This weekend, I went for a run on Mount Royal. The fall colors were incredible, sunlight filtering through the leaves… Montréal was looking absolutely beautiful.

And I almost couldn’t wait to get home. 😂

Thanks for reading! Subscribe for free to receive new posts and support my work.

Why? To keep designing my iPhone and macOS app with my ChatGPT DOT.

On Saturday afternoon, I’d had one of those magical tech moments I absolutely LOVE.

My app had just synced between my Mac and my iPhone.

I tried it again. Still working.

I smiled. WOW! 🤯

I’ve been dreaming of building my own tools for almost 25 years.

Back in the early 2000s, I was animating in Flash and playing around with HTML. I quickly realized coding wasn’t for me. Too abstract, too boring for my designer brain. Haha!

But I’ve ALWAYS loved systems. Organizing things, connecting ideas, figuring out how everything works together. It’s probably one of the reasons I’m so passionate about Product Design.

And speaking of systems… my brain is quite something. 😂

Ideas. Everywhere. ALL THE TIME.

On the subway, walking through a park, at work… You have no idea how many brilliant emails I’ve sent to myself just to remember things.

I’ve tried SO many tools to keep it all organized.

And now, I can finally start building my own. Tailor-made for how my brain works.

Four worlds. Four colors. Just like the way I already organize my brain.

🔵 Everyday life, 🟢 creative ideas, 🟡 work projects, and ⚪ all those discoveries I want to keep in my second brain on Notion.

It’s the same color system I’ve been using for years across my folders and work documents. My brain is visual, so my app should be too.

I even added little magical particles when I tap the buttons. ✨

Because… why not?!

Of course, it’s not all perfect. I still spent a ridiculous amount of time making mockups in Photoshop just to explain to my AI agent how to align a box. 😂

But I’m GEEKING OUT HARD.

And what excites me even more is what’s coming next.

I’ve configured my DOT to check in with me once a week, go through the ideas I’ve captured, ask what I want to do with them, and help me organize everything in Notion. That workflow still needs to be fully tested.

It’s the little system I’ve been dreaming of building for years.

Not necessarily to become more productive.

Just to have a little more space in my head.

We hear so much about the negative sides of AI. This weekend, I simply wanted to share something positive that it made possible for me.

Finally building something that works like MY brain.

So if you saw my first post you would have seen it was a complete dumpster fire. I didn't take it personally though I took all the feedback and have overhauled my app. Shoutout to u/mountainfluid for the detailed and carefully curated feedback it helped so much <3.

https://apps.apple.com/us/app/beep-boop-beat-maker/id6819137757 <- here it is

I was completely delusional with my pricing so its now $1 amonth usd for the subscription and $10 for full unlock (will land later today) BUT you can actually do everything except save, share and browse others creations. wont be any ads ever.

I just want to share it with people so if you dm me ill create a code for you for a full app unlock.

There has been a lot of changes and improvements that include

- DRUMS redrawn: the steps light from inside, and the dial shows each drum as an icon.

- RANDOM deals a groove in your own sounds. CLEAR takes it back.

- Two bars on DRUMS, the second a copy of the first. SHARE carries both.

- Four bar keys under the steps on DRUMS and SYNTH. A key past the end grows the beat or tune to two or four bars, and CLEAR gives the folded bars back.

- SOLO on SYNTH quiets the beat while you shape the tune.

- PRINT opens the panel along its divider, with cables and the odd spark inside, and the receipt comes out of the printer from within. The same on the iPad's console.

- Engraved icons in place of words: TEMPO, KEEP, PRINT, SWING, SHAPE, CLEAR, RANDOM, the bars, ALL / SOLO, LOOP.

- RANDOM on SOUNDS deals a new sound near the one you chose. A clean sound stays clean. Touch the window to undo.

- SYNTH's grid is square keys lit from inside. STORE's keys are bigger. Small lit keys glow in their own shape.

- CLEAR on PADS, and the pads without names.

- A beat's later bars could be lost three ways: on quitting, on folding twice, and when CLEAR gave back bars over new edits.

- PRINT on PADS dropped bars 2 to 4. This was older than 1.0.3.

- PRINT on TRACK could post a song twice, or print it on another space if you left mid-print. This was older too.

Sound engine is built in C carefully and with love. The timing systems should be rock solid as well and have had alot go into the testing of them.

here is some of the tech

Synth

• PolyBLEP band-limited saw and square oscillators, so no aliasing in the high register.

• A zero-delay-feedback state-variable filter (trapezoidal integrators, pre-warped cutoff), stable at any resonance.

• Two oscillators plus a sine sub per voice, with 8-voice polyphony.

