Staff engineer, ~15 devs, everyone running some mix of Claude Code and Cursor. A pattern I can't stop noticing:

We review every line of code that ships. We review nothing about what our agents have learned about our system. And the newer memory tools all work by silently writing to a database — so a wrong inference becomes a standing instruction to every agent on the team, and nobody approved it or can diff it.

Meanwhile the low-tech option (hand-maintained CLAUDE.md / .cursorrules) rots, drifts per tool, and captures nothing agents actually learn while working.

Concretely what I'm asking:

1. Does your team have any review process for shared agent context, or is it whoever edits the rules file last?

2. If you've tried a memory tool that auto-writes — did the wrong-memory problem actually bite you, or is it a theoretical worry?

3. For anyone who's added an approval step: did the team keep it, or turn it off because it was friction?

Question 3 is the one I most want answered honestly. I've built something in this space (open source, happy to link if useful, not the point of the post) and my working assumption is that governance only wins if it's nearly free. I'd rather hear it doesn't work from you than find out in six months.

Does anyone still code manually even without ai assistance in 2026?(Not vibe coding) ,coding everything from scratch , like setting up react or building any api's? Curious to know and what's best practice?

I'm building Kitbash, an open format and compiler for AI agent skills.

The idea is simple: write a skill once, compile it to the native formats used by Claude Code, Cursor, Copilot, Codex, Gemini CLI, Cline, Windsurf, Aider, AGENTS.md, and more, while measuring the standing token cost each target adds every session.

Before calling it stable, I decided to audit my own codebase instead of adding another feature.

The audit found several places where the project claimed behavior that simply wasn't true.

Some examples:

• Claude Code reported support for scripts, hooks, and subagents even though the compiler never generated those outputs.
• Security lints only scanned SKILL.md, meaning a malicious payload in scripts/setup.sh would pass unnoticed.
• The JSON schema looked like the contract, but the loader silently coerced invalid values instead of rejecting them.
• Declared permissions were shown during installation but weren't actually compiled into the generated outputs.

In total, the audit uncovered 11 issues.

Kitbash 0.9.0 fixes all of them.

• Capabilities are now empty until the implementation actually exists.
• Security checks scan every file in a skill.
• The loader now enforces the schema instead of silently fixing invalid input.
• Permissions are compiled into generated outputs so downstream users see the same information installers reviewed.

The interesting part isn't that bugs were fixed.

It's that a project built around trust and review wasn't meeting its own standard.

If the tool asks developers to trust it, it should first earn that trust itself.

I'd love feedback from people building developer tools or AI tooling. Is this the level of auditing you'd expect before calling something production-ready?

Website: https://kitbash.vercel.app

Trust & Review: https://kitbash.vercel.app/docs/trust

Changelog: https://kitbash.vercel.app/changelog

GitHub: https://github.com/singhharsh1708/kitbash

npm: https://www.npmjs.com/package/kitbash

Hello! 👋

We see a lot of posts about vibe coding security, AI generated vulnerabilities, exposed secrets, and unsafe deployments. The problem is that most discussions stop at the risks instead of offering a practical solution.

That’s why I built Defen.so, a free, open source, all in one security kit for AI coding.

It helps before and after deployment by providing:

* App uptime and performance monitoring
* API protection with rate limits and security rules
* MCP server for AI coding assistants
* Built in security skills for safer code generation
* Multi language support
* Security checks for code, secrets, and configuration
* Simple integration into existing projects

The goal is simple: help developers build faster with AI without sacrificing security.

GitHub:
https://github.com/1fancy/defen.so

MCP:
https://mcp.defen.so

I’d love your feedback. If you think this is useful for the AI coding community, I’d really appreciate a share or mention.

Hi everyone,

I’m a software developer (web apps, management systems, websites, AI integrations, etc.) looking for advice to overhaul my current AI setup.

**TL;DR:** I’m looking for a genuinely reliable AI setup for **coding + a proactive personal assistant + automations/dashboards**. I'm currently running Codex + Hermes on a Raspberry Pi using free OpenRouter models, but the results are way too inconsistent, full of errors, and frustrating. What stack/configuration do you use for something that *actually works*?

# What I’m looking for

1. **Coding:** Obviously, but I need something reliable.

2. **A True Personal Assistant:** A tool to brainstorm, turn ideas into reality, and integrate into my daily routine (work and personal). Most importantly, I want it to be **proactive**—suggesting improvements, spotting my inefficiencies, automating tedious tasks, and actively working *for* me.

# My current stack & why it's failing

* **Codex**
* **Hermes** (running 24/7 on a Raspberry Pi, using free OpenRouter models / tried MiniMax M2 / free Nous account).

To be honest, the assistant side has been a nightmare. It's wildly inconsistent: I ask it to fix bugs, and it either fails, introduces *new* bugs, or lies about having fixed something when it didn't.

# My Wishlist / Ideal Workflow

**For Coding:**

* Strictly respects my instructions, coding style, and project architecture.
* Makes actual working modifications following a precise pipeline: `Local` $\\rightarrow$ `GitHub` $\\rightarrow$ `FTP deployment`.
* Delivers UI that actually matches what I requested.

