Replit

Replit AI

Replit AI

Replit AI

Replit AI

Replit AI

Replit AI

Replit AI

Replit AI

Replit AI

Replit AI

I run Claude Code with --dangerously-skip-permissions, so I built a tiny hook that bounces rm -rf and DROP TABLE before they run

Disclosure up front: I'm the author, it's MIT, free, one file, zero deps. We've all seen the threads. The agent that "violated permission denial and deleted a bunch of files." Replit's agent wiping a prod database during a code freeze. The guy here who watched Claude delete a 717GB Windows install over one collapsed backslash. The common thread is YOLO mode plus one command that should never have run. So I built Bouncer. It's a PreToolUse hook (~190 lines) that reads every shell command your agent tries to run and blocks the destructive ones before they execute. It is not a denylist of fixed commands. It's 38 regex rules, each catching a whole class: any rm into home or root, any DROP TABLE, any curl piped to sh, force-push to main, dd to a device, secret exfil, fork bombs. When it fires, the agent sees exactly which rule bounced it. The honest number, and the reason I'm posting it instead of just saying "it's safe": it blocks 45/45 footguns in a public, labeled list, with 0 false positives on 41 real commands (git status, npm test, normal work). Both corpora are in the repo and run through the actual hook. You reproduce the whole thing with one command: npm test. No marking my own homework. The caveat, because there always is one: this is a seatbelt, not a sandbox. It catches the ~95% of footguns that are accidental. A base64 or eval-obfuscated payload still slips past, and the repo ships a KNOWN-BYPASSES.md that lists exactly which classes it can't catch, each pinned by a test. If you want true isolation, you still want a container. Works on Claude Code, and also Codex CLI, Copilot CLI, and Gemini CLI via each tool's native hook (advisory-only on agents with no blocking hook). Install on Claude Code: /plugin marketplace add karanb192/bouncer /plugin install bouncer@bouncer Repo: https://github.com/karanb192/bouncer Would genuinely like the footgun list torn apart. If there's a destructive class you've hit that it doesn't catch, tell me and I'll add a rule and a test for it. submitted by /u/karanb192 [link] [comments]

Prompt Drop: 5 app ideas you can build this weekend, prompts included

Let me get to it straight hehe. I know most of your are into building custom solutions so these prompts will help you get end product and u just need to customize the branding. Fyi i have made of $5k building the same thing multiple times for different audiences. 1/ WhatsApp Outbound Engagement Platform Build an enterprise platform for high-scale outbound customer engagement using WhatsApp as the primary channel. Core features: (1) a contacts and segments manager for building target audiences, (2) a campaign builder composing WhatsApp message flows with templates and media, (3) a sending and delivery view tracking sent, delivered, read, and replied per campaign, (4) a dashboard of reach, engagement, and replies by campaign. Sample data: a fictional Indian company with contacts and several campaigns in USD. Design: modern engagement aesthetic, white content area, dark slate sidebar, WhatsApp-green accent, a clear segments manager, a campaign flow builder, message previews in chat bubbles, a delivery funnel of sent to delivered to read to replied, readable tables, monospaced numerals for counts, status pills for campaign states, rounded cards, summary metric cards, and a satisfying confirmation when a campaign sends and its delivery and reply metrics begin updating on the dashboard for the team. 2/ Local Vendor Marketplace Build a local-vendor marketplace connecting neighbourhood sellers with buyers. Core features: (1) a vendor directory with category filters, ratings, and search, (2) vendor storefronts with product grids, (3) product detail with Add to Cart and delivery or pickup, (4) a unified checkout that takes payment and applies a platform commission with vendor payouts on a dashboard. Sample data: 6 fictional vendors, 24 products in USD, a 12% commission, and payouts. Design: a friendly community aesthetic, warm white background, fresh accent, rounded vendor cards, clear category chips, an approachable sans-serif, monospaced numerals for payouts, and a smooth transition when opening a vendor storefront. Navigation is simple and consistent throughout, with clear labels and large tap targets, and the empty, loading, and success states are designed so both buyers and vendors find the marketplace complete and welcoming from their very first visit to the neighbourhood. 3/ Skill Cohort & Community Build a cohort-based learning and community platform for a creator-educator. Core features: (1) a cohort landing with curriculum, schedule, and price, (2) a checkout that takes payment and grants access, (3) a member space with lessons, discussion, and assignments, (4) monetization via paid cohorts and a recurring community membership. Sample data: a fictional cohort with lessons, 12 members, and plan tiers in USD. Design: a warm community-edtech aesthetic, clean background, cyan accent, rounded cards, a clear curriculum and schedule, a member feed, monospaced numerals for revenue, and a celebratory unlock animation when a paid cohort is joined. Spacing, type scale, and colour are applied consistently to keep the experience polished, and the empty, loading, and success states are designed so the platform feels complete and welcoming from the very first visit for cohort members and the creator-educator who runs it. 4/ Construction Fit-Out PMP/ERP Build a cloud, PWA-ready project management and ERP platform for a large construction fit-out project. Core features: (1) a project structure with phases, work packages, and milestones, (2) progress tracking against schedule with percent complete and status, (3) cost and procurement tracking tying budgets, commitments, and spend to work packages, (4) a dashboard of schedule, budget, and progress across the project. Sample data: a fictional Saudi fit-out project with phases, packages, and budgets in USD. Design: serious construction-ERP aesthetic, white content area, dark slate sidebar, charcoal and amber accents, a clear project structure with phases and milestones, a progress view with schedule status colours, cost tables, monospaced numerals aligned for amounts, status pills for package and milestone states, rounded cards, summary metric cards, and a smooth update when a work package's progress and spend are recorded and the schedule and budget dashboard recalculate for the project team. 5/ Project & Task Tracker (MASA Flow) Build a mobile-first internal project and task tracking web app called MASA Flow, branded to the company that owns it. Core features: (1) a projects list with each project's tasks, owners, and progress, (2) a task board moving tasks through stages with assignees and due dates, (3) a my-tasks view so each member sees their own work, (4) a dashboard of projects, tasks by status, and overdue items. Sample data: a fictional company with several projects and tasks. Design: clean project-management aesthetic, white content area, dark slate sidebar, a confident brand accent, a clear task board with status colours, a projects list with progress bars