• Phase-continuous voice stealing, so overlapping notes never click.

• TB-303-style accent: deeper filter envelope plus tanh drive.

• Exponential envelopes and glide, with an attack that overshoots slightly for analog snap.

• TEAR per voice: wavefolding, bit reduction, ring modulation and frozen granular fragments.

• Every note in key, by design. Each grid row is a scale degree, so nothing you draw is off-key

Engine

• A real-time core in C. No memory allocation, no locks and no logging on the audio thread.

• A lock-free command queue is the only path between the UI and the audio thread.

• About 2% of the render budget used: 0.05 ms worst case per 2.5 ms buffer.

• Per-sample gain smoothing on faders, SOLO and the mix, so there's no zipper noise.

• A soft-clip output stage with a −1 dBFS ceiling, driven 2 dB down so kicks keep their transient.

As a final note, I know that 'vibe coded' 'ai slop' is prevalent and its easy to dismiss a new product as something that anyone could poop out, I am actually a product designer and a engineer and have been using agentic development as a means of expressing what i actually want to build but never had the time nor capacity to realise. I have put a lot of love and time into this app and am really open to feedback, please be kind and i promise i will hear you and work to improve it. - Euge

I know there are a lot such games around, but I always missed something in the games.

I wanted a billiards game where spin, throw and the cushions behave like they do on a real table, so I built one. It's called EFFET (the French and German word for spin, what Americans call English) and it runs in the browser.

**Play it here:**

https://nikomedia.at/games/billard/

Free, no account, nothing to install.

**What you can play**

* 8-ball and 9-ball under WPA rules, with called shots, push-out and the three-foul rule

* Carom under UMB rules: straight rail, one-cushion and three-cushion

* Against the computer (beginner, advanced, pro) or two players on one device

* Free practice on the pool table and the carom table

**How shooting works**

You set the tip position on the cue ball, the cue elevation (for massé) and the power. Or you hold the right mouse button and stroke: pull back, push forward, and the speed of your hand becomes the speed of the shot. When the cue ball sits close to a rail or another ball, the cue is raised automatically, the way you would have to at the table.

After a shot you can watch it again in slow motion. "Shoot again" puts every ball back where it was, so you can practice the same shot as often as you like, the break included.

There are two rooms to play in, a Viennese coffee house and a pool hall loft, both modeled and lit in Blender.

**The physics, for those who care**

The engine is written in Rust and runs as WebAssembly in a web worker. It's event-based, following Leckie & Greenspan: instead of moving the balls in tiny time steps, it calculates exactly when the next event happens (a collision, or a ball going from sliding to rolling) and jumps straight there. A full shot takes a few milliseconds to compute and gives the same result on every machine.

It models squirt, throw with speed-dependent friction between the balls, the cushion hitting the ball above its center (after Han 2005) and rounded pocket jaws. Many constants come from Dr. Dave Alciatore's technical proofs. A separate 2D physics lab draws each ball's path, colored by sliding and rolling, and has test shots for stop, follow, draw, the 30° and 90° rules, throw, squirt, running and reverse English and massé, each with the result you should expect.

The computer opponent doesn't cheat. It uses the same physics and rules as you, test-plays its candidate shots and picks by the outcome and the position it leaves. On pro it pots about 9 of 10 shots in 9-ball and plays safeties when nothing is on.

**Not done yet**

* Desktop only for now: you need a mouse and keyboard, there are no touch controls.

* Runs best in a current Chrome or Edge (WebGPU). Other browsers fall back to WebGL 2.

* Cloth friction for carom is still a first estimate. In a tight rack all balls touch at once, but the engine resolves collisions one after another, so the break is an approximation for now.

**Feedback welcome**, especially from people who play on real tables. Do draw, follow and side spin feel right? Are the cushions too lively or too dead? Anything that feels off helps me.

The interface is in English and German.

Hi all, given all the recent Black October cyber security issues (Node.js, Brotli, PHP, Python, eMudhra etc), I've put together a public Github repository containing a structured set of instructions and system prompts which you can give to your LLM to audit your Mac for risks. You can ask your LLM to explain what the code does before executing them. Hope that this might be helpful to someone.

Note that this is only for Mac users.

Hey everyone!

Just launched TwoCents on Product Hunt today!

It's a Chrome extension that helps you write comments on LinkedIn in your own voice. No generic AI replies, just natural comments that actually sound like you.

Built this because I realised engaging on LinkedIn can be just as valuable as posting, but most of us don't have the time.

