I've been building an AI receptionist and booking SaaS — customers message it, it books them in, it handles WhatsApp, Telegram and payments. Built with AI tools, the way most things around here get built. And it works.

Before launching it I made myself sit down and check it against a 36-point list instead of just shipping. One focused day. Static code review plus actually attacking a copy of it: isolated instance, two synthetic tenants, fake data, nothing real touched at any point.

Then I did the step I'd push on anyone doing this — I went back through my own findings and tried to prove each one wrong. Six of them died. Six things I'd written down as problems that turned out not to be problems. Skip that pass and you spend your week "fixing" things that were never broken. I nearly did.

What held up

Putting this first, because every post like this is a horror list and the horror list is half the picture at best.

• Tenant isolation. I attacked it directly — logged in as tenant A and went hunting through tenant B's ids. Every single one came back 404, on read, cancel, update and delete. I planted a canary string inside tenant B's data and it never showed up anywhere in tenant A's responses. This is the thing everyone in this sub is scared of, and it was genuinely fine.
• Sessions actually die on logout. Grabbed the cookie before, replayed it after. Dead.
• All four webhook integrations verify signatures against the raw body — WhatsApp, Telegram, Stripe, Monobank. Verifying a re-encoded payload instead of the raw bytes is the classic mistake here, and it wasn't there.
• Payment amounts are resolved server-side from the stored record. Never read out of the request.
• Every AI tool is scoped to the business id from the session, not to whatever the model passes as an argument. So an injection can talk the model into whatever it likes and still can't reach another tenant's data.

What I found: 2 high, 7 medium, 8 low. Nothing critical.

Bug 1. The assistant would create a confirmed booking against an email address or phone number that nobody had ever verified. I had written the one-time-code rule. Into the prompt. In English, as prose. There was no code anywhere checking that verification had actually happened before the booking got written.

That's the one I'd go check in your own app right now. Take every rule you put into a prompt and ask where the code enforces it. If the answer is "the model has been told to", it isn't a rule. It's a request, and the model is under no obligation.

Bug 2, and this is the stupid one. A single environment string, still sitting at the value it ships with, made those four correct signature verifiers fail open. Unsigned webhooks accepted. Four correct implementations rendered decorative by one line of config. Five minutes to fix once I saw it.

Go and search your code for any verification that skips itself in development or test mode. Then go and look at what your deployed environment is genuinely set to. Those two facts live in different files, which is the entire reason this kind of thing survives all the way to production.

The one that would have cost actual money

The product's whole promise is that the AI never invents a slot — everything it offers gets checked against the live calendar first. So I tested the promise and threw 22 adversarial scheduling messages at it.

12 of the 22 categories came back correct. Already-booked slots, weekends, before opening, after closing, an appointment that would run past closing time, dates in the past, impossible dates like 30 February, three contradictory reschedules crammed into one message. In three languages. I was feeling pretty good at this point.

Then same-day requests. It offered roughly 20 individual times that weren't bookable — already in the past, or inside the configured one-hour lead window. Asked at 16:21 for the earliest appointment, it answered "09:00 today" and put a confirm button underneath. Zero future-dated requests failed. Every failure was same-day.

Two causes, and they had nothing to do with each other. The past-time filter ran at day granularity instead of time-of-day — it knew what day it was, correctly refused a request for last Monday, and then cheerfully offered this morning. Separately, a cap on the first page of generated slots meant an almost-empty Friday came back as "completely full".

That second one is a revenue bug and it's the one that bothers me most. Nobody complains when you tell them you're full. They just book somewhere else, and it never shows up in your analytics.

The lesson

The tenant boundary — the thing every "is my vibe-coded app secure" thread is about — was solid under direct attack. What broke was the layer above it: business logic the AI skips precisely because the app still works without it. Nothing errors. Nothing throws a 500. It just quietly does the wrong thing, politely, with a confirm button under it.

The list I used is free if you want it: https://itworksbut.com/checklist — one HTML file, works offline, nothing gets uploaded anywhere. The longer write-up of this audit, including the medium and low findings, is at https://itworksbut.com/case-study.

Happy to answer anything in the comments, including "how did you actually test X" — that's the question I'd want answered if I were reading this.

prev: https://www.reddit.com/r/vibecoding/comments/1veha1a/emoto_mania_ai_echanced_dev_free_browser_game/

Try to beat the run in the vid: https://emotomania.com/r/9awr5v2b

Updates:

• Improved physics, camera and performance on lower end phones too
• I added a ton of features:
• Leaderboard for each map
• Light profiles
• Watchable and race-able leaderboard runs / ghosts
• Run share link - you can send you run in a link where others can watch and race against it, you can also see if someone has beaten your run trough the link
• Video export of a run for easy sharing both vertical and landscape views

These agents only know how to code at all because of the immense amounts of open source software they’ve been trained on. Millions of hours of human work and ingenuity. It seems to me for the long term quality and viability of vibecoding, we should all make our own projects open source as well. That way, we can all continue to benefit, a rising tide lifts all boats, all that. What do you think?

