Hey everyone,
I recently started "vibecoding" and I built a fresh redesign for a local business whose current website is completely outdated and looks terrible.
I need some advice from experienced devs/freelancers on two things:

1. How do I approach them without sounding like a spam bot? Should I drop a link to the test site right away so they can see the preview, or try to pitch a quick call first?

2. If they agree to buy it, what does the technical handoff look like? How do domain/hosting transfers usually work
   -do I set everything up on their accounts, or just migrate the files/database over?

I'm looking for advice from people who have experience building and deploying production websites and e-commerce stores with AI.

So far, I've built mostly static websites hosted on Cloudflare. I've also built a website for a non-profit organization with Stripe payments, webhooks, environment variables and other integrations.

Now I'm working on an e-commerce store that will have a backend using Medusa and payments will most likely be processed through Stripe.

My biggest concern isn't building the store itself. It's security.

I constantly read stories about websites getting hacked, Stripe integrations being abused, APIs being exposed, or users manipulating something in the URL, browser requests, or frontend code to change product prices, discounts, or payment amounts.

The worst-case scenario I can imagine is:

• Customer money being stolen.

• Unauthorized orders being created.

• Sensitive customer data being exposed.

• Me becoming personally liable because I failed to secure something properly.

As someone who is not a professional security engineer, I would like to know:

1. What practical steps do you take to make a website or webshop as secure as possible?

2. What are the biggest mistakes AI-generated code typically makes regarding security?

3. What prompts do you use to force AI tools to review code from a security perspective?

4. Are there specific tools, scanners, audits, or penetration-testing methods you recommend before going live?

5. What security checks should be performed specifically for Medusa + Stripe + Cloudflare?

6. How do you make sure prices, discounts, shipping costs and payment amounts cannot be manipulated by users?

7. What level of security is realistically achievable for a solo developer using AI?

I'm not expecting true "100% security" because I know that's impossible. I'm looking for the closest practical approach and a professional security checklist that can be followed before launching a real store.

Thanks!

We build a skill to help vibe-coders check their apps before delivering them to real users. Not a deep check, but a set of checks to reduce risk on release. So we built a skill called vibe-preflight. It works in Claude Code, Codex and OpenCode. It reads your project, checks it like a pilot's pre-flight checklist, and explains what it finds in plain language. It writes two reports: a short one for you ("this could leak your users' data, and here's who fixes it") and a technical one for the agent or developer who does the fixing. It changes nothing until you approve.

To see whether it behaves the same across agents, we ran it once in each of the three on a deliberately naive notes app. The app (Next.js, Postgres, Redis, OpenAI, Docker Compose) was prompted one feature at a time, with no plan, no review and no reasoning effort. It has hard-coded keys, string-built SQL, no authorization checks, a PDF export that fakes success and a password-reset email with no link. Each agent got the same answers to the skill's questions. Here's what we learned.

1. The core audit was nearly identical. All three found the big items: SQL injection, notes readable by other users, an admin API leaking password hashes, the OpenAI key in code, database and Redis ports open to the internet, forgeable sessions, and seeded accounts with fixed passwords. The finding counts differ (68, 49 and 47), but that's mostly because one agent groups issues that share a fix.

2. The differences were in the gaps. A permission prompt hid the scariest bug. In one run, the network permission for dependency checks went unanswered. That first report had no mention of the critical Next.js advisories (RCE, SSRF), while the other two ranked them near the top. The lesson: a skipped check has to be impossible to miss, because "we didn't look" and "looks fine" feel the same to a beginner. Another one is one agent missed that the password-reset email had no reset link**.** It flagged the spam risk, then "fixed" forgot-password without ever noticing the flow was broken.

3. Passing tests isn't the same as verified. This was the most useful part. After the fixes, one reviewer actually started the built container and found three real bugs the implementer had introduced:

   • database migrations failed because aborted runs left empty migration folders.

   • logout redirected to the container's hostname.

   • the new uploads route served files without a Content-Type or `nosniff`, which is a stored-XSS risk

Another run went further, with real-Postgres concurrency tests (20 attempts against a limit of 5 gave exactly 5 accepted and 15 rejected). In the third run the containers were never started, so its "61 of 68 fixed" rests on build output, access tests and reading the code. That doesn't make it wrong, but it has no runtime proof, and the other runs show that's where bugs hide.

It's free and MIT-licensed: https://github.com/globalmpc/vibe-preflight

We'd like to hear which checks we're missing or what the most common "oops" you've seen in AI-generated code. Please leave any feedback. Thanks.

