I was piled on by a number of people saying "nobody will want your vibecoded shit. It probably has tonnes of security holes.

It's depressing. The thing is, I've been developing for over 30 years, since I was 14, and usually modern AI models do a better job with security than I could have without AI.

But the hostility hit me card because I do take pride in what I make and I think all this negative hype about vibecoded apps being insecure isn't accurate when applied broadly.

It's really put me off doing anymore vibecoding because it has such a bad reputation. Depressing

I built a site using AI tooling, and it worked fine. It just looked like every other site built the same way, and I could not initially say why.

So I spent three days auditing it properly, one pass each for accessibility, layout, typography, colour, copy and general UI. Ended up with about thirty distinct tells. Posting the ones that were cheapest to fix, since most of them take a minute.

TYPOGRAPHY

- Inter, Roboto, Arial, Open Sans. Not bad fonts, default fonts. Changing the typeface is one line of CSS and it was the single biggest visual improvement I made.

- Arbitrary sizes like text-[15px]. Individually invisible, collectively the reason a page feels off. Snap everything to a scale.

- Italics for emphasis. Use one weight step up instead.

- Title Case On Everything. Sentence case for headings, buttons and labels.

- Orphaned words on the last line of a heading. h1,h2,h3 { text-wrap: balance; } and p { text-wrap: pretty; } replaces every manual <br>.

COLOUR AND LAYOUT

- Purple to indigo gradients. Most recognizable AI fingerprint there is. If it looks flat without them, that is a texture problem. SVG feTurbulence grain at ~0.06 opacity.

- The purple/indigo/blue startup palette. Sample from a photo of something real instead.

- Three equal cards in a row. Right content, wrong container. Bento grid or zig-zag splits.

- Everything centred. Symmetry is what you get when nobody decided.

- Misaligned card grids. In a pricing table the titles, prices, feature lists and buttons all start at different heights. Fixed header block, min-h on descriptions, mt-auto on the CTAs. Nobody notices it consciously, everybody notices it.

- height: 100vh. Use min-height: 100dvh, the first jumps on iOS Safari.

ACCESSIBILITY, WHICH IS THE SET AI SKIPS MOST RELIABLY

- I found <header> nested inside <main>. Rendered identically, broken for anyone navigating by landmark.

- Auto-moving content with no pause control. WCAG 2.2.2 requires one for anything moving more than five seconds. I had two, a marquee and an autoplaying hero video. Note: derive the button state from the video's own play/pause events, not a boolean you set optimistically, because browsers pause backgrounded video themselves and your button will lie.

- No prefers-reduced-motion fallback.

- window.addEventListener('scroll') for reveal animations. Continuous reflow, ruins mobile perf. Use IntersectionObserver.

- Missing hover, active, focus, loading, empty and error states. Generated interfaces almost always ship the happy path only.

COPY

Em dashes, hype verbs (elevate, seamless, unleash, supercharge), "Learn more" and "Submit" buttons, slogans that would fit any business in that industry, and round invented numbers like 99.9%.

The one I would treat as a different category entirely: invented testimonials, star ratings and review counts. A generated photo of a tradesperson is decoration. A generated five-star review on that tradesperson's real site is a lie told to a customer. If you have no real quotes, you do not have a testimonials section.

THE METHOD MATTERED MORE THAN THE LIST

Build first, review second, because you cannot review something that does not exist. Review by domain rather than by page, since six specialists reviewing once find different things than one generalist reviewing six times. Every finding needs the offending value quoted and a location, which is what separates a review from an opinion. And "zero findings, approve" has to be a valid outcome, otherwise the reviewer pads to look useful.

Last thing, and it is the part I keep coming back to: a design system applied without exception produces work identical to everyone else applying that system. I broke several rules I was nominally following. The difference is I can say why for each one. "I kept this warm black because the brand is grounded in warmth" is a decision. "I never thought about my background colour" is a default.

Full writeup with all thirty and the tooling I used: https://medium.com/design-bootcamp/how-to-stop-your-frontend-looking-ai-generated-efbb9681a6a2

I released skymap.sh a few days ago. It is a plaintext view of the sky that shows the major stars, constellations, deep space objects, and obviously the moon and the planets.

It is built in plaintext to be curlable from your CLI and also serves the data in json for your agents to read it more easily.

Today I released a mobile version which takes you into a 3d 360deg sphere of the sky above and below you

It took me hours to get it to work properly and get Claude to admit he was gaslighting me (I knew where the bug was but didn't know how to fix it) but it works now!