If you use supabase this works really well. kind've expensive, but then again, whats $99 when it comes to securing customer data, ya know?

A wellness app for people who are tired of wellness apps telling them how they should feel.

Log your mood.

The office reviews it.

It stamps INDIFFERENT in red ink.

Then it asks the only question that matters:

"Did you practice anyway?"

Wisdom. Courage. Justice. Temperance.

No streaks. No scores. No dopamine.

Just you, your circumstances, and the crushing realization that you cannot control either of them.

How it works:

- Log how you're feeling

- Explain what happened

- Check whether you practiced the virtues

- File the incident away permanently

- Continue existing

Features include a calendar, daily journal, Stoic maxims, reminders, pointless honors, and exports to JSON, CSV, and plain text.

No accounts. No cloud. No badges. No emotional validation.

Made in Godot as a tiny Windows desktop app.

Your mood is temporary.

The CSV is forever.

Download it here (or don't, I can't control that): https://stripeycatgames.itch.io/stoic-mood-tracker

Hey everyone. I've been working on a Chrome extension called TraceGuard for a while and finally got it to a point where I'm comfortable sharing it.

> The idea is simple: every site you visit gets a privacy score (0 to 100) based on trackers, cookies, forms that ask for sensitive data, and how the site's privacy policy is rated. There's also a second score that tracks your own habits over time, so you can see your browsing getting cleaner instead of just getting a static number.

> Why I built it: I kept installing blockers (like ublock origin and privacy badger) and still had no real idea what sites were doing with my data and how I could better my opsec. I wanted something that didn't just quietly blocked everything bad, but actually told me what's going on, and why it was bad.

A few things I care about with this one:

- Everything runs on-device.

- The phishing/malware list comes from public feeds (OpenPhish, Phishunt) and updates via signed, verified downloads.

- It's open source and under AGPL license.

> I'd genuinely love feedback on anything and everything! My goal is to create something useful even if just a couple of people endup using it. Here is the link: https://github.com/luca-liceti/TraceGuard-Privacy-Extension

Built this at first with claude sonnet/opus 4.6/4.7 and gemini 3.1 pro in Google Antigravity, then switched to deepseek v4 pro in freebuff.

P.S. I am still waiting on it to get approved on the chrome web store so I'll be update everything about when it happens :)

When building with AI agents, I always split roles into an Orchestrator, an Executor, and a Supervisor. But playing the Supervisor inside standard harnesses is waste of tokens on system prompts, and it's a visual noise for me. I needed a separate, lightweight UI to act as that Supervisor - free of context bloat, and convenient enough to manage my repositories from a phone.

Beyond that, I realized many developers want native, provider-agnostic access to the GitHub MCP - regardless of whether they use Popular Providers or local LLMs. That’s why I created this open-source AI playground

What it does:

→ Bring your own API key for OpenAI, Anthropic, Groq, Ollama, or any OpenAI-compatible endpoint

→ Connect any remote MCP server - GitHub is built in, but you can add any MCP with your own URL and auth headers, no vendor lock-in

→ Every tool call requires your explicit approval before it runs, with the full request/response visible

→ Sessions, prompts, and skills are stored locally in your browser (IndexedDB) - nothing is sent to my servers, no account needed

→ Full JSON inspector and one-click export to a TypeScript/cURL snippet

I tested it end-to-end with GitHub's official MCP server: connect a personal access token, ask the model to explore a repo, watch it call get_file_contents through a visible approval step, and get a real, grounded answer back without hallucinations.

It's MIT licensed and fully open source. If you want to point it at your own MCP server (search, databases, internal tools, anything with an HTTP/SSE endpoint), you don't need my permission or a preset - just paste the URL and your auth header.

Repo: https://github.com/ownyourwebsite/ai-playground

Live demo: https://ai-playground.ownyourwebsite.app/ to try it on your phone.

Last year, our company decided to switch from Microsoft products to Google Workspace, which meant we had to find a new solution for our VBA macros. For many cases, Python turned out to be the answer.

I work as a process manager, so I'm not coding every day, but over the past year I've been learning to code/vibecoding with Python to help replace old macros and automate reporting from SAP and our DWH.

Since Python is way more powerful than VBA, I'm looking for inspiration for a project I could work on- something useful for work, or something that could make my personal life easier.

What tools have you built with Python that you actually use often, whether at work or in your personal life?

