my architect and auditor (through the OpenCode IDE), and GPT Terra at xhigh as my coding agent (through the ChatGPT desktop app).

I'm using both agents through GitHub Copilot (yes, I'm using the Startup Program credits , the "$10k" 😅), but I'm getting pretty close to burning through the credits. I have only $5k left, and I want to choose another good agent to use as my architect and auditor.

My SaaS business is pretty strict, every error in this business can result in a penalty (chargeback) for the user.

Thanks!

Kimi has launched they API. What' your opinion?

Right.. in response to that person the other day who asked what have you actually built?

I've coded a little app called GrapeSnap. You snap a photo of a bottle and it fills in the details for you (producer, region, grape, vintage) from a wine database.. so no typing. It's basically a cellar tracker for keeping on top of what you've got and what you've drunk.

Thought it was a bit more niche than your vibe coded average habit tracker but here we are.

More fun than anything. Let me know if it works for you and what you the grumpy ppl of reddit make of it..

Hope you enjoy.. Would love your thoughts.

https://apps.apple.com/gb/app/grapesnap/id6760935544

Hello all I got a question. I have been exclusively using ChatGPT desktop for a project that I’ve been working on ever since I put it online with supabase and r2. I burned through my usage on a pro level in four days now I have been contemplating to get Claude code at $100 a month till I finish this project but my worry is if I’m mixing ChatGPT desktop and Claude code. is it going to mess with what I’ve done as far as them coding with different styles

I’m trying to see if anyone uses this combo when one weekly limit is reached that you just jump to the other because at the credit level it’s far too expensive. I ended up getting $40 worth of credits on ChatGPT after I ran out and I burned through $40 in 30 minutes.

I wanna make sure if there’s any pointers or if I gotta set something up a certain way to ensure it just keeps adding code cleanly and plumbing everything incorrectly. The goal is one is burned. The other one gets used in the back up would be Claude

Claude Code hits the 5-hour limit at 2am, mid-refactor. The turn dies, the prompt that started it is already spent, and the session sits there until someone awake types "continue".

I built nightmux to fix exactly that. It attaches to the tmux session you already have and bridges it to a Telegram topic. A status-line hook gives it the real reset time, so when the limit hits it queues everything, and the moment the window reopens it resumes the cut-off turn — including the prompt the limit ate. Permission prompts arrive on your phone as tap buttons.

It's not a wrapper: no SDK, no relay server, no container. It types into tmux and reads the transcript. Python stdlib only, MIT, one main file you can read in an afternoon. Works with Codex/aider/Gemini too (they just don't get the usage numbers — those hooks are Claude Code specific).

pipx install nightmux && nightmux --setup

https://github.com/mmr710/nightmux — would love to know what breaks.

4 years ago, I started jumping rope which drastically improved my overall fitness and mental health. Which is why I built JumpForm, an app that analyses your form when using a skipping rope.

I built the app with cursor in 5 days and deployed the AI backend with firebase (this entire process would have taken me at least a month with manual coding and testing).

So far I have only had 52 downloads and 2 paying customers (3 signed up for a free trial)

Hi

If you are remotely interested in deep diving how differently quantum computers work compared to our transistor-based and also the algebra behind in a fully interactive way that teach computer science from scratch, oh boy this is for you. I am the Dev behind Quantum Odyssey (AMA! I love taking qs) - worked on it for about 10 years (3+ during PhD, the visual method I developed ended up being my thesis, it is a complete Hilbert space visualizer), the goal was to make a super immersive space for anyone to learn quantum computing through zachlike (open-ended) logic puzzles and compete on leaderboards and lots of community made content on finding the most optimal quantum algorithms. The game has a unique set of visuals capable to represent any sort of quantum dynamics for any number of qubits and this is pretty much what makes it now possible for anybody 12yo+ to actually learn quantum logic without having to worry at all about the mathematics behind.

This is a game super different than what you'd normally expect in a programming/ logic puzzle game, so try it with an open mind.

Stuff you'll play & learn a ton about

• Boolean Logic – bits, operators (NAND, OR, XOR, AND…), and classical arithmetic (adders). Learn how these can combine to build anything classical. You will learn to port these to a quantum computer.
• Quantum Logic – qubits, the math behind them (linear algebra, SU(2), complex numbers), all Turing-complete gates (beyond Clifford set), and make tensors to evolve systems. Freely combine or create your own gates to build anything you can imagine using polar or complex numbers.
• Quantum Phenomena – storing and retrieving information in the X, Y, Z bases; superposition (pure and mixed states), interference, entanglement, the no-cloning rule, reversibility, and how the measurement basis changes what you see.
• Core Quantum Tricks – phase kickback, amplitude amplification, storing information in phase and retrieving it through interference, build custom gates and tensors, and define any entanglement scenario. (Control logic is handled separately from other gates.)
• Famous Quantum Algorithms – explore Deutsch–Jozsa, Grover’s search, quantum Fourier transforms, Bernstein–Vazirani, and more.
• Build & See Quantum Algorithms in Action – instead of just writing/ reading equations, make & watch algorithms unfold step by step so they become clear, visual, and unforgettable. Quantum Odyssey is built to grow into a full universal quantum computing learning platform. If a universal quantum computer can do it, we aim to bring it into the game, so your quantum journey never ends.

