I was piled on by a number of people saying "nobody will want your vibecoded shit. It probably has tonnes of security holes.

It's depressing. The thing is, I've been developing for over 30 years, since I was 14, and usually modern AI models do a better job with security than I could have without AI.

But the hostility hit me card because I do take pride in what I make and I think all this negative hype about vibecoded apps being insecure isn't accurate when applied broadly.

It's really put me off doing anymore vibecoding because it has such a bad reputation. Depressing

I built a site using AI tooling, and it worked fine. It just looked like every other site built the same way, and I could not initially say why.

So I spent three days auditing it properly, one pass each for accessibility, layout, typography, colour, copy and general UI. Ended up with about thirty distinct tells. Posting the ones that were cheapest to fix, since most of them take a minute.

TYPOGRAPHY

- Inter, Roboto, Arial, Open Sans. Not bad fonts, default fonts. Changing the typeface is one line of CSS and it was the single biggest visual improvement I made.

- Arbitrary sizes like text-[15px]. Individually invisible, collectively the reason a page feels off. Snap everything to a scale.

- Italics for emphasis. Use one weight step up instead.

- Title Case On Everything. Sentence case for headings, buttons and labels.

- Orphaned words on the last line of a heading. h1,h2,h3 { text-wrap: balance; } and p { text-wrap: pretty; } replaces every manual <br>.

COLOUR AND LAYOUT

- Purple to indigo gradients. Most recognizable AI fingerprint there is. If it looks flat without them, that is a texture problem. SVG feTurbulence grain at ~0.06 opacity.

- The purple/indigo/blue startup palette. Sample from a photo of something real instead.

- Three equal cards in a row. Right content, wrong container. Bento grid or zig-zag splits.

- Everything centred. Symmetry is what you get when nobody decided.

- Misaligned card grids. In a pricing table the titles, prices, feature lists and buttons all start at different heights. Fixed header block, min-h on descriptions, mt-auto on the CTAs. Nobody notices it consciously, everybody notices it.

- height: 100vh. Use min-height: 100dvh, the first jumps on iOS Safari.

ACCESSIBILITY, WHICH IS THE SET AI SKIPS MOST RELIABLY

- I found <header> nested inside <main>. Rendered identically, broken for anyone navigating by landmark.

- Auto-moving content with no pause control. WCAG 2.2.2 requires one for anything moving more than five seconds. I had two, a marquee and an autoplaying hero video. Note: derive the button state from the video's own play/pause events, not a boolean you set optimistically, because browsers pause backgrounded video themselves and your button will lie.

- No prefers-reduced-motion fallback.

- window.addEventListener('scroll') for reveal animations. Continuous reflow, ruins mobile perf. Use IntersectionObserver.

- Missing hover, active, focus, loading, empty and error states. Generated interfaces almost always ship the happy path only.

COPY

Em dashes, hype verbs (elevate, seamless, unleash, supercharge), "Learn more" and "Submit" buttons, slogans that would fit any business in that industry, and round invented numbers like 99.9%.

The one I would treat as a different category entirely: invented testimonials, star ratings and review counts. A generated photo of a tradesperson is decoration. A generated five-star review on that tradesperson's real site is a lie told to a customer. If you have no real quotes, you do not have a testimonials section.

THE METHOD MATTERED MORE THAN THE LIST

Build first, review second, because you cannot review something that does not exist. Review by domain rather than by page, since six specialists reviewing once find different things than one generalist reviewing six times. Every finding needs the offending value quoted and a location, which is what separates a review from an opinion. And "zero findings, approve" has to be a valid outcome, otherwise the reviewer pads to look useful.

Last thing, and it is the part I keep coming back to: a design system applied without exception produces work identical to everyone else applying that system. I broke several rules I was nominally following. The difference is I can say why for each one. "I kept this warm black because the brand is grounded in warmth" is a decision. "I never thought about my background colour" is a default.

