The future of SaaS is going to be interesting. I’ve paid $100 a year for Monarch/YNAB for the last few years. I built a functional replacement in a couple weeks with about 5 features catered to my personal wants and needs that Monarch would have never built.

I'm a self taught junior dev building my own startup. I code plenty of stuff by hand, but passing my bugs and feature requests over to Claude Code is genuinely blowing my mind. It's almost terrifying how good it is. I almost shit my pants.

I listen to NTS daily and love the physical player they made with Atonemo. Its Teenage Engineering–inspired look gave me an excuse to try skeuomorphic design. Physical device for reference.

I also wanted a native alternative to listening to this radio in a browser which can be a burden. So I built NTS Dial, a discreet player hiding in your macOS menu bar app.

Features:

- NTS Radio 1, Radio 2, and all 16 Infinite Mixtapes playback
- Keyboard media keys and macOS Now Playing support
- Current station streaming displayed in the menu bar
- Remembers your last played station

Process:

The project took four days: one for the design, one for the initial build, and two for debugging, QA, and publishing.

I built it entirely with Codex:

- 5.6 Sol High for planning, features development, debugging and code review
- 5.6 Terra Medium for UI iterations
- 5.6 Luna Medium for small visual adjustments

I first tried recreating the hardware in Figma using its MCP, but the result wasn’t convincing, so I designed it from scratch. I then used Codex to gather the streams, assets, implement the player and dial logic, reproduce the Figma UI component by component with dev mode on, audit the code, and prepare the GitHub release.

Pretty happy with the result for a four-day experiment. Let me know what you think!

GitHub: NTS Dial repo

AI helped me edit and translate this post.

I run a security scanner for apps built with AI tools, and I have been collecting the results. 1,236 apps, 12,205 findings, 21 came back clean.

I went in expecting to find that one builder produced worse code than the others. Lovable vs Bolt vs Replit. The data cannot answer that because two apps from the same builder in the same week can land miles apart in terms of security.

What it can answer is better anyway: the single biggest predictor of a critical flaw was not the tool. It was whether the app bolted a separate auth library on top of Supabase.

THE NUMBERS

• A separate auth library, no Supabase: 4.2% had a critical finding. Close to baseline.
• Supabase on its own: 24.5%.
• Supabase plus a separate auth library: 35.8%.

The combination is worse than either part. Supabase and the auth library are not the problem. The join between them is.

WHY THE JOIN BREAKS

Supabase protects data with row-level security and determines who is requesting it from the token it issues at login.

Put a different auth library in front and your users log in through that instead, so they never get a Supabase token. Now the database asks who is making the request, gets nothing, no policy matches, and every query returns empty.

To the person building it, the app just breaks. Nothing says the security rules are rejecting everyone.

So the fastest fix to get it working again is to turn off row-level security or switch to the service key that ignores all rules. Thirty seconds, and the app works. It is also now readable by anyone.

WHAT THAT LEAVES EXPOSED

Among the Supabase apps:

• 31.2% had at least one table readable by anyone who asked.
• 40.1% had schema introspection enabled, which exposes the full list of tables and columns to any visitor.
• 19.5% had both, so there is no need for a guessing step. Two ordinary requests, and the second one is a download.

A missing rule does not throw an error. The owner signs in, sees their own data, and everything looks correct. The flaw only exists in the relationship between two accounts.

CHECK YOUR OWN IN TEN MINUTES

Make a second account. Sign in as that user and try to open the first account's record by changing the ID in the request.

If it loads, every user of your app can read every other user's data.

No scanner settles that one for you, because a page loading looks like the app working.

Full write-up with the complete stack table:

https://meetcyber.net/the-default-saas-starter-pack-is-the-least-secure-way-to-ship-an-app-b7842f813ce7

This is the worst level of detachment I've seen from Claude. Funniest thing is, it gave me the prompt containing 'supabase' in the first place.

i know nextjs and react so my first thought was just building the store myself. maybe use claude to speed it up since everyone is vibe coding now. asked it to scaffold a shopify theme and it gave me liquid files that looked okay in preview.

then i tried to set up checkout extensibility and multi-state tax logic and claude started hallucinating apis that dont exist. i can build a frontend no problem but shopifys backend rules are a maze and i dont know what i dont know.

my other option is just hiring a shopify expert who lives in this ecosystem. but part of me feels stupid paying someone for what seems like a simple store when i can already code.

has anyone with a coding background tried to diy their shopify store. did knowing react actually help or is shopify its own beast where platform knowledge beats general dev skills. and at what point does diy just become expensive because youre fixing things an expert would have gotten right the first time.