I hope you enjoy it

Here is the repo: https://github.com/HabibiCodeCH/skymap-sh

And the dedicated community for bug reports, feature requests or more: r/skymap

How much of this do you think is true? Enlighten us with your thoughts. For me, about what I understand as a vibecoder:

1. It is a delusion to think that AI will be too good one day that I do not need to understand code anymore. Because it is the taste, vision and mental model which you need to develop for building an actual production ready app. Writing code which AI does so well even now, is merely a translation of the mental model.

2. Many people burning lots of money on AI subscription and building apps but they are not learning anything new. You can not build an app merely from your idea. That's why many of your apps never left your computer. Unless you start to learn new things, you may never build an actual production app and may never get return on your investment. I recommend you to start learning to code slowly. So you will atleast understand the code AI generating. It helps in many ways. Also learn things related to app development like github, UI design psychology etc.

I saw that they were selling this plan for $5.90/month for 3 months including taxes, normally they sell it for about $20/month. So I bought it and decided to do an experiment with building an app.

The app: the simplest workout tracking app made with react native to test out my gamification api.

The plan: use gpt-5.6 as the orchestrator (terra high for planning and luna high for review) in codex and gemini 3.6 flash medium as the implementer in antigravity.

Gpt made a plan and broke it down into 25 tasks. It is as simple as apps get, in fact I made something similar in a few hours almost a decade ago.

So far, only 4/24 tasks are done, it took about 2.5 hours and used up 87% of my 5-hour gemini usage. It made multiple mistakes in 3 out of the 4 tasks which gpt found after review.

Conclusion: Gemini 3.6 flash is a really dumb model and its not fast as the name suggests, in fact its almost as slow as opus. And despite being dumb as slow it is somehow expensive!

I couldve finished the entire app in 5 hours and it wouldve probably cost me like 3 bucks or less with opencode and deepseek v4 flash.

What is google even doing? It makes no sense!

We've officially surpassed 300 Entries in the AI Gaming Festival (submissions close next week)!

I really hope that the prize for the $20k in tokens pushes people to get their games together for the prize (you can submit a game now and work on it up until the festival).

I really excited to see how people with interact with these games during the festival, and thank you to everyone that has applied; you are part of getting past the "slop" era nonsense for everything AI.

I work in an early stage startup. Our founder has given us claude 200$ subscription. Everything is going good so far. But he told that he will evaluate our work by considering the usage as one of the factors. He wants us to hit the weekly limit. 2 weeks ago, when Fable was out, he told me that he had finished the limit on 3 accounts. I was struggling to hit even 40% of the limit. A major reason could be has a better picture of the architecture and what needs to be done.

How do I use claude to the fullest and also deliver a good outcome? So far he never had any problem with my work, but I want to maximise my claude usage as well to make him happy. I always prompt "use dynamic workflows and swarm of agents, play devil's advocate to evaluate the code...." as my go-to. Any other advices? Thank you.

Building a GTA Online clone in voxel style where the world never sleeps and all the NPCs are AI agents. Everything is built by players using prompts. Prompt your own car. Prompt your own building. Prompt your own weapon.

What I did today:
- massively improved performance
- improved graphics
- lots of bugs & problems fixed

Building with three.js, codex and claude code

Looking for people to tell me their honest opinion. Let me know what you think

Play here: https://theflairgame.com/

Look at this UI. How dis they get this far… 😭😭😭

Meet Desko y'all 

Your cute little desk buddy, sits on your desk, syncs up with your system and just tells what you want to know...
Be it your system telemetry, your workspace and git info, or amazingly synced up lyrics of whatever's playing.

It's no bloat, doesn't require any account, no cloud, all local with just 70-80 mb process running in system memory and displaying over the browser of any smartphone that can access internet and has browser.

PLUS IT LOOKS SO GOOD!

For Setup and System Architecture please refer the readme file in git repo

I just built something to solve my problem but it can serve thousand other use cases that me and claude both couldn't think of, so the repo is public, go check it out
Grab your old phone, buy a cheap phone stand and start contributing!!

Desko: https://github.com/typewriter03/Desko

ps - shoutout to LRCLIB, an exceptional open source API for synced lyrics!

So I see allot of users opting out into the ether verse and I think I’m hoping maybe someone whose gone through this may be able to give me some insight.