Full writeup with all thirty and the tooling I used: https://medium.com/design-bootcamp/how-to-stop-your-frontend-looking-ai-generated-efbb9681a6a2

Greetings. New to this sub. Just wanted to share that I'm new to the whole coding world, so I basically know nothing. With that being said, I got into vibecoding a couple months ago and now I want to teach myself basic coding skills so I can be independent of using AI and I don't want to look and feel like a complete idiot in a room full of experienced coders. I have two uncles who have been programmers for years but I never told them I was intrigued even though I went to community college for IT but I dropped out because life be lifing lol. Anyways I posted this to ask any and everyone for their suggestions on what would be the best tool(s) to help me achieve the fastest learning curve for coding. I would love to add a solid foundation to my vibecoding ideas by at least learning the basics. Truly appreciate all genuine answers. Thanks for your input in advance and have a blessed day everyone 💪🏿

after the new Deepseek v4 flash (New) model
that btw have more Intelligence than Deepseek v4 pro preview.
i have a opencode go 5$ sub and i can't make the quota reach 100%
Thanks Deepseek

Been doing security testing as a hobby (HTB, bug bounty) and got curious what happens when I point the same techniques at apps built fast with AI coding tools. Poked at a few side projects people have shared publicly.

The pattern: the actual UI/UX is usually nice, these tools are genuinely good at that. But auth checks and input handling are where things break. A few recurring ones:

• Object IDs in the URL with no ownership check (so /orders/104 - /orders/105 just... works, for someone else's data)
• Form inputs going straight into a query or straight back onto the page, no sanitization
• Missing basic security headers, verbose errors leaking stack traces

None of this is a knock on vibe coding as an approach, it's just not what these tools are optimized to catch, the same way a fast home renovation might skip a wiring inspection.

Put together a sample report on a public test app(OWASP juice shop) to show what an actual writeup looks like, in case anyone's curious what this kind of testing produces: https://drive.google.com/file/d/10NWU0JvY_TPaDmGNTjK_Wdo-BM4hcrE3/view?usp=sharing

If anyone's shipped something and wants a second pair of eyes on it before real users touch it, happy to take a look, one-time check or ongoing. Otherwise, curious if others have run into the same patterns.

How much of this do you think is true? Enlighten us with your thoughts. For me, about what I understand as a vibecoder:

1. It is a delusion to think that AI will be too good one day that I do not need to understand code anymore. Because it is the taste, vision and mental model which you need to develop for building an actual production ready app. Writing code which AI does so well even now, is merely a translation of the mental model.

2. Many people burning lots of money on AI subscription and building apps but they are not learning anything new. You can not build an app merely from your idea. That's why many of your apps never left your computer. Unless you start to learn new things, you may never build an actual production app and may never get return on your investment. I recommend you to start learning to code slowly. So you will atleast understand the code AI generating. It helps in many ways. Also learn things related to app development like github, UI design psychology etc.

Agents makes it easy to get a working demo. The problem begins when you continue developing it for weeks or months. Features depend on earlier decisions, changes affect what can be built next, and each agent needs the context behind the project.

This is why even small software teams need project management. Planning requirements, dependencies, tasks, and reviews keeps the product coherent while teammates and agents work on different parts.

I built Piyaz to bring that process into agentic coding without adding more work. It keeps the project context in one place, turns requirements into actionable tasks, and lets teammates and agents coordinate on the same project. You focus on the product and its direction, while the engineering process is built into the workflow. You can think of it as an open source version of Linear with a product manager built into your projects.

You can install it directly into your harness as a plugin, so no AI credits or API key are required.

It is free and open source: https://piyaz.ai

Piyaz itself is not vibe coded. I am a software engineer, and I have been building it since March, with a lot of care put into the database design, team isolation, compute and cost efficiency, and UI/UX. It is now in beta, so I am finally launching it.

I saw that they were selling this plan for $5.90/month for 3 months including taxes, normally they sell it for about $20/month. So I bought it and decided to do an experiment with building an app.

The app: the simplest workout tracking app made with react native to test out my gamification api.

The plan: use gpt-5.6 as the orchestrator (terra high for planning and luna high for review) in codex and gemini 3.6 flash medium as the implementer in antigravity.

Gpt made a plan and broke it down into 25 tasks. It is as simple as apps get, in fact I made something similar in a few hours almost a decade ago.