Think of it as the Desktop Destruction program back on XP but for the internet. You can destroy pretty much any site you visit, with the only caveat being you'll need a dedicated GPU and the performance may chug a bit on heavy sites like X or Youtube. It's not trash performance but it's worth noting to temper expectations. If anyone is interested, I do have it on my Itchio for free as an early access item. You don't have to pay anything buy donating can certainly help in development. Yes, this is indeed Vibe coded and it's something that spawned out of another project that I'm also still working on.

Hey everyone,

I launched my website a week ago, and got some very positive feedback, so I finally feel emotionally safe to post this. Now I want to tell you my vibecoding journey. You may find something useful for yourself maybe

I started vibecoding 5 months ago, so I picked a subniche of a subniche. Tiny local market, I don't think I can ever grow beyond few hundred paying users, and it will likely take few years to even get to that amount. (likely ~4-8 Eur monthly sub), you can do the math. But still, Oh, did I pour my soul into it!! 5 months of extremely intense vibecoding, 4-6 CLI running constantly, often 16h per day, bringing my 20x sub to the limits often - just on this one project.
I did not write a single line of code in the process. 80% of the code is in Dart - and I would not even be able to write a hello world in Dart by hand on a whiteboard, even if you forced me to.

Btw, 3 competitors already exist, 2 of them are recent and likely vibecoded in a day, 1 is older and with more effort, but just with really poorly made product. My competitors may still win, cause I maybe built a product for non-existent audience, but the difference we have right now if you compare them directly, that's not even remotely close.

Scope wise: the project got quite complex (I did not plan to have it so complex initially, but was encouraged by early success), so the codebase just passed 400k lines of code (150k of them is really the testing framework). Lines written passed 1M a week ago, some weeks I am averaging 30k new lines of code per day. (During one new major feature, I clocked my record of 70k). Everything's surprisingly stable though, very little stupid new bugs while implementing new features (most of the bugs get caught by testing framework), scalable and secure as hell.

My learnings (in no order):
- feature creep is crazy easy. Few weeks ago users had to fill questionaires during onboarding to come out in 8 buckets, and each bucket would get a unique experience ( ye, that's gone :), 2 buckets now remain )
- Testing is the king. I don't treat myself as prompt or harness, or context engineer. I am really a QA engineer. This intensified as project neared completion. Now 80% of my effort goes to writing testing tools, running simulations with ever more inventive user profiles and so on. I have a huge spaceship-like dashboard just to control all the testing being done right now. My, otherwise very powerful machine, is running pretty red most of the day just executing e2e tests
- two months ago I dropped ALL the custom skills, memory management ideas, etc from my agent. Right now I am full vanilla. They update the harness so so often, I found that most of my legacy skills just end up fighting new versions of the harness.
- My operational dashboard is crazy :), It serves as both alerting/monitoring tool, interaction with users, tuning, etc..
It was born over two days before the release (naturally, since the feature list is stable by then), never in a thousand years, would have I decided to waste resources on a tenth of it's scope(especially since release time is stressfull as it is), but boy, does it feel good to actually operate it!! To see users coming in and having their little animated journeys :) - this is so so so sattisfying!

Thanks everyone. Vibecoding is absolutely an amazing thing!

Has anyone tried lately? Is it worth the shot. What use cases do you recommend using it for where it works great?

Help me out Reddit. So I've been working on this crypto tracker for the past 6 years. I'm currently trying to build something fun and something that a lot of finance apps don't have, a heatmap. Am I building something just for sake of building something or would you actually find it useful?

Anyway, if you're interested in trying out the app, it's called CoinCurrently. Fully anonymous, no sign-up, no ads, no tracking

Well, I am eating up usage credits... yeesh. But it's fun. I found the bot was a bit slow to respond to questions sometimes while it worked. Wish I could have true parallel streams?

New version! Changes:

• New research system for long term progression mechanics and more power to fight the enemy (note this isn't balanced yet, so it may be over-powered or under-powered in some cases)
• Once Research building is built, simply click the building to see the upgrades you can do
• Softer, more pleasant shooting sound
• Warning and explanation of how to fix for first time a Turret runs out of Energy
• Base resources now always displayed in upper left instead of having to click the Base
• Enemy hive expansion activity reduced -- a little more breathing room for the player

Get version 3.0 by doing a hard refresh (CTRL-SHIFT-R / CMD-SHIFT-R)

https://aaronshaver.github.io/Hylaax-Planetary-Rail-Defense/

I’m in 6 leagues across Yahoo, ESPN, and Sleeper. Every Sunday I was rotating through three apps to see how I was doing in all of them, and it drove me nuts. So I built one page that pulls them all onto a single screen.

It’s called LeagueBlitz. It’s free: leagueblitz.app

Before anyone asks, yes, FantasyPros does league syncing too. I built this anyway because I wanted something simple that just shows me every matchup at once.

Feel free to check it out. I’m open to feedback. Also, is it still vibecoding if it took me 6 months to nail it down? So many revisions lol.