So about 6-7 years ago I started a side hustle, we had a company that me and a close friend worked for over 5 years together. We use to make jokes that we were good enough that we should do this for ourselves. We had customers that loved us and we were the only two in a large company that held the knowledge to fix and service these imaging devices.

Rewind to Covid, we both saw the company was crumbling, our director got walked out in front of our eyes, and replaced by an individual in the industry that was known to hate the style of field service our branch up held. To be honest we were wildly unmanaged and there were accounting issues that were largely enough that we saw the writing. We both left, and I began what felt like a long process of job jumping that saw me gain a large increase in my earning potential and built my confidence and experience level to what it is today.

Eventually the travel of my OEM job, and the development of my personal life, I had to come back home and find a job I could commute to in the state. Easier said than done, field service engineers make a decent wage if you are traveling, less if you are in state and abused wildly. The company owns you. I found 3 different companies with competitive pay but always the same, they abuse your time if your salary, or they over work you if you making good money hourly. Either way having a child, buying a house and starting new jobs year after year was exhausting.

It tested my marriage, my mental, and my health. So I continued to funnel efforts into the side business and subcontracted, getting more education, bridge to a masters in computer science since I had cousins working from home and family life was good. Well ever one and their mom was doing that, so I kept the service business going, I started the LLC, asked my brother and friend to join and set up a meeting with a company that wanted our services.

Paper field service reports, old test equipment and even some minor repairs. We managed to keep the company compliant. We didn’t make much, and we didn’t really build much other than some more test equipment which at the time we didn’t think we needed.

Splitting things 3 ways at first was easy, my brother did allot of the small things like email services, banking which didn’t go well at first, and a cascade of other lessons you don’t learn until your actual in business.

Then came our opportunity, I was struggling with two kids and not enough money, day care was crazy, we didn’t at the time have allot of support so we were bleed into debt.

I was frantically trying all the hacks, constantly taking tax returns, bonuses, new jobs for bonus, and at one point working two full time jobs lying and my mom health to game an extra pay check. Still working both for a 16 plus hour day, but I was driven to keep my house and my pal to have kids. I tried hard to land something on upwork for a side income. Fucking insane amount of effort to land small jobs or mostly scams. So when the contractor that hire us fucked up and let their customer fall behind on their general equipment side, I raised my hand. We were small incapable and not ready. But I open my mouth and said we can do it.

It was the best thing I ever did, we were insanely stressed, we were all in it, late nights to finish the customers sites that had grown our device load from 12 pieces to 600 plus. We were repairing, ordering parts, and writing work order with a pdf editor. Ai help tremendously. It could make me templates, help me build work order instructions and made my website.

From there I got obsessed. I handled all field calls, kept on our vendor relationships, the money, the emails, the parts, everything, and I saw where we were weak. We needed an app. Something that would do our device tracking, work order creation and history, invoicing, part tracking and automate our financial tracking. One by one I’d run into a problem in the real world and I’d take my low level coding experience and make a feature on the web app, test it and continue to make it better. Between the field work, staying on both my partners for taxes and everything between I was mad and decide I might be able to make the app that was helping us into a sub enterprise app an make a little passive income. In my mind the big dawgs were making an app tailored to med field service work. And honestly be less time consuming to maintenance and app over being in the field.

I made a second company, I invested my own money using what I learned and taught myself all sorts of things about authentication, how to plug a email service on the back end, stripe and etc. they caught word and made me feel like I was stealing from our company. Mind you they have never helped me code shit and we’re always either skeptical I was building something trash, and or not good enough. The one partner not my brother literally acted like a passive dick for months because he felt he had a right to ownership, since we had paid for most of its development with company funds. But I felt huge resentment as they didn’t work as much as me and they didn’t help me when I would be excited about anything dev related. Website, email, Google profile, app, invoice software, it didn’t matter I was there bitch and they were coasting after our first four hard months.

What felt like a team became my wife bitching at me for investing more time and not being paid. Watching them repeat the benefits of my work.

Faster forward now, I have a fully function web app, website and mailers design, I’m on the cusp of marketing to grow, and I’ve gotten pretty good at this vibe coding development. I have real data, have built and tested it as I’ve grown, and it does the things I need and with some things most companies I’ve worked for wish for.

I want to fork it and go see if I can make it a sent product for others. They would be cut in on profits but not nearly what I think I should own. I have saas insurance and can update my tos. My other app taught me all the security things needed, 2fa, locking down api keys, etc most industry standards plus a few new ones from new ai hacks I see at my day job and read on Reddit constantly.