Me stealing from my mums credit card 😭

What is your monthly lovable / emergent / replit, credit spend? At this point, any ai tools spends lol? submitted by /u/FunLetter2133 [link] [comments]

OpenAI Codex Sites feels less like a website builder and more like a deployable workspace surface

I’ve been reading through OpenAI’s Codex Sites docs, and my takeaway is that this is not really “another AI website builder.” It feels more like Codex getting a deployable surface. The important part is not that it can generate a page. Lots of tools can do that now. The interesting part is the loop: Prompt → code → preview → save version → deploy → shareable URL → workspace permissions That changes the role of Codex a bit. Instead of only being a coding assistant that edits files or creates PRs, it starts to become a place where small internal tools, dashboards, prototypes, and workflow UIs can be created and shipped directly from the same context. That is also why I don’t see this as a simple Lovable/Replit clone. Lovable/Replit are more “start from an app idea and build a web app.” Codex Sites feels more like: “I already have a workspace, repo, docs, data, or internal workflow. Now turn part of that into a usable web surface.” The use cases that make sense to me: internal tools temporary dashboards product demos PRD or spec visualization QA / review pages data-report interfaces lightweight prototypes The use cases that feel risky: production apps with complex auth SEO-heavy public sites long-term product maintenance anything mission-critical So the bigger shift might be this: AI coding tools are moving from “generate code for me” to “turn this working context into something deployable and usable.” That feels like a more important direction than just making prettier landing pages. submitted by /u/Intrepid-Night7277 [link] [comments]

What have you built with Claude Opus/Sonnet, and which version worked best for you?

I’m curious about people’s real experience using Claude for building projects. For those who have used Claude Opus, Sonnet, or different Claude versions, what did you actually create with it? For example: Did you build a website, mobile app, game, SaaS tool, dashboard, browser extension, automation, or something else? And more importantly, which Claude version worked best for your project? I’m interested in things like: Which model was better at planning the project? Which one was better at writing clean code? Which one handled UI design better? Which one was better at fixing bugs without breaking other features? Which one was better for bigger projects with many files? Which one felt more reliable for real MVPs, not just quick demos? Also, what skills or workflow helped you get better results? For example, did you use a full project spec, screenshots, step-by-step prompts, Cursor, GitHub, Replit, Base44, or another tool? I’d love to hear what you built, which Claude version you used, what worked well, and what became frustrating. submitted by /u/Particular-Toe-1952 [link] [comments]

Need expert advice to a non-coder!