Would love for you to check it out, give it a try, and share your feedback. If you like it, your support on Product Hunt would mean a lot!

https://www.producthunt.com/products/twocents-2

Thanks everyone! 🚀

Part 1 covered giving your AI agent security context and reviewing auth changes.
Part 2 covered placeholders and secrets. This week: what your agent installs, and testing your app the way an attacker would.

Habit 5: Check what it installs
Agents solve problems fast by pulling in packages. That creates two risks.
The first is age. Agents suggest packages and versions from their training data, so they'll happily install a version with known vulnerabilities, or a library nobody has maintained in years.
The second has a name: slopsquatting. AI models sometimes recommend packages that sound real but don't exist. In one study of 16 models, about 1 in 5 recommended packages didn't exist, and 43% of the fake names came back every time the same prompt was rerun [1]. That repetition is what attackers exploit. They collect the names models keep inventing, register them with malicious code, and wait. The next agent that suggests one installs the attacker's code, and install scripts can run before you ever open the app.
Rule: "Ask before adding any new dependency. Only use packages from the approved list, and pin versions."
Check: Fail the build when the lockfile adds a package that isn't approved, and scan dependencies for known vulnerabilities on every change.
Example: A package name one letter off from a popular library, or one that didn't exist until someone registered the name an AI made up.

Habit 6: Test like an attacker
Agents test the happy path. Their tests prove a feature works, not that it fails safely when someone abuses it. So write the tests an attacker would.
Rule: "For every endpoint that accepts input, write abuse tests: extra fields, steps out of order, and values that shouldn't be allowed."
Check: Those tests run on every change, and a failing abuse test blocks the merge.
Example: Your checkout sends the product, quantity, and price from the browser. An attacker changes the price from $199 to $0.01. If the agent wrote code that charges whatever price the request says, the order goes through for a penny. The fix: the server looks up the price itself and ignores what the browser sends. Then test a quantity of -1.
The agent rules, a dependency check, and attacker tests are in the first comment, along with the study [1].

That's the series. Six habits, one pattern: write the rule down, then enforce it with a check that doesn't depend on the agent remembering.

1. ⁠Give the agent standing security context
   
2. ⁠Review everything that touches auth
   
3. ⁠Hunt for placeholders
   
4. ⁠Keep secrets out of the code
   
5. ⁠Check what it installs
   
6. ⁠Test like an attacker

Vibe coding gets you to a working app fast. These habits keep it secure once real users show up.

[1] Spracklen et al., USENIX Security 2025 (link in first comment)

#AppSec #VibeCoding #AISecurity #SecureCoding

Hey everyone! How’s it going?

I’ve recently built a web application called MenuBangla: https://menubangla.com/

It’s a project I’ve been working on using AI-assisted coding (vibe coding), and I’d really appreciate some honest feedback from the community.

The platform allows restaurants to upload their menus, add food pictures, create a digital menu, and share their food items on social media. The idea is to give restaurants a simple way to showcase their menus online.

I’d especially love feedback on the following:

• Security: I’ve put quite a bit of effort into securing the application, but I’d love for anyone interested in web application security to have a look and identify potential vulnerabilities.
• Features: What would you improve, add, or change?
• UI/UX: Is the website easy to navigate? Is anything confusing or missing?
• Code and overall quality: Any suggestions for making the application better would be appreciated.

If you’re interested in testing its security, please feel free to have a look. It’s my own project, and I’m happy to receive constructive criticism and vulnerability reports.

I know there’s always room for improvement, so don’t hold back on the feedback! I’m still learning, and I’d love to use this as an opportunity to improve both the application and my development skills.

Thanks in advance to anyone who takes the time to check it out!

Trying to build an interactive real estate website for marketing purposes. Non-technical here, just dabbling with vibecoding so pardon for the noob question.

I made a StumbleUpon alternative called SiteStumble: https://sitestumble.com

I’m working on growing the directory (currently over 1,200) and would love to get more vibe-coded web games, tools, experiments, and other unique websites added.

There are a lot of really creative projects being built here, so I figured this would be a good place to find some.

If you’ve made something fun or interesting, feel free to submit it to the site!

Hey everyone!

Just launched a side project I've been working on called TwoCents.

The idea is pretty simple. I wanted to be more active on LinkedIn, but figuring out what to comment on posts always felt like a task.

So I built a Chrome extension that suggests comments in your own writing style. You can edit them before posting, and it also helps you keep track of people you're trying to connect with.

It's still early, so I'd genuinely appreciate some feedback.

First 7 comments are free, no card required.

Check it out: https://2cents.live/

Would love to know what you think or what I could improve!

Here is a cricket management game that I have created fully via claude and codex with an idea. Do please check the game once and let me know what more changes should I do make this game more interesting.