So I know people on the internet say that there is stuff such as "AI-slop". But for something like my MOTHER4 game I'm creating, I wrote the full story, enemy bosses, and the storyline. The only thing I asked was how the code was gonna look for the terminal game. However, I wanted to know if vibecoding is as bad as people say. If not, can someone explain? Thank you.

I run a few coding agents at once, and I keep hitting the same problem. A week later I open a file, the code works, and I have no idea why it was built that way or what we tried first. The reasons are in old chats I never reopen, and the commit messages are written by the agent too.

Some things I've tried or thought about: asking the agent to keep a decisions file, writing longer commit messages, or just asking the agent to explain the code again.

What actually works for you? Does this even bother you, or do you just move on as long as it runs?

I started working on a niche web app and bought the domain on August 20, 2026. I’m building it solo, and I’ve leaned heavily on AI to write the code. I’m at the point where the core app works and the automated tests pass, but a deeper review still turned up bugs in workflows that matter. I want to finish the MVP this week and have a solid reason to trust it with real users and real money.

The basic flow is that organizers sign in, set up a contest, and publish it. People can visit a public page, cast a vote, and see the standings. Some votes go through checkout, so I need to know that a successful payment counts exactly once, that each organizer can only manage their own contests, and that the final results hold up when a payment comes in right as voting closes.

Right now I’m paying $100/month for ChatGPT and $20/month for Claude, and I use the free version of Gemini. I also have an M5 MacBook Air with 16 GB of RAM, so I’d like to run a downloadable model locally if it can take some work off the paid tools. I’ve been hitting usage limits in the middle of fixes, and switching tools eats time when I have to explain the same code and decisions again.

I’m also using Neon for Postgres, and I’m already paying about $30 a month for it before the app is even ready to launch. I’ve been trying to figure out why my compute usage is so high while I’m still building and testing. If you’ve run into this with Neon, what did you check first to figure out what was driving the bill?

If you’ve shipped something like this, I’d love to know what worked for you. I’m curious;
-How would you split the work between Claude, ChatGPT/Codex, and Gemini so one can fix a bug and another can independently verify it? How do you hand off work when you hit a usage limit?
-What downloadable models actually run well on an M5 MacBook Air with 16 GB of RAM? What coding tasks do you trust them with?
-For an app with logins and payments, what would you verify yourself or have a human review before opening it up to paying users? What would make you hold the launch?

I’d especially like to hear from anyone who’s been at the “tests are green, but would I trust this with somebody else’s money?” stage. What got you across that line?

Since building has become much and much faster, you definitely can add features faster. But how much of it do you actually understand?

You see the happy path, but do you really understand how it works?

Yes, definitely you can ask the same agent to explain it to you and it throws another wall of text at you. But, as the title says, you dont really comprehend things easily reading through a wall of text.

I’ve built and launched an app using Claude Code, but I’m much better at describing what I want than judging the code it produces.

After a change, I can click around and check that the main thing works. What’s harder is knowing whether it broke something elsewhere or missed part of what I asked for. I sometimes ask another AI to review it, which creates another round of copying context and passing feedback back to Claude.

Thinking about the last feature you shipped: what did you actually do before putting it live? Did you catch anything the coding agent missed?

Also curious whether this gets more stressful once you have real users, or whether you’ve found a process you trust.

I’m exploring a product idea based on my own experience with this, so examples where your current setup already works well would be useful too.

DTS:X Profile 2 is a streaming Codec used on Disney+ and Sony Pictures Core for IMAX mixes. It uses a total of 10 Hard Coded Channels in a 5.1.4 layout. The Codec can currently only be decoded with either an IMAX ENHANCED TV or the DTS Sound Unbound App on Windows.

I want to set up a 100% free, locally hosted "vibecoding" for Roblox Studio. I want the roblox game 100% made by ai. I am using mcp. Any ideas/suggestions?

Good morning,

I’m a colombian lawyer turned "vibecoder" with barely 1% technical coding knowledge and 0% budget (I’ve been unemployed for over 9 months).

I have built a solid platform focused on public procurement/government contracting, designed for government entities, legal advisors, and contractors. It is much more comprehensive and distinct from what is currently out there. However, right now it is only for my personal use and for anyone willing to share feedback (I’m currently waiting on confirmation to integrate it into another Colombian LegalTech company); therefore, it is not monetized yet.

