After the third time an agent gave me a passing test that was testing nothing, I added one rule: before accepting any fix, I revert it and confirm the test fails.

If the test still passes without the fix, the test is wrong. This has caught assertions against mocks that never change, tests that check the function was called instead of what it returned, and one test comparing a variable to itself.

I've been building a SaaS with Lovable + Supabase that handles pretty sensitive stuff bank data via Open Banking, tax-related info. It's still in beta with very few users, but I want to get security right before opening it up more.

I know the basics (HTTPS, not exposing API keys in the frontend), but I'm not confident I've covered what actually matters for something handling financial/tax data.

For anyone who's dealt with this:

What would you consider the absolute minimum before letting real users connect their bank accounts to something you built solo?

Hey everyone. My name is Talha Masood and I am a second time founder. Previously I built Remotebase[dot]com and raised $2.7 million for my startup.

I am now building an AI editor to help interviewers assess vibe coding skills in software engineers. I myself vibe code every single day, even though I have more than 10 years of experience writing code. I believe that software teams can now move 10x faster if they're using the right AI workflows and tools.
Here are a few facts about me:

• I have launched close to 10 times on Product Hunt

• I organize a lot of IRL events in San Francisco. My latest event is happening on April 24th. Here's the link to it if you're interested - https://lu.ma/5s9vc24j

• I can write code 10x faster than an average software engineer by using the right Vibe Coding tools. Please challenge me. P.S. I came up with the number 10x out of thin air lol. But I do a lot of Vibe Coding

• I am also looking for a technical co-founder right now.

I started using Replit about 3 weeks ago. First on a trial basis and then decided to pay the quite ok monthly fee of $25. What I didn't realize back then was that once they got my credit card info they just keep charging for use even if cancel my sub.

The thing is that Replit charges 'checkpoints' a 25 cents each no matter what it does. Implementing Google Auth with 2FA or failing over and over again to format an output i Typescript, same result. The checkpoints just runs away. When the AI fails to solve a very basic variable naming problem for the Xth time you tend to get a bit frustrated - to say the least. Tell the AI to mind the difference between CamelCase and snake_case and it remembers it for less than 5 minutes. Putting it in writing in the manifest Instructions.md makes no difference.

After about a week I decided to make a first deployment. The AI ran all sorts of test and then deployed. Successfully in its own words. Except not a single endpoint worked in deployment. Not even logging in to the Express backend as admin. So I asked the AI if it thought it was ok that code that worked in the Replit dev env did not work in their own deployment env (based on Google Cloud). It wasn't. So I sent a mail to support. Which yielded absolutely nothing but a boilerplats BS answer. You see, the support too is an AI. How clever is that!

Vibe coding makes it much easier for non-technical founders to build a first version, test an idea, and get real users without hiring a full engineering team.

But what happens when the product starts working?

You have users. Maybe even paying customers. People depend on it now. But the app starts slowing down, bugs become harder to fix, and adding new features feels risky because the codebase was built mainly to validate the idea.

At that point, the question is no longer: Can this be built?

10 years as a 3D artist, never touched Xcode or written a line of code before this year. In February I opened Cursor and just started typing what I wanted to build.

7 months later, backend on Cloudflare Workers, iOS app in SwiftUI, multi-model AI routing (GPT, Claude, Gemini), all written and shipped through Cursor. Launched on the App Store, now live on Product Hunt today.

Biggest surprise for me: the hard part was never writing the code, Cursor handled most of that. The hard part was learning to think in systems, architecture, what breaks what, how to debug when something goes wrong three layers deep. That took actual time.

Curious how far others here have pushed it. Anyone shipped something with real backend complexity, not just a CRUD app or landing page?

I keep going back and forth on this. Write out a tight spec first (user story, edge cases, acceptance criteria) and the AI output gets a lot more predictable, but it also kills a chunk of the speed that made vibe coding appealing in the first place. Skip the spec and just describe the vibe, and I end up rewriting prompts three or four times to fix things a spec would've caught upfront. Where do people here actually land? Full spec, loose bullet points, or just winging it and iterating in the chat?

There is one directory in my project I am not allowed to refactor, even to tidy it up: the code that draws the actual Nutrition Facts panel, to the regulator's spacing rules.

It is not pretty code. But it is correct, it is verified against the regulation's worked examples, and every "improvement" I can imagine risks nudging a hairline rule by half a point and making thousands of generated labels subtly non-compliant. So it is frozen. Bugs elsewhere get fixed; that folder gets read-only respect.

Hey makers!
I've been deep in prompt engineering lately while building an AI tool, and I'm genuinely curious about how others approach this.
A few questions:
1. Do you save your best prompts somewhere? Notion, text files, dedicated app, or just copy-paste from chat history?
2. How do you iterate? Do you have a systematic approach or just tweak until it works?
3. Different prompts for different models? Or do you use the same prompt for ChatGPT, Claude, Gemini?
4. Text vs image prompts do you treat them completely differently?
I've noticed I was doing the same optimizations over and over (adding role, being more specific, structuring output format), which made me wonder if everyone has their own "prompt formula."
Would love to hear your workflows!

I ve been testing the 'Free Tier' limits of the 2026 AI landscape. While everyone swears by Claude 3.7 or GPT-5.2, I m trying to find the 'Golden Ratio' for makers on a zero-budget.

My current findings for the Office Bee MVP:

• The Brain: Gemini 3.1 Pro (via AI Studio) seems to have the highest 'Reasoning-per-Dollar' (free) for deep R&D.

• The Frontend: v0 (Free Tier) for shadcn/ui components.

• The Glue: Bolt.new for the initial scaffold.

The Challenge: Most 'free' models hallucinate complex state management in full-stack architectures.