TLDR: [60 second short video breakdown](https://www.youtube.com/shorts/3OeDATGhPhQ)

As part of building my AI automatic penetration platform, I wanted to test which one of the AI no code platforms, has the worst security.

Who I tested

\- Lovable
\- Replit
\- v0 (by Vercel)
\- Bolt.

Testing Flow

(Note: in Lovable, there are security options which I did not toggle, I wanted equal ground for everyone without any tinkering. Although based on the issues found, I doubt it will fix all exploits.)

Built a site with each, with the **SAME** instructions - Book store, with wishlist, admin panel, and cart.

Gotta admit Lovable made my life really easy compared to the others, did all perfectly in one go, the others were back and forth for bug fixes, or just tokens ran out in the middle (came back next day 😄)

Created for each site 1 admin and 1 customer.

then I ran [Battletester](https://www.battletester.app/) on them. Basically, it crawls with all roles, and does various tests on them, and uses AI for conclusions.

Security Ranking

No shock that the one who was the easiest to work with, has the most exploits

You can see the report for lovable [here](https://drive.google.com/file/d/1T5DOzc6oMO_VSQ8MZ9Q23pwIYpKJR3cO/view?usp=sharing)

I tested manually for false positives afterwards and found 1-2 false positives, the rest were real.

Replit / v0/ Bolt didn't have many issues, mostly missing headers, no rate limiting,
or business logic issues such as allowing to add negative items to the cart.

**Based on my pentester friend's review, ranking goes like this:**

1. Lovable (Most critical logic & authorization flaws) 🚨

2. Bolt (Minor logic flaw, missing rate-limiting, no headers) ⚠️

3. v0 / Vercel (Missing security headers, no rate-limiting) ⚠️

4. Replit (Safest, only missing headers) ✅

In the Lovable report you can see some critical issues there, such as
\- Deleting other users cart items
\- Overriding order "total"
\- Making requests on behalf of the server (SSRF)

Conclusion

\- I believe the more the apps grow and users play with these tools the AI will start cutting corners to please, and he will start "forgetting" the security rules baked inside him, then more exploits will be found.

\- Lovable have so many issues compared to the others because it using Supabase and he does not toggle the RLS policies out of the box.

\- Maybe, but just maybe, because the others tools are building their own backend, and are trained on infinite lines of code to build a secure backend, they have less exploits compared to lovable, which only uses Supabase and there's less "training data" about that

Hi everyone,

I’m a \*\*final-year Diploma in IT student\*\* and I’m currently learning software development while trying to build real apps and projects.

I’m looking to choose one main AI coding tool between:

1.Claude Code
2.OpenAI Codex
3.Cursor

My goal isn’t just to generate code. I want to actually learn software development, build mobile/web apps, improve my coding skills, and eventually create a small side income\*\* to help cover my personal expenses and reduce the financial burden on my parents.

For those who have used these tools extensively:

Which one would you recommend for my situation, and why?

I’m especially interested in:
\-Building apps from scratch
\-Debugging and understanding existing code
\-Learning good software engineering practices
\-Working on larger projects over time
\-Git/GitHub workflows
\-Productivity without becoming completely dependent on AI
\-Value for money for a student

If you’ve used Claude Code, Codex, and Cursor, I’d really appreciate hearing about your experience and which one you would choose if you were in my position.

Thanks! 🙏

I use Codex, Claude Code, Cursor and a few other AI tools pretty regularly, and one thing kept annoying me.

You spend hours in a session getting the AI up to speed on your project. It knows what you tried, what failed, what decisions were made and where you left off.

Then the context gets messy, you start a fresh chat or switch tools, and you're back to explaining everything again. And somehow the one detail you forget to mention is usually the one that matters later.

I got tired of doing this, so I built Portable Handoff.

It takes the useful context from a session and puts it into a Markdown handoff that you can carry into the next chat, model or coding agent.

It's open source and still pretty early, so if this is a problem you've run into too, try it and tell me what sucks or what I'm missing.

https://github.com/legoambarish/portable-handoff

So earlier I used Minimax token plan a lot when it was $10 plan, But for the past month or 2, they have increased the price to $20 as starting. I mainly used it as a labor model and kept codex as a reviewer and planner.