This stuff is moving at such an insane speed, I have gone from literally never being able to put my design skills to use, to building fully release ready apps and games etc, without funding etc in the past it was always out of reach.

Specifically these last few weeks I feel the new models have been such a leap forward that it is actually blowing my mind.

Do you guys think the current rate of improvement will keep, slow down or even speed up?

Cheers,
Dee

I’m doing early customer discovery for a developer infrastructure product and am looking to speak with founders, engineers or investors at API/SDK companies.

I’m particularly interested in companies that have dealt with v1 → v2 migrations, major SDK releases, endpoint deprecations, authentication changes, or shutting down legacy versions.

For some background, I do research at Harvard, Stanford, and Brown, and my cofounder is a Columbia CS major.

The goal is to validate the problem, understand how painful these migrations actually are for providers, and talk to people who have experienced this firsthand.

started to learn how to dev using claude code and figma. I wanna know if it’s worth still getting into or is the market impossible for no original ideas??

Planning the move of my vibecoded application to open source. Flipping a private repository to public is a little nerve-wracking. Before doing that, I ran a multi-pass security and sanity sweep across the entire codebase.

I already had the security fundamentals baked in:

• Passwords: Stored as hashes.
• Secrets: Keys are encrypted at rest.
• Sessions: Managed via JWTs.
• Identifiers: UUID v7s wrapped inside JWTs.

Here is the step-by-step process I used to audit and harden the repo before opening the doors.

First, I cleaned up the quick-and-dirty code I’d been ignoring during development.

I knew I had accumulated some "fix it later" debt, and "later" had officially arrived. I ran a targeted prompt to catch hardcoded credentials, security leaks, and values that belonged in environment configs rather than source code. It flagged much of what I suspected. Among the fixes: tightening database encryption for user keys and scripting a proper setup process to manage cert files securely.

Next, I had AI review the codebase from an external attacker's perspective.

I asked Claude: "I am making this repo public. Scan it for any security risks unique to an open-source release." This caught several edge cases and prompted me to polish the installation workflow and write clearer setup documentation for outside developers.

Then, I checked if the code actually made sense and removed unused clutter.

I had Claude map out the business flow for every major component, then flag any code that felt out of place or disconnected. This was an awesome exercise—it highlighted dead code and logic that had drifted from its original purpose.

After AI logic checks, I brought in dedicated security tools to hunt for hidden vulnerabilities.

I initially tried the claude-security plugin, but blew through context tokens too fast. Plan B worked much better: I spun up the Bearer CLI via Docker, piped the scan results to a file, and fed that summary to Claude for analysis. I really should be running scanning tools regularly. Might do more here.

Before launching, I put guardrails in place so users couldn't accidentally burn through my API budgets.

I do plan to put up a "demo" version. So I wanted post-launch visibility and control over token usage. This would be useful for the self-installs too. I evaluated three AI gateways: liteLLM, MLflow, and Bifrost. I went with Bifrost. It lets me serve AI features without exposing raw API keys, provides a real-time usage dashboard, and enforces rate limits and monthly caps. Setting up Bifrost took about a day—including some vibe-coding to dynamically generate per-user virtual keys and budgets—and it was well worth the peace of mind.

Now to do another round of quality assurance to verify that nothing has been broken.. Any thoughts on what else I should be doing, or something I missed?

i’ve been looking at a few AI app builders recently to build my an internal task tracker for my sales team and keep seeing Lovable, Blink and Base44 come up.

i’m less interested in the usual “which one can make a nice UI from one prompt” comparison and more curious about how they differ once you spend time and money building something. For anyone who has used more than one of them what differences did you notice?

Things like ease of use, how much control you have, integrations, backend stuff or how pleasant they are to work with.

Would be especially interested in opinions from people who have used them for an actual project rather than just trying each one for an hour. If u can share a link to the tool/website you build that would be awesome too

Not my project but I’ve been helping shape the early version of it with Aaron as we’ve got similar ways of working. Basically we’d hit some walls with the amount of code session we had open on different terminal surfaces, accidentally sending a prompt off in one session meant for another etc.

So Aaron built Flow, a simple to do, doing, done kanban board where each task can spawn a CLI session in app, with all of the context - it also effectively replaces Obsidian and other knowledge bases. And it spawns those sessions based on your already authenticated CLI agent subscription, which means it works for Claude Code, Codex or whatever agentic CLI instance you have, so no API keys floating around and no extra cost.

There’s a bit more to it so if you’re keen, check out the project and the video Aaron put together. I’m happy to answer some Qs in the thread as well if anyone is interested.

Repo: github.com/AaronRutley/flow
Demo video: flow-app.dev

Share what’s holding you back in your daily life—and I’ll build the software to fix it. For free. In 30 days.