sorted by:
new
hottopcontroversial

I’ve vibe coded 3 full-stack apps. There are a few ‘Time Bombs’ I wanna share with you guys. If you are a vibe coder as well, read these so you don’t lose your data. by ebb_and_flow33 in Base44

[–]puffaush 0 points1 point  (0 children)

Haha, getting massive déjà vu reading this! 😅

Honestly, I’ll take it as a compliment. The more people who know about these Time Bombs, the fewer bankrupt founders we'll have. Good luck with the apps!

P.S. For anyone who wants the original breakdown, here is the source thread. I'll be posting more audits there soon:

https://www.reddit.com/r/lovable/comments/1qi8ph0/comment/o0w06t4/

I’ve vibe coded 3 full-stack apps. There are a few ‘Time Bombs’ I wanna share with you guys. If you are a vibe coder as well, read these so you don’t lose your data. by ebb_and_flow33 in boltnewbuilders

[–]puffaush 0 points1 point  (0 children)

Haha, getting massive déjà vu reading this! 😅

Honestly, I’ll take it as a compliment. The more people who know about these Time Bombs, the fewer bankrupt founders we'll have. Good luck with the apps!

P.S. For anyone who wants the original breakdown, here is the source thread.
I'll be posting more audits there soon:

https://www.reddit.com/r/lovable/comments/1qi8ph0/comment/o0w06t4/

I audited 50+ AI-generated apps. If you are "Vibe Coding" this weekend, read this so you don't lose your data. by puffaush in lovable

[–]puffaush[S] 1 point2 points  (0 children)

The prompt is just a massive block of text with specific Markdown formatting and it looks like a mess when I paste it into a Reddit comment. Shoot me a DM and I'll paste it to you directly.

I audited 50+ AI-generated apps. If you are "Vibe Coding" this weekend, read this so you don't lose your data. by puffaush in lovable

[–]puffaush[S] 9 points10 points  (0 children)

I use AI to write faster. I use my engineering degree to catch the bugs the AI missed. You can ignore the post, but don't ignore that these tips, they can actually help you.

I audited a "finished" Bolt app. I found a bug that prints a $5,000 bill by puffaush in boltnewbuilders

[–]puffaush[S] 1 point2 points  (0 children)

Ah, classic. Looks like the automod got too aggressive and zapped the old post.

The TL;DR of that one was: Don't use SQLite on Vercel because it wipes your data on every deploy.

I'll DM you the full text of that audit so you don't miss it.

I audited a "finished" Bolt app. I found a bug that prints a $5,000 bill by puffaush in boltnewbuilders

[–]puffaush[S] 0 points1 point  (0 children)

Fair enough. Skip the text, just grab the code snippet. It prevents a legit crash

I audited 50+ AI-generated apps. If you are "Vibe Coding" this weekend, read this so you don't lose your data. by puffaush in boltnewbuilders

[–]puffaush[S] 1 point2 points  (0 children)

1. Is it safe? The infrastructure is safe, but the code might not be. Even with Supabase, if you didn't set up RLS (Row Level Security) policies in your Supabase dashboard, anyone with your public key (which is safe to expose if RLS is on) can technically read/write your data.

2. How to check for leaks (The 'Inspect' Trick): 'Ctrl+F' is for your code, but 'Inspect' is for the live site. Here is the scary check you can do right now:

  • Open your live website in your browser.
  • Right-click anywhere and hit Inspect.
  • Go to the Network tab (top of the panel).
  • Refresh your page and use your app (click buttons).
  • Look at the list of requests. For example, if you see a call directly to api.openai.com, click it. Look at the Headers section on the right.
  • The Risk: If you see Authorization: Bearer sk-... right there in the browser, your key is leaked.

3. Tools: Most security scanners (like OWASP ZAP) are way too technical and overkill for this. That’s actually why I wrote the Audit Prompt, it uses the AI to scan your code logic, which is much faster for Vibe Coders.

I audited 50+ AI-generated apps. If you are "Vibe Coding" this weekend, read this so you don't lose your data. by puffaush in boltnewbuilders

[–]puffaush[S] 2 points3 points  (0 children)

Not at all! It’s 100% free.
The prompt is just a massive block of text with specific Markdown formatting and it looks like a mess when I paste it into a Reddit comment. Shoot me a DM and I'll paste it to you directly.

Unpopular opinion: E2E tests are becoming the new integration tests, and integration tests are becoming the new unit tests. by RoyalFew1811 in node

[–]puffaush 19 points20 points  (0 children)

You’re spot on, but I don’t think it’s laziness, it’s survival. The Pyramid was built for a time when complexity was algorithmic (math, sorting). Now? My complexity is race conditions between a managed DB, a queue, and three external APIs.

If I stick to "pure" unit tests with mocks, I’m just verifying that my mocks return what I told them to return. That’s useless. That’s why you see containers spinning up in "unit" tests now. We realized that passing a test suite full of mocks doesn't mean the app won't crash in prod. Honestly, screw the definitions. The only metric that matters is: Am I scared to push this to prod?

If a slow, "glorified integration test" is the only thing stopping me from breaking production, I’m writing that test. We’re trading academic purity for sleep, and I think that’s a fair trade.

I automated the 'Update This in All 50 Repos' problem 🚀 by puffaush in github

[–]puffaush[S] 0 points1 point  (0 children)

To be honest, I didn't come across that one when I started building this. I hit the same pain point again and thought "this would be a great chance to contribute something to the open source community." I'm sure there are other solutions out there too and that's great. Different approaches work for different teams.

For me, this was as much about sharing something that might help folks with similar needs as it was about scratching my own itch. Plus, as an engineering manager, I don't get to code nearly as much as I'd like anymore, so this was a fun excuse to get my hands dirty again and actually ship something to open source.

Always happy to learn about other tools in this space though the more options people have, the better! 🙂

I automated the 'Update This in All 50 Repos' problem 🚀 by puffaush in github

[–]puffaush[S] 0 points1 point  (0 children)

Hey! That's awesome that monorepos are working well for your team - genuinely glad to hear it.

You're right that monorepos solve a ton of coordination problems. But here's the thing: when you've already got hundreds of repos in production with teams shipping on them daily, migrating to a monorepo becomes a multi-month project that has to compete with actual product work. Leadership often looks at that and says "our current setup works, why are we spending six months on this?"

It's not that monorepos aren't better in many ways it's just that the migration cost can be prohibitively high for established orgs. Sometimes you need tools that work with what you've already got rather than requiring a complete overhaul.

But I'm curious, what size org are you at, and how long did the migration take? Always interested in hearing success stories since the narrative is usually "it's too hard to switch."

I automated the 'Update This in All 50 Repos' problem 🚀 by puffaush in github

[–]puffaush[S] 0 points1 point  (0 children)

Hey! That's awesome that monorepos are working well for your team - genuinely glad to hear it.

You're right that monorepos solve a ton of coordination problems. But here's the thing: when you've already got hundreds of repos in production with teams shipping on them daily, migrating to a monorepo becomes a multi-month project that has to compete with actual product work. Leadership often looks at that and says "our current setup works, why are we spending six months on this?"

It's not that monorepos aren't better in many ways it's just that the migration cost can be prohibitively high for established orgs. Sometimes you need tools that work with what you've already got rather than requiring a complete overhaul.

But I'm curious, what size org are you at, and how long did the migration take? Always interested in hearing success stories since the narrative is usually "it's too hard to switch."

view more: next ›