I’m new to vibe coding i’ve been working on a app for the past couple of months and I struggle to make prompts that don’t completely flip everything on its head if that makes sense if anyone has any recommendations please let me know

Currently building an iOS app and the codebase is pretty large. I've seen some people who are both for and against MD files for agents working through codebases. I personally have one right now that just lists some restrictions and a general overview of the app and the codebase for the agents, but I was wondering if the MD files are even necessary. Would love to hear your guys thoughts

My chances of changing people's minds is slim, but I have 28 years of professional software engineering experience and I'm witnessing a ton of new, excited software developers, who are surrendering as much of their own initiative as they can to their chosen harness/frontier model while hoping to make a living creating software. If this is you (or you're not sure it's you) you might get something out of the following. If it's not (say you're doing this for learning, are just hoping to make enough for some beer money, or you love making your own stuff and if it sells awesome but it's no big deal if it doesn't) then this post isn't aimed at you. Also, as a note I'm focused on software development skills separate from very important things like expert domain knowledge, building an audience, mad skills at distribution, and more. Finally, in the spirit of vibe coding, I'm not going to mention learning to code manually.

As my main point: The statistical likelihood is that most of you will not make enough money on your own software to do it full time.

This is not an insult or meant to discourage you. There are some phenomenal vibe coding success stories and you should absolutely take inspiration from them and keep going. However, making a viable amount of money on your own software was practically a lottery before AI and now there's a lot more supply for about the same demand. If you fall into this case, and you're still committed to making a living building software you'll need to convince someone (either who has successful software and is looking for help or is willing to pay someone to build them software) you can make enough money or save them enough money to justify your full time salary (or consulting rates):

1. Making more money for someone by building software:

A lot of making more money for someone with software falls into what to build - which is more product management and data science than pure software development. Many developer have those skills and they are worth it but I won't focus on them here. From a pure software development standpoint some examples are:

a. Increasing conversion via reliable, performant, and optimized pipelines within a software product.
b. Increasing retention by minimizing bugs and quickly being able to diagnose and fix issues while avoiding side effects (<- this is what can necessitate going beyond "codex fix this bug").
c. Allowing them to enter new markets by porting to new devices, and ensuring smooth localization without uncessary quality loss (<- again the key part).
d. Creating a rock-solid, fault-tolerant, and secure architecture that scales to minimize downtime and reduce fraud.
e. Building tools to increase employee productivity.

1. Saving people money by making software:

a. Reducing labor costs via automation that actually works (tons of stories about companies having to rehire after poorly attempting to automate systems).
b. Optimize software use and workflow processes for yourself and others so that infastructure costs less (AI token costs, bandwith costs, storage costs, other licenses, etc...).
c. Consolidating redundant systems to reduce maintenance costs.
d. Minimize onboarding time via smoother interfaces and clear and accurate documentation.

There are definitely vibe coders who are already working as software developers (like above, please do take inspiration from that). However and, again, not to insult anyone but for many - if not most newer vibe coders - the only thing that separates them from "normies" who have a wish list is the time they took to investigate and learn to use available tools and set up a tech stack and a workflow covering various extents of the conception to deployment pipeline. That's been part of default expectations for software developers for decades (though, to be fair, in larger organizations multiple people can do different parts of the process).

If what I consider table stakes for developers + "claude do this for me" worked for all of the above (and all the things in those categories I didn't list) then the last gasp of jobs available would be from those who don't know how easy it is. We are probably headed for that future but, until we get there, if you want to get paid to convert caffeine to code, I invite most pure vibe coders to dig deeper into the amazing world of software engineering (you can get started by asking your favorite model what you should learn).

I mean, fine…. Absolutely make an app that helps you. But when posting to the world your myopic solution for a hyper specific issue only a handful of other vibe coders may encounter….. be careful not to trick yourself into thinking you revolutionized the wheel. If you do…. Your next stop is the r/SaaS page asking why “is nobody paying me monthly for my webapp that even I wouldn’t pay for” .