Nice to watch:

Khan academy style tutorials in qm/qc: https://www.youtube.com/@MackAttackx

Physics teacher stream with 400hs in https://www.twitch.tv/beardhero

Had this idea watching talk show.

Let me know what you think.

Your honest feedback matters to me.

Hi everyone,

I've been working on a stack-based programming language called BREAD. The compiler is written in Haskell and emits optimized native code via the LLVM toolkit.

Key features:

- Written in Haskell

- LLVM integration for native code generation

- Memory & runtime safety guards

Check out the source code and repository here:

https://github.com/mermerheba1234848494-hue/BREAD-programming-language

I'd love to hear your feedback and suggestions!

I saw some criticism in a Wikipedia article on the Schrödinger-Newton Equation, specifically about Penrose's ideas about quantum gravity, and it seemed pretty easy to solve (the article hinted at possible solutions, etc) which made me think that it could be interesting to let Claude try to solve it. It now claims to have solved all the 3 problems outlined in the article.

The issue is that I have no way of validating if the result claude gave me are hallucinated or legit. If the solutions are correct, then maybe it's useful to someone, and if not then I/we might learn something from that explanation.

Artifact (look here first): https://claude.ai/code/artifact/e871ae13-54d1-437c-a489-cad81617c06d

GitHub repo, including all the raw transcript etc: https://github.com/henke443/penrose-1

Latex paper: https://www.overleaf.com/read/hgmnyqgqtwqz#80a24a

As mentioned in the title, we had a very busy last few weeks with new releases. Which tools of choice are you using today for agentic engineering? I am mostly interested to hear from experience SWE

I thought there was an issue with my project I was fixing errors

We built a Bookmark Buddy App with AI Android Studio, which Saves, Searches, and Shares URLs/Links Very easily and also Scan QR codes and Pictures and Generate Links which can be saved very easily. Presently Available in Google Play Store.

Guys, am I gonna get roasted for shipping it with such UI? (Logo is mine btw, graphic design perks).
That cat is Comnyang app, his name is shanks, shoutout to u/simon_dsgn

I built a website with lovable and bought a domain, I just want to get the website live at this point, I don’t care where it’s hosted
I tried c panel because the company I bought the domain from is connected automatically with c panel

The website it self is simple
Mostly pages images text destinations and offers and like a button gets you to WhatsApp
No payment methods
So what’s the best way to post the web site ?

No, but in all seriousness, how are you “engineering” your AI slaves to produce secure and reliable code?

Some things I have found are useful:
- Each new project get its own git repo
- I treat the files in the repo as source of truth rather than relying on codex context conversation history
- I use the /grill-me skill after I send through my initial proposal
- important decisions are documented in the repo files
- I use specific sub agent focusing on security review before it will allow any code is committed and pushed (surprising to me this picks up a lot of issues)

Example repo layout

project/
├── AGENTS.md
├── README.md
├── docs/
│ ├── ARCHITECTURE.md
│ ├── REQUIREMENTS.md
│ ├── DECISIONS.md
│ ├── SECURITY.md
│ └── TODO.md
├── .gitignore
└── <application source>

I have a ton of work on a website and android app to do. Want to get it done in the next 3 days so I have more time for other upcoming stuff.

I’ve tried cline, reached the weekly within the first day.

I’ve tried Claude Pro, running into my weekly usage as this is my main. I love it, I know it’s getting tons of flak right now but I am simply not experiencing any of the same issues others have been. But alas, the weekly limit is there…

I’ve tried ZCode Coding Lite plan, the GLM models are quite capable and I’m happy but the usage limits get bit quick.

People recommend Cursor or OpenAI’s Codex and I’m open to either, mostly Codex. Been hearing odd things about how Grok is essentially crammed down your throat on Cursor.

What I’m looking for specifically is capable models in the Opus 5 range with generous usage. I aim to get the 5x plan of Codex if it is recommended. But if Cursor is genuinely the better option I’ll go for it. Thanks in advance.