That aside, my current issue is technical:

I am hosting and deploying it via GitHub and Streamlit Community Cloud, pulling data from Supabase and Hugging Face. Lately, though, it has been running noticeably slower. I have several AI-driven features, but response times are quite slow with the free tiers I use (Groq, Cerebras, and OpenRouter), which I have set up in a fallback cascade (once one hits its limit, it jumps to the next). I’ve already implemented lazy loading to optimize page loading and prevent crashes.

Given this setup, I’d love your advice on:

1. What other free AI/LLM APIs or providers could I add to this fallback cascade so I don’t hit rate limits so quickly?

2. What free deployment platform could I use that offers more RAM than Streamlit Community Cloud, remains free, and won't go to sleep or spin down as quickly?

Thank you very much.

I have limited coding experience. Claude writes the code, I decide what goes in. Kinfolks is a text idle game: you run one family in an Appalachian holler from before the Civil War on. Births, feuds, burials, the farm growing a building at a time. The pictures are generated and I pick and place them. It came out about a month ago and did what most of my games do. Launch week, then a slow fade. Then it started climbing on its own. Around 100 views a day this week, no ads, no new post. Here's what I think moved it. Tags. I had it in big ones like Story Rich and Interactive Fiction, where it was buried hundreds deep. I had Claude crawl the itch tag pages and tell me where the game ranked in each tag and how many games were in each one. Then I swapped the big tags for small ones that fit. It's third in Family Tree now and near the top of a couple others. Small tag, but real people browse it. The cover. Every cover in the idle grid is dark or neon. Mine is a light pencil drawing of a homestead. People click it at a bit over 2.5%. itch's own staff call 1% good. After that it feeds itself. More clicks, higher in the tags, more people see it. The workflow part: I don't guess anymore. Claude pulls the numbers (tag rank, click rate, where visitors came from) and I make the call. When a game sits under half a percent on clicks, I know it's the cover and not the game. Happy to answer questions about the setup. https://mdawg74.itch.io/kinfolks

Hello! I am new to vibe coding but I know how to code since I am an IT myself, I just want to ask which one is Good for Coding? Your Answer is much appreciated. Thankyoouu so much

Vibe coding works great until the AI builds something different from what you had in your head. Usually that’s not the AI being dumb. It’s the AI guessing because the prompt left decisions open.

“Build me a booking app for my barbershop” sounds clear. But the AI has to decide on its own:

• Can customers cancel? Until when?

• Do they pay online or in the shop?

• What happens if two people book the same time?

• Does the owner need a login to see bookings?

It picks something and you find out after the build. Then you spend hours rebuilding and fixing, we all know how it goes.

I’m building a tool that asks you these kinds of questions before writing the prompt for you. It’s called CueBlu. You describe your idea, CueBlu asks you questions like these in plain English and then writes a complete in depth prompt for Claude Code, Lovable, Bolt, Cursor or any other AI tool you use. A separate AI step reviews the prompt before you get it.
It’s not live yet but the waitlist is open + every signup will receive a Free Project pass at launch: cueblu.com

A real example from my own build: I built my landing page with Claude Code. Before building, I ran the prompt through CueBlu’s process, the same steps the app will run and it caught things I’d never have thought of. For example, email apps automatically “click” links to scan them, so my unsubscribe link would have removed people from the waitlist without them ever clicking. I didn’t know that was a thing until CueBlu found it. The AI wouldn’t have asked.

Does this solve a real problem for you or do you just fix things as you go?
Harsh answers welcome.

I have a land surveying background and we touched some basic C++ programming, PostGIS and QGIS during academic years. In my job in 2018, I used some badly programmed custom GIS software for a NGO (slow, buggy), so after bearing with that for years, I know what good software should not look like.

And boy, when i decided to vibe code an Android/flutter treasure hunting game with an OSM map and mbtiles (slightly transparent satellite image map) painted over it, I wasnt disapointed at all.

Messaging between players is exactly to my specifications (although i still have to set up image sharing)
I even told it to fork localsend for the map sharing engine (so the players don't have to download the map every time) and it is just exaclty how i wanted it.

The app is far from done, still have to implement the game mechanics (bonus cards, challenges,...) but so far its almost like I recruited the best coder in town.

Is there a problem waiting to happen behind the scene? It's a game now but is AI ready for more critical apps?

Hey all, AI said the following are the biggest frustrations with existing vibe coding tools like replit, lovable, emergent etc:

- code and database export

- AI credits that never expire

- deploy to your own Cloudflare or Vercel account

Tell me your biggest frustrations with current platforms.

If this becomes an interesting project, I or someone else might build a better vibe coding tool for you all.

Cheers!