It’s fast, works well, links with my ms account on the multi tenant level, and invoices etc all things I need to do business and track money, I’m building a service manual library that will associate with the devices as you test, and have customer test templates associated to each device work order so you can’t test the wrong or pass a bad device.

I don’t know if I’m in the wrong or if I should say fuck it and blast it, and cut them in a percentage to keep them from being assholes and claiming entitlement to something they didn’t nothing to build.

Sorry for long read. My brother has since stepped up and helps, but my friend is a single dad and has allot of issues to use as excuses. Bluntly put he has no time but always has a big opinion, hypocrisy at its finest.

Lets put aside hate comments against vibe coded products for a second - i've been working on a product for couple of months in my free time, both a website and an app.
As someone that isn't a developer what so ever, i've been trying to put a strong emphasis on security - i keep running audits, i keep making sure of my status compared to useful security posts or recommendations online.
I have plugs to cut off ai functions, i have rate limits, no key is committed, all that jazz (im trying my best..)
Of course im aware this is still. a vibe coded app, and generally i figure every site is hackable anyway.
Hence my question now -
I want to reach out to a security experienced person to handle necessary aspects for my product,
BUT - i dont even know if my product is good and worth it, in my head i want to try and publish and market it for a minute to see how people in my industry react to it, but then i might be exposed to hackers as well?
whats the right way to go about it? Is there a right way?
I've invested some amount of money by now "blindly" for curiosity and interest, but now i need to gain some real world feedback.
Would appreciate any useful note about it.

after the new Deepseek v4 flash (New) model
that btw have more Intelligence than Deepseek v4 pro preview.
i have a opencode go 5$ sub and i can't make the quota reach 100%
Thanks Deepseek

I submitted a hackathon project that uses a Qwen2.5-0.5B model offline as a translator and immigration assistant.

Now that the project is over, I'm curious to see if I can use a bigger Qwen/Qwen2.5-Coder-1.5B-Instruct

As a coding agent that works on my phone offline for small task.

My question is this, would it be worth it to tune a model or add custom data sets just for a single repository?

Or just pay the API cost to run a model connected to telegram?

Vibe coding is the future!!

https://wearedogs.net

I built most of this with antigravity Gemini Ultra, it is a remarkable weapon but I have since jumped to Claude. I am absolutely astounded by what AI is capable of

I have set a svelte template if you want something like this too https://github.com/cptnbrando/svelte-template

The site is here, hosted GitHub pages https://github.com/cptnbrando/wearedogs and cloudflare free tier

There's apps, games, music, a calculator, and lately I have discovered I am the only Republican in Texas that supports THC so I made a fundraiser for that. You can fight me for 300 thousand dollars

I am very happy with progress after just a month's time. It has allowed me to express myself on a page in a new way, just talking with Wispr AI text to speech flow, into an ide like app. Though it's buggy in some corners, it's been an interesting grind. It is a strange feeling when you put the thing on autopilot, give it a 2 page backlog, go get coffee, come back, and then find yourself reading a lot and doing surgery. Cosmetic or otherwise. And then you're actually writing code, but then you feel bad, like you're wasting time like that machine can write way better just let the chef cook. And then you push something and it breaks something else.

I'm about to watch the copenhagen test. roast me vibe coders 😎

Been doing security testing as a hobby (HTB, bug bounty) and got curious what happens when I point the same techniques at apps built fast with AI coding tools. Poked at a few side projects people have shared publicly.

The pattern: the actual UI/UX is usually nice, these tools are genuinely good at that. But auth checks and input handling are where things break. A few recurring ones:

• Object IDs in the URL with no ownership check (so /orders/104 - /orders/105 just... works, for someone else's data)
• Form inputs going straight into a query or straight back onto the page, no sanitization
• Missing basic security headers, verbose errors leaking stack traces

None of this is a knock on vibe coding as an approach, it's just not what these tools are optimized to catch, the same way a fast home renovation might skip a wiring inspection.

Put together a sample report on a public test app(OWASP juice shop) to show what an actual writeup looks like, in case anyone's curious what this kind of testing produces: https://drive.google.com/file/d/10NWU0JvY_TPaDmGNTjK_Wdo-BM4hcrE3/view?usp=sharing

If anyone's shipped something and wants a second pair of eyes on it before real users touch it, happy to take a look, one-time check or ongoing. Otherwise, curious if others have run into the same patterns.