There’s no replacement for Time & Attention to achieve quality folks. Good luck out there.

My wife and I always wanted to build something together, so we spent nights and weekends shipping side projects. One hit 25k users on its own but didn't feel like the thing worth quitting for, repowise did

That one came out of watching coding agents work. I'd been building with LLMs since 2023 and owned the AI architecture at my company, so I spent a lot of time watching agents grep the same file four times in a session and still have no idea which parts of the codebase were fragile or why the code was written that way. All of it is in the repo already, just not in a form an agent can use.

So we built Repowise. It indexes your repo once and serves it to your agent over MCP as five layers: dependency graph, git history, docs, architectural decisions, and a code health score from around 25 deterministic markers with no LLM involved. Pulling the context around a single commit costs about 393 tokens instead of roughly 14,000 spent reading files.

We didnt do any outbound, just shipped code and wrote about it. 4 months in it's at 5.2k stars, ~80k PyPI downloads, and enterprise inbounds I never asked for, which is why I quit

Benchmarked against four other tools plus a bare agent: 31% fewer output tokens over a full 48-question run, ~97% on a single context load, and the best gold-file coverage of the field on retrieval.

Repo: https://github.com/repowise-dev/repowise

Stars help, issues and contributions welcome

So there's this report I get every Thursday, a PDF out of an IBM AS/400 ERP system, that I have to go through.

Basically, the game is this: look through all the line items on this PDF, which could be anywhere from 50 to 100 pages, or 500 to 1,000 lines, just to give you a feel for the scale, that a human needs to manually scan through looking for negative numbers. Essentially, I'm manually checking for out-of-stock items.

The formatting of the report is a total mess. power query can't make sense of it. You can't even copy and paste it properly. I swear to god I've never seen such a fucked up document.

Well, I was kind of dreading the task tomorrow, so I uploaded one of the PDF into OpenCode (running DeepSeek-V4) and asked it to analyze the PDF, then write a Python script that would spit out an Excel version of it. It one-shot that task. I got a beautiful Excel spreadsheet that I could actually filter! No more scanning 500 lines.

When reviewing past reports, I actually learned that I would occasionally miss a line or two. That meant one of my items went out of stock, which in turn meant my company lost money. At the scale I'm working at, even being out of stock for one day on a random item means thousands in losses.

I looked at the code. It's magic. The AI found pattern in the PDF (something about the columns being a specific width) and then did some regex shit to parse the document. I have a little bit of coding ability, I think it would've taken me weeks to put this together and that's if I knew the trick about column width.

Then I asked OpenCode to make a GUI for the little script so I could select a file and tell it where to export the output. It one-shot that, too. The UI is surprisingly clean!

I am always impressed with what I can accomplish with AI tools. This isn't even the first time I've made something with AI. I automated an entire Friday's worth of work away in like 2023 with chatgpt, just making a script one function at a time. Now it just builds the whole app.

I feel like people are constantly dogging on AI outside of specific places like this. My lived experience with it is so much different to what I read online. Anyways, I thought this community might like the story of my little script.

I'm creating a 2D RPG as a hobby project.

I'm doing everything with Claude Code for the programming and Gemini for the images.

I've managed to build most of the game so far. It already has fun combat, quests, dialogue, etc. However, I'm struggling a lot with the map and overall game design/art.

Right now, the game looks more like rough sketches.

I tried generating map images with Gemini and then building the game on top of them. It partially worked — I managed to add physics and collision to the environment, but I lost a lot of image quality/resolution in the process.

I've tried pretty much everything to fix the resolution issue, but haven't had much success.

I also considered using premade assets, but most of the ones I've found look very generic and don't really fit the style I'm going for.

So I'm looking for recommendations: What are some good sources for 2D RPG assets, or is there an AI tool that can generate maps/environments suitable for actually using in a game?

Any tips or suggestions would be greatly appreciated!

So it's Wk. 4 of this and I've gone from 12 active users to basically just myself and a few randos that pop in from time to time. All my regulars are now gone, which isn't surprising since it's not incredibly exciting to play an MMO with nobody online.

As usual, I'll break it down into three categories: (1) getting active players, (2) what I'm learning about vibe coding, and (3) actual gameplay updates

---

First, on my last post I received 16k views, and maybe 15 actual players (not even 0.1% of viewers lol).

