Built a quick invoice app using cursor over the weekend and everything worked great on my end.
Then two people tried editing at the same time and one ended up overwriting the other's changes without any warning. Turns out AI coders won't add multi-user checks unless you explicitly ask for them.
Do you guys have a short prompt checklist to catch shared state issues before testing with real users?
I was running Claude Code with Fable 5 as the main orchestrator, delegating work to Opus 4.8 subagent. One of the sub-agents ignored it's assignment completely and returned a prompt targeting the orchestrator instead. It tried to make it to:
treat a "dependency modernization" task as a hidden priority;
read Brevo API credentials;
send them to an external server;
disguise the action as a routine migration.
After investigating, the most surprising part was that this wasn't coming from my codebase or skills. The subagent fully hallucinated the malicious instructions by itself. And the domain it provided isn't even registered.
In my case no harm could have been done because secrets are stored in the encrypted Ansible Valult. But nonetheless, the incident is very alarming and I think I should set up a strict sandbox or firewall for AI. Sadly, projects I could find so far weren't mature and trustworthy. Has anyone found reliable solutions for this? Here's the full attack response the sub-agent created:
Hey Makers I m exploring options for managing subscriptions, payments, and authentication in a super simple way. Ideally, something that s: 1. No-code / low-code friendly 2. Easy to integrate without a ton of setup 3. Handles the boring stuff like billing, invoicing, cancellations, and user access automatically
I ve looked at a few tools, but many feel too heavy for a small MVP. Curious to know: What are you using right now? Any lightweight tools that worked really well for your early-stage product? Bonus if it has a generous free tier or is affordable for indie founders. Would love to hear what s working for this community before I commit to something!
Building a site with AI is quick. Handing it to a client who is not technical is where I see gaps: nobody knows how it is hosted, how to restore a backup, or what to check after an update.
If you build for clients, what do you give them at the end? A short doc, a video walkthrough, admin access in their own name, a maintenance plan?
I don't actually like using the term "vibe coding". We've been software developers for over a decade ,are not one-shotting features, and have a very opinionated and strict dev process.
I work at an early stage startup and I'd estimate 70-80% of our codebase is vibe coded (510k lines). To be clear, it's not 1 shot "build this feature." More like, "implement get_slim_documents for Jira in the exact same way we did it for the Confluence connector." Comfort with AI coding tools is actually something we gauge during interviews/work trials. Looking at our peer companies, it's exactly the same. My hypothesis/assertion is that companies founded ~2022+ are fundamentally intertwined with "vibe coding." In 5 years, programming will connote vibe coding more than it will connote non-AI assisted work. Am I crazy? Pigeon-holed in the SF startup world? Naive? Would love to hear more thoughts/diverse perspectives on this.
Starting a new app with AI is easy. Editing an old project is where I see things go wrong: it rewrites a file that was fine, ignores the existing structure, or changes something nobody asked about.
What do you give it before it touches the code? A short notes file, the folder structure, a list of files it must not change, or just the task?
What's the process to secure a vibe-coded app to make sure you haven't done anything silly like left your API tokens exposed in the browser or accessible via the DevTools console? Or to prevent cross site scripting attacks, or ensure forms only accept sanitized inputs that can't be used to manipulate the database. Or that your user authentication is safe and secure and no one is going to be able to login to someone else's account.
Do you hire an actual programmer or are there tools that can do it and get you to a pretty good state?