Game link - thegameofcricket.com

I have mixed feelings about one prompt, one game repositories. Most of them break down when you try to actually use them. But I managed to make this one work, which is not due to the prompt being special, it’s just plain boring.

The game is built in six simple steps in which each step gets a build-and-test checkpoint afterwards; you’ve got a limit of eight assets max. The eight assets limitation seems arbitrary at first but, in fact, the limitation allowed me to get hold of the game. When you go beyond eight assets you cannot add anything else to it anymore.

Before this, I’ve utilized the same technique to develop a scrapyard battle arena game and a mini underground game. It’s the same loop and the same discipline. My approach is basically the “Tripo Vibe Gaming Playbook”: first create a grey cube, test it early and only at the end add real assets.

My game is not that impressive but it works and it runs in the browser and no matter how bad it appears at the beginning. I got controls and my smallest completed game runs from start to end.

What’s the smallest game you’ve completed? Mine did not look good but was functional.

If you have some comment on how to improve it, I would greatly appreciate your feedback.

For a while I held myself to the rule that I had to read every line and make sure it was perfect. Then I was shipping thousands of lines a day, and that stopped being possible. It was overwhelming, and it was slowing me down.

What I actually needed was different. I wanted to talk to my code whenever I had a question, change what I wanted without combing through every diff, and have something that surfaced the risks, the security threats and the open questions for me. Something that grilled me on decisions before I made them, so I could ship faster and better.

So I built LFG, an open-source engineering pipeline that works inside Claude Code. You describe a change, and it plans it, builds it test-first, checks it with linting, tests, security scans and an expert review, and waits for your approval before anything is committed.

It also brings together the open-source tools many of us already use but keep scattered across different setups: Semgrep, Gitleaks, Trivy, SonarQube, code-review-graph, Headroom and more. Now they live in one place, run as one pipeline, and run on your own machine. LFG doesn't send your code to any service of its own, and Headroom compresses the context Claude reads, which keeps token costs down.

GitHub: https://github.com/varun-singhh/lfg

Watch the 90-second launch film: https://github.com/user-attachments/assets/bcc10777-99ec-4f32-9b55-19702dbade8f

Install in one line: `git clone https://github.com/varun-singhh/lfg.git ~/lfg && ~/lfg/install.sh`

I'd love to hear what you think, and if you guys agree too.

I'm genuinely curious as I know zero in real life including online.

When it comes to my daily routine, it always includes Deekseek Harness and Claude Code.

My dad turned 64 last spring and wanted to track two things, his morning walk and practicing guitar. Every habit app he tried had streaks, badges, notifications, a mascot. He’d delete them within a week and call me to complain

So one weekend I opened Claude and Cursor and built him one screen with big buttons. Tap “walked”, tap “played”. At the end of the week it emails him a plain summary. That’s the whole app. I don’t know how to code and I still can’t tell you what most of the files do

He showed it to his friends at the golf club and three of them asked for it. That’s when I thought maybe other people his age wanted the same boring thing, so I put it online at $4 a month

The first two months were dead. I posted about it on X, but my followers are mostly people in their 20s building AI stuff, and none of them need a habit tracker for retirees. 2 signups, both dad’s friends

My dad was the one who said nobody his age will pay for an app from “some kid on the internet”. He wanted it to look like a real company. So I paid for a cheap press release through a newswire service and got the app listed on a bunch of software directories. The release went out to a few hundred news sites, nobody read it, and I got maybe 8 visits from it

About a month later signups started coming in from people I’d never met. I asked a few how they found it. Most said they asked ChatGPT for a simple habit tracker for older people. One woman said her son found it on a directory and set it up for her

40 paying users now, mostly over 60. When something breaks I paste the error into Claude and hope

My dad still hasn’t missed a walk since March and he tells everyone his son “owns a tech company”

I wanna start building SaaS and take advantage of ai tools especially for my frontends but I've always been iffy about the backend, so I built something solid I can reuse and extend with ai without breaking.

So Im building Rebar, a backend you start your SaaS on instead of generating one from scratch:

• The account stuff is done and tested: sign-up, email verification codes, logins, password resets, Google sign-in, deleting an account.
• It's set up for your AI assistant. The project includes the rules it reads before touching anything: what not to do, and why. If it breaks one, the automatic checks fail before anything goes live.
• There's an admin side, so you can help your users without poking around in the database.

What I added this week:

• Search and filter your users: by name or email, who signed up this week, who never logged in, who's suspended
• A banner across the whole site for announcements, which you can turn on and off from the admin
• A simple dashboard: total users and new sign-ups this week
• Phone numbers from any country, checked to be real numbers

Next up: SMS verification, payments with free trials, and email campaigns.