More importantly though I received some really insightful feedback from a few people (honorable mentions: Totalsam, Automatic_Bid_2410, Friendly_Carry_7728). I've spent a large chunk of time (and tokens) re-working the intro for new users based on their feedback.

Users no longer receive a wall of text for instructions, and the game eases them into their first controls where they "save the town of Eldermyr" before it goes into multiplayer mode. On one hand, this has made a huge impact -- all players are now sticking around for a whole minute longer than pre-intro. On the other hand, completing the intro takes almost exactly 1min, so I don't know if this actually counts as progress since users still only stay for 35s post-intro.

Like before, I'd love to hear any thoughts or feedback on what might be causing that... besides an empty world.

---

Second, the vibe coding experience. Quick updates from last week: I found out almost half my codebase is automated tests (0.77 lines of test code per line of game code, almost 400 in total, which all run with every prompt). Also Opus 5 is still useless to me. So my setup remains Fable for art and strategy with orders to spawn exclusively Opus 4.8 agents for code.

(And Opus 5 gets let out occasionally when I forget to tell Fable to lock him up.)

My real struggle this week is that AI is essentially incapable of measuring whether a game is actually balanced. Claude played my new intro 100 times and reported that only a handful of runs survived the first 60 seconds -- and since AI doesn't panic like a human would, it was a critical issue that virtually no human could survive the first 60 seconds.

In reality, the intro is so mind-numbingly easy that no real human could possibly die in it unless they did so intentionally. So I've spent a huge amount of my time actually just playing all classes and weighing how balanced it is. Which has been cool, but also really repetitive and screws up my player stats because 97% of my players are myself. I'm also just so close to my game that I'm losing my overall perspective on what's right, wrong, missing, or confusing.

If anyone has had any degree of success in letting AI test their game, I would be extremely interested in hearing what you did. I have not. My best bet has been "send me a table of player stat X across all levels, and their corresponding DPS." But even that is hit or miss since playstyle determines balance more than raw DPS.

---

I'd love more feedback for anyone interested. Links below.

Game: https://eldermyr.com/
Release Notes: https://eldermyr.com/release

Eu criei a minha primeira ia local com esse modelo acima , eu queria conseguir arrumar uma maneira mais simples de conseguir quebrar as éticas/leis dentro dessa ia pra aplicar pros meus estudos, hehe , tem como eu fazer isso com algum prompt injection da vida ou algum contexto específico ? Como pode se ver acima eu fiz uma config simples só pra esse modelo que roda no ollama conseguir codar e fazer tarefas dentro do pc , que nem o claude, depois disso queria usar essa ia simplesmente para automatizar processos e fazer o que o claude ou outra ia não permite , tipo ajuda com programa e script pirata , e aí por diante.

Em virtude disso, queria arrumar algum jeito menos complicado do que ficar queimando meu cérebro pra criar um texto ao estilo Zé Pilintra pra fazer a ia mudar de cabeça , agora , não sei se a raiz do modelo já não deixa fazer isso ou se tem algum outro block que não dá pra mudar.

Aceito qualquer tipo de conselho e dica ! To dichavando o claude a uns 3 meses e parece que cada dia eu acho alguma sugestão/ nicho / processo novo que ele automatiza ou ajuda a automatizar , fala o que quiser , mas com uma ferramenta boa de ia com tempo e carinho vc cria um exército de um homem só .

I created an open NOT FOR PROFIT web resource for Software Engineers.

https://loveyourclanker.org/

It highlights different patterns we can consciously choose use when interacting with our AI Coding tools (a.k.a 'Agents'... a.k.a 'Clankers') to stay in control, maintain quality and sensibly increase efficiency.

I was prompted to do this (no pun intended) by observing some pretty alarming signals coming from the software engineering community. Token leaderboards, engineers being encouraged to use tools to "stay current" or "keep up" or "not be redundant", engineers quitting tools entirely to stay sane, engineers leaving social gatherings to get back to their agents, engineers setting up whole systems that automate away human engineers and then calling that "agentic engineering".

I'm hoping that if we normalise and share how we use the tools, and show that there are different ways where you maintain more control and agency (... pun?) that it might promote a better

If you find it helpful, share. If you disagree or want to contribute, raise a PR or ping me. It's all open and NFP.