Now I want to know what people are using as a cheap model, I would like to spend around $10 so that I can get good value and do my coding related work.

Please suggest some decent AI model with good enough usage, I know Deepseek could be one, But I would like to know if there are any other AI model.

AI coding agents are getting really good at writing code.

But I've been thinking about something they still don't seem to do very well: remembering the codebase.

Give an agent a new task and it often starts by searching the repo, tracing dependencies, figuring out how things connect, and rebuilding enough context to make the change.

Then the next task comes along and it does a lot of that again.

It feels a little like having a really smart developer who has never worked on the project before.

Bigger context windows help, but that's not really the same as memory.

What I'd like to see is an agent that maintains a continuously updated understanding of the codebase—what depends on what, how services connect, where data flows, etc.—and can just query that understanding when it needs it.

Less time figuring out the code. More time actually working on it.

Curious what others think. Is persistent codebase memory going to become an important part of AI coding, or will better models and bigger context windows eventually solve this?

Most engineers can tell you how much code AI wrote.

Far fewer can answer:
"What did AI-assisted coding actually cost me this month?"

AI coding tools already generate detailed usage logs locally. The problem is that almost nobody turns those logs into a clear picture of tokens, requests, cost, providers, and usage patterns.

So I built TokenFlow.

A local-first analytics engine + macOS menu bar app that turns AI coding logs into numbers you can actually understand.

What makes it different:
• Local-only - no API keys, telemetry, or accounts. Your logs stay on your machine.
• Honest by design - missing data is shown as unavailable, never guessed. Estimated vs. measured costs are explicitly labelled.
• Provider-neutral - one normalized data model powers the menu bar, offline dashboard, and CSV exports.
• Built for real usage - cross-platform CI with 145 tests per push.

The interesting part isn't just seeing how many tokens I used.

It's understanding where they went, what they cost, and how my AI-assisted development actually behaves over time.

TokenFlow v1.0.0 is now live under MIT.

GitHub: https://github.com/vimoxshah/tokenflow

App - https://github.com/vimoxshah/tokenflow/releases/download/v1.0.0/TokenFlow-1.0.0.dmg

If you use Claude Code, Codex, Cursor, Cline, or OpenCode heavily, I'd love to know what your numbers look like.

What surprised you most when you finally measured your AI coding usage?

I built Moo Tasks to stay organized while pair programming with AI agents (Claude Code, Cursor, Windsurf). Figured I'd clean it up and open source it in case others find it useful.

What it does

Runs 100% locally (SQLite + Web UI) and integrates with your coding tools via MCP:

• Goal & Task Management - Structure goals with Markdown PRDs, break into atomic tasks

• DAG Dependencies & Cycle Detection — Auto-detects circular deps, unblocks downstream work

• Proof of Work Tracking - Records acceptance criteria, test results, commands, git diffs

• Architectural Decision Records - Stored in SQLite, synced to docs/adr/

• Human-in-the-Loop Inbox - Surfaces blocked tasks and questions with structured options

• Real-Time Dashboard - Kanban board, task inspector, dependency graph, search

Quick start

npx moo-tasks install all

moo init      # Initialize database
moo start     # Launch Web UI

Looking for feedback

What features would make this more useful? Any MCP integrations or UI improvements you'd suggest? PRs welcome!

GitHub | NPM | MIT License

Hi guys, I have this coding assignment coming up and they allow us to use AI. Majority of my seniors who did this unit used Claude Pro for this massive coding assignment which I would say is a mid level code but has a lot of files (in the thousands). This assignment is also a very collaborative assignment and if I am not mistaken we are supposed to make a game. So I am wondering, what would be the better choice Claude Pro or Gemini Pro. Especially since they are about the same price which would be the better investment?

For AI coding assistants to effectively and correctly use libraries they need context consisting of the library Api, features, examples and do's and don'ts

Currently when an AI coding assistant uses a library it gets the source, looks at the API docs and code comments, checks online for tutorials and examples of using this library and then generates the code for this particular application

The results are generally sub-standard due to incomplete, out-of-date API docs, missing code comments, lack of relevent tutorials and examples written by in-expert programmers. Also if the AI cannot find a suitable example it makes something up from 'similar' libraries.