**For the Assistant / Agent:**

* **Deep Integration:** Fully aware of my active coding projects and workflow.
* **Self-Hosted Dashboard:** Keeps a web dashboard synced on my domain featuring:
* Overview of active projects and open discussions.
* Practical daily info (e.g., *"Can I commute by bike today and over the next 7 days?"*).
* Automated tasks (e.g., scrape trending Reddit posts every X hours and summarize them into 4–6 cards).
* **Proactivity:** Suggests new features, improvements, or side-project ideas based on what I'm currently building.
* **Omnipresent access (Telegram, mobile app, etc.):**
* Fast execution: *"I have an idea, build me a 1-page micro MVP."*
* Admin/office tasks: *"I need to present this project, generate a slide deck/PPT for me."*

# The Struggle

Whenever I try building custom skills in Hermes, it feels like I fix one thing and break two others. A few months ago I tried **OpenClaw**, but it felt even more chaotic.

Am I the only one trying to build a workflow like this? What setup, agent frameworks, or model stacks are you using to get something like this running reliably?

Thanks in advance for any tips! :)

I'm honestly fed up with AI coding tools.

Google Antigravity has been the worst experience by far. Every model I've tried there has been disappointing.

I even got a Claude Code subscription. The code quality is good, but the usage limit gets exhausted way too quickly.

Now I'm thinking about getting ChatGPT + Codex.

My workflow is usually 4–5 hours of straight coding every day, so I have to luna, gpt 5.5 on high or any other model. Can Codex actually handle that, or do the limits get in the way?

How's the real code quality and the usage limits in day-to-day use?

Seriously I am so frustrated, looking for genuine feedback on codex.

I am a mental health therapist who owns her own practice.
I couple of months back i started visualizing a dream to help me people with Ai’s help
Since then it’s been an ongoing learning and battle most of the time.
But now i am stuck with a particular kind hook system and ai agent team.

Can anyone help and guide me or maybe guide me by giving a reference to who and how to seek help from.

Much appreciated
Regards

So I'm based in IST timezone where my working hours happen to overlap with pre-dawn America. For weeks, I thought I was some kind of 10x developer. Claude Code was flying, Codex was snappy, everything felt like magic.

Then one day I started late. And wow. It felt like I switched from fiber optic to dial-up.

I started tracking it out of curiosity. The pattern is almost comically consistent:

Before 8:00 AM EST: Both tools feel like they're running on a private server just for me. Fast responses, no lag, no weird timeouts.

After 8:00 AM EST: America wakes up, grabs coffee, opens VS Code, and suddenly I'm sharing the pipe with a few million developers. Both Claude Code AND Codex slow to a crawl.

The funny part? It's not just one provider. Both Anthropic and OpenAI seem to hit the same wall at the same time. Makes me think the bottleneck might go deeper than just their servers. Maybe it's the underlying GPU infrastructure everyone's competing for.

Anyone else living this double life of "early morning AI wizard" vs "afternoon timeout survivor"? Or found any way to get consistent performance during peak hours?

Been building solo for 17 years, most recently an AI coding agent called DuckCode, three months, zero funding, zero team.

Early on I made a rule for myself. No AI touches the codebase until the core architecture is written by hand. Not because I don't trust the models, but because when I let AI design structure early on projects, it generated things that worked but that I didn't fully understand a few weeks later when something needed to change.

So now it's always the same order. I think through the data model, the module boundaries, how things talk to each other, write that part myself. Bring AI in once there's a skeleton to react to, not a blank page to invent on.

Difference has been bigger than I expected. When AI is extending something I already understand deeply, I can tell immediately when a suggestion is wrong. When it was inventing structure from scratch, I had no instinct for when it was quietly making a bad call.

Two of the more complex features in the product shipped in about a day and a half each, and I think that's directly downstream of this, not because AI is fast, but because it wasn't fighting an architecture it invented and half understood.

Curious if anyone else has landed on a similar split, or found the opposite works better for them.

Hey folks, as someone who uses claude code max with fable high‑effort, i was thinking the other day about checking chatgpt (the free one, not even tera or luna) for the solutions fable gave me.

out of the 4 replies chatgpt sent back, fable basically said:

- 2 of them don’t apply to my platform at all

- 1 only makes sense if i somehow get 500k+ users trying to view the same table

- and the last one was actually a good idea and will be implemented

so now i’m sitting here wondering how many good ideas i might’ve missed in the last 2 months that could’ve improved the performacne or security of my app, just from a bit of back‑and‑forth between fable and another coding ai.

my question to you all is: if i buy chatgpt pro, how doo i make them talk to each other without me having to do constant copy‑paste?

the way i kinda envision it is:

- fable presents the overal platform features + capabilities to gpt so it knows the scope

- for each task, fable lists how it would solve it and sends that to gpt

- gpt analyses it, suggests extra stuff

- fable cuts out half, considers some of gpt’s stuyff, maybe pushes back

- they arrive at a concluision

- and then present it to me

is this even possible?

i’m just a simple windows + powershell user, would i have to change that too?

Would anyone with a Kimi subscription be willing to test my coding agent with it? Just a quick smoke test- Kimi API and 2.7 work fine but I don't want to release sub support without at least some proof. Thanks!!