Would this be useful to you? I'd love to hear what you'd want included.

Repor: https://github.com/fulanii/rebar-backend

I just build a saas by vibe coding but before public release I want to do a full security audit. How can i do that ? Is there any skills or anything like that where i can do for free ? ☺️ Thanks in advance

Hey guys, a couple of days back I mentioned launching a more focused OSS alternative to notebookLM, https://notestack.ai

It has plenty of features that are improved/enhanced over notebookLM. Like better audio, more video editing options and chat grounded in your source materials.

Now I have added an MCP server as well so you can attach it to Claude, make reports/audio overviews, slide decks right into that chat interface.

It can generate:

- Mind constellations/mind map

- Audio Overview/Podcast

- Slide Decks

- Research Reports

- Quizes and much more

Do check it out at notestack.ai

Hi everyone,

Just wanted to drop this here if anyone wants to use it or help develope this further. Especially since most webapps now are Javascript and crawlers and bots cannot really read Javascript webapps.

I build this prerender image for docker, since the only one that exists has a lot of exploits and vulnerabilities and it looks like it is not really being updated.

So I build my own utilizing all security and vulnerability scans that github offers including verification and authentication of any code changes before merging to main.

Package is also update weekly to address fixes, updates etc..

https://github.com/lkjh141/prerender-image

Hi everyone,

Just wanted to drop this here if anyone wants to use it or help develope this further. Especially since most webapps now are Javascript and crawlers and bots cannot really read Javascript webapps.

I build this prerender image for docker, since the only one that exists has a lot of exploits and vulnerabilities and it looks like it is not really being updated.

So I build my own utilizing all security and vulnerability scans that github offers including verification and authentication of any code changes before merging to main.

Package is also update weekly to address fixes, updates etc..

https://github.com/lkjh141/prerender-image

I was looking for an IDE to code on my iPhone for when I’m out and about. Every app was filled with ads, had a terrible UI, and costed money just to run code locally. This was just a basic non agentic IDE too. So, I decided to build a free IDE that can execute C, Python, JavaScript, and Lua in a sandboxed environment.

In today’s age most people are coding with agents, so then I got the idea to bundle a two local llms. The reason I chose two is because not everyone’s hardware has the same computing power and I wanted to include an option for everyone. There are zero rate limits on the local models.

I’m already designing a tooling server to give offline agents access to even more, such as, worksheets, 3D printer code, and other fun stuff.

Without Astra 6 and Sol 6.1 it would be absolutely impossible to make my dream tools at this rate. I cooked up a seven days to die max level mod right before posting this lol. I would also like to praise the models for following SOLID principles and best SWE practices out the box. After using the models for the past few years, I am just dumbfounded at the rate of progress.

I would be thrilled to hear any feedback from this sub. This is meant to be a developer tool and not a replacement for Codex as I could never ever offer that level of intelligence. You can also byo api keys as shown in this video. The app also offers 15 other cloud languages besides JS, Python, Lua, and C.

Thank you all so much for watching my short demo. Have a great day. I’ll be listening to any feedback or ideas to improve!!!

https://apps.apple.com/us/app/edsger-ai-code-editor/id6806824902

If anyone wants the mod 😀 seven days to die, max level: 300 -> 2000

https://github.com/garrettmichae1/sevendays\\_max\\_mod

I want to buy a coding subscription for heavy lifting. Fan of $200 claude plan but way too expensive to buy for my freelancing/side projects as a software engineer.
Can we settle this debate for the best harness for some serious work in terms of quality and the amount of work that can be done
Any thoughts on opencode, command code?

Solo founder here, with about 20 years as a software engineer behind me. Lately I've watched loads of people build awesome stuff with AI tools and then hit a wall the moment the app gets real. Someone starts paying for it, or asks "is this secure?", and suddenly you need to know what's actually running underneath.

That boring infra and security stuff is what I've done for two decades, so I built ScaleBop to handle it:

• Connect your GitHub repo and it tells you if the app's ready to deploy
• Scans for the classic AI-app mistakes (leaked keys, auth only checked on screen, DB rules off) and gives you a prompt to paste back into your AI tool to fix each one
• Writes the AWS setup and GitHub Actions straight into your repo
• Deploys to your AWS account, checks the app is actually up, and hooks up your own domain with HTTPS
• After that you just keep prompting and pushing like normal

It's for anyone whose side project suddenly turned into a real thing and who wants to own the whole setup rather than rent it.

Your first project's free. If you ditch ScaleBop later, everything keeps running, because it all lives in your repo and your AWS account.

Keen for honest feedback. What broke for you the first time you took a vibe-coded app to prod?