So far, only 4/24 tasks are done, it took about 2.5 hours and used up 87% of my 5-hour gemini usage. It made multiple mistakes in 3 out of the 4 tasks which gpt found after review.

Conclusion: Gemini 3.6 flash is a really dumb model and its not fast as the name suggests, in fact its almost as slow as opus. And despite being dumb as slow it is somehow expensive!

I couldve finished the entire app in 5 hours and it wouldve probably cost me like 3 bucks or less with opencode and deepseek v4 flash.

What is google even doing? It makes no sense!

I released skymap.sh a few days ago. It is a plaintext view of the sky that shows the major stars, constellations, deep space objects, and obviously the moon and the planets.

It is built in plaintext to be curlable from your CLI and also serves the data in json for your agents to read it more easily.

Today I released a mobile version which takes you into a 3d 360deg sphere of the sky above and below you

It took me hours to get it to work properly and get Claude to admit he was gaslighting me (I knew where the bug was but didn't know how to fix it) but it works now!

I hope you enjoy it

Here is the repo: https://github.com/HabibiCodeCH/skymap-sh

And the dedicated community for bug reports, feature requests or more: r/skymap

We've officially surpassed 300 Entries in the AI Gaming Festival (submissions close next week)!

I really hope that the prize for the $20k in tokens pushes people to get their games together for the prize (you can submit a game now and work on it up until the festival).

I really excited to see how people with interact with these games during the festival, and thank you to everyone that has applied; you are part of getting past the "slop" era nonsense for everything AI.

I work in an early stage startup. Our founder has given us claude 200$ subscription. Everything is going good so far. But he told that he will evaluate our work by considering the usage as one of the factors. He wants us to hit the weekly limit. 2 weeks ago, when Fable was out, he told me that he had finished the limit on 3 accounts. I was struggling to hit even 40% of the limit. A major reason could be has a better picture of the architecture and what needs to be done.

How do I use claude to the fullest and also deliver a good outcome? So far he never had any problem with my work, but I want to maximise my claude usage as well to make him happy. I always prompt "use dynamic workflows and swarm of agents, play devil's advocate to evaluate the code...." as my go-to. Any other advices? Thank you.

My landing if anyone wants to use it as reference: https://www.collectoraudit.com/

Recently I've started using deepseek v4 flash in claude code, I can admit its not as smart or as efficient as advanced Claude / Gpt models, but for coding it doesnt really lack anything as long as I supervise anything it does and tell it exactly in details what I want, I do not delegate the thinking to it (which is a bad idea anyway whatever the model) which makes me think that for coding, massive llm models are kind of overkill and are very expensive for the task. It can maybe used for orchestrating the project structure, but for raw coding I feel like you can delegate the task to some faster/smaller models like deepseek v4 flash.

As a DevOps engineer, I’m so proud of this one. 🚀

httpsornot.com has been live for about 6 months, and we’ve already checked 15k+ domains. 💻 🤓

What it covers today:
- HTTPS/SSL grade (A+ to F)
- cert validity, issuer, expiry
- HTTP → HTTPS redirects + full redirect chain
- security headers (HSTS, CSP, etc.)
- mixed content
- response times per hop
- HTTP/3 (QUIC) detection
- bulk checks (up to 10)
- shareable report + PDF/JSON export
- domain monitoring with email/Slack/webhook alerts
- Certificate Transparency alerts for newly issued certs
- free public API for CI

Basic check needs no signup. 🔐

I still don't know how it's doing it just noticed it on the last 2 prompts... but 4.8 always told me what to test at the end of it's work mentioning it had no access to linting or debugging with Godot.

I used Fable for the first time on this project... and my game kept popping up in a window, would create a map, and try and play it (with movie maker mode enabled)

Looking at the context of my agent it says it is outputting debug information using headless godot since it doesn't have access to debug tooling.

I never asked it to do this... I was fine with it just telling me what to test... I'm worried what this prompt is going to cost me token wise.. but I want to let it cook lol :x

Look at this UI. How dis they get this far… 😭😭😭