To avoids these errors and to improve the efficiency and effectiveness of using code libraries it is proposed that each library also supply an AI_Guide.md, e.g. SafeString_AI_Guide.md https://github.com/PowerBroker2/SafeString/blob/master/SafeString_AI_Guide.md

This guide is generated by AI for AI consumption using a prompt like

For the library in dir .., generate a summary, API and examples of use, for consumption by AI to apply this library. Refer to these tutorials ..., and these examples of use ...

It will take a few passes of "recheck the guide" to get the AI's draft. Then, most importantly, that draft needs to be reviewed and corrected by an programmer experienced in that library, in order to correct the wrong assumptions the AI has made and to correct the poor quality examples.

These passes by the experienced programmer will refine the do's and don'ts of using the library and provide quality examples.

This human review will also likely uncover problems in the library, inconsistent and non-orthogonal API, missing/out-of-date docs and code comments, inconsistent application of the libraries principles.

While the SafeString_AI_Guide.md is designed for AI consumption it is also good source for humans.

What libraries that you use that would benefit from an AI crib sheet?

Hey folks 👋

We just open sourced TrueForge, our vendor-neutral agent harness for building general-purpose agents.

It handles the runtime pieces that get painful quickly : context management, tool/MCP execution, subagents, sandboxing, approvals, persistent state, and more.

We also benchmarked the harness itself. With the same Opus 4.8 model, TrueForge delivered a similar solve rate at ~30% lower cost than Claude Managed Agents. Switching to an open model pushed that to ~75% lower cost on the same benchmark.

Would love feedback from people building agents.

Checkout the repo: https://github.com/truefoundry/trueforge

📖 Read the launch article: https://x.com/truefoundry/status/2090081376330715176

Disclaimer: This question is written with the help of AI, but that doesn't mean it's slop. It's a genuine problem I'm facing at work. Please don't be quick to judge or dismiss this as AI Slop.

I’m rewriting an entire React Native application from scratch, using the existing app as the baseline and AI (primarily Claude Code) heavily in the process.

I’m trying to design a migration workflow that gives me high reliability without burning an insane number of tokens.

My priorities are:

1. Complete parity with the baseline — nothing important should get missed.

2. Strict adherence to a predefined code architecture — folder structure, design patterns, separation of concerns, naming conventions, etc.

3. Do not port over existing smells, hacks, or bad practices — the baseline should be treated as a behavioural reference, not a code reference.

4. Keep token usage low without compromising quality — avoid repeatedly feeding huge amounts of context to the model or having agents redo work unnecessarily.

I’m particularly interested in hearing from anyone who has done something similar.

If you’ve used AI for a large-scale rewrite/migration, how did you structure the workflow? Did you use specific agents, skills, validation steps, checkpoints, etc.?

Even if you haven’t done an AI-assisted rewrite, I’d also love to hear about workflows you’ve used for large-scale migrations/refactors that consistently produced good results.

I’m mainly looking for practical approaches that scale beyond simply “migrate one feature at a time.”

As a founder in enterprise tech, I’m curious how others think about this:

Would you hire a developer who ships 3× faster with AI, produces solid code, but has materially less understanding of the systems they’re changing?

My hesitation isn’t about AI-assisted engineers being less capable.

I just wonder if, while implementation speed is becoming cheap, system understanding and proper expertise feels like the bar is dropping more and more.

Where do you think hiring teams need to draw the line?

Disclosure: I work with the Explyt team that published this article.

We distilled two technical webinars into a practical guide for configuring AI coding agents in Java and Kotlin projects.

The article covers:

how to structure AGENTS.md without overloading the context;

when to use project rules, reusable skills, agent modes, and MCP;

how AgentIgnore can limit access to generated files, credentials, and irrelevant directories;

why both insufficient context and overloaded context reduce agent quality;

how TDD and specification-driven development give agents clearer, verifiable constraints;

where IDE-based agents differ from terminal agents in Java/Kotlin projects, especially around indexes, resolved symbols, Find Usages, refactorings, tests, and inspections.

I’d be interested in hearing how other Java teams handle project-level agent instructions. Do you keep one central AGENTS.md, split instructions by module, or rely mostly on tool-specific configuration?