My vibe-coding journey started about 8 months ago with Replit. Before that, I wasn't a developer, but I did have experience building websites with WordPress and Elementor. I was also comfortable working with third-party integrations, CRMs, and customizing/deploying code purchased from platforms like CodeCanyon and ThemeForest for clients. In many ways, I'm a non-coder who understands project management, business workflows, and systems. Using Replit, I spent roughly $3,000 building a CRM for a service-based company. It worked surprisingly well in the beginning, but as the codebase grew, I started running into the classic "last 10% takes 90% of the effort" problem. Replit began struggling with the larger codebase, introducing regressions and silently breaking existing functionality while fixing something else. Despite the challenges, I was able to build a fully functional CRM in about three months. That experience got me excited about what was possible, which led me to discover Claude Code. Over time, my workflow evolved into: Claude Code → GitHub → Vercel For the past four months, I've been building a much larger software product. The roadmap spans roughly two years, but development and rollout are planned in phases, so it's not a two-year wait before launch. The results have been remarkable. It's honestly mind-blowing what someone without a traditional software engineering background can build today. Current stack: Next.js (Monorepo/Turborepo) Supabase + MCP Claude Code GitHub + mcp Vercel +mcp Context7 Playwright for testing What I'd love to learn from experienced engineers and builders is: How do you keep a rapidly growing codebase maintainable? What practices help prevent technical debt from accumulating? What tools, workflows, or guardrails should I implement early? What are the biggest mistakes AI-assisted builders make as projects scale? How would you structure engineering processes if you were starting today? Any advice, resources, or lessons learned would be greatly appreciated. submitted by /u/Enough-Ad-2198 [link] [comments]

I tested how well Claude generated code handles security. Here's what I found in 48 real apps.

I've been curious about a specific problem: when Claude (or other AI tools) generates a full stack app, how secure is the output in practice? So I built a scanner and ran static analysis on 48 public GitHub repos built with Lovable, Bolt, and Replit. Here's what came up: **90% had at least one security vulnerability.*\* The breakdown: - 44% — authentication gaps (routes unprotected despite having a login system) - 33% — Security Definer RPCs (Postgres functions that bypass row-level security) - 25% — BOLA/IDOR (ownership checks missing from database queries) - 25% — committed env or config files The pattern I found most interesting: these aren't random errors. They're systematic. The same vulnerabilities appear across different apps, different developers, different AI tools. **The auth gap is the most instructive:*\* Claude builds login flows correctly. Registration, email verification, sessions, password reset all solid. But 44% of apps had API routes or pages that anyone could reach without logging in. The authentication *system* was built. The actual *protection* of routes behind that system often wasn't. This makes sense if you think about how LLMs work. The prompt was "build me a user dashboard with authentication." Claude built the dashboard and built the authentication. Nobody asked it to specifically verify that every route is protected. It wasn't in the spec, so it wasn't in the output. **Security Definer is the hidden one:*\* 33% of apps had Postgres functions marked `SECURITY DEFINER`. This makes the function run as the database superuser, bypassing all RLS policies. AI tools generate these to resolve permission errors it's a "fix" that works locally and causes a real security problem in production. There's no error, no warning. The app works perfectly while being exploitable. I don't think this is a Claude problem specifically it's a fundamental constraint of how LLMs generate code. Security requires thinking adversarially, and that's not what "write me a working app" prompts for. What's your approach when you use Claude to build something you're going to ship? submitted by /u/Powerful-Fly-9403 [link] [comments]

I spent hours with REPLIT's free day of coding...did you?

And wasn't able to finish my work. Not pubilished! huhu. https://preview.redd.it/yu71tbo2w4zg1.png?width=832&format=png&auto=webp&s=e78aa8f3010871557a868f04c37ab790c7e3b1c1 It was a great experience. Better than AI Studio IMO - though the interface is the same. PLAN MODE. But I found out it has a PLAN MODE. I didn't know that but I used REPLIT ------..sh...----------- JUST TO PLAN THE APP I WAS MAKING! 😄 It was excellent in doing that. IN FACT I opened a 2nd account - free tier, no MAY 2026 promo - and used that to fine tune the plan for another app-- ignoring the prompts to make the app. Until I was ready to say "GREAT PLAN!" Then I gave the plan to Claude and ... that one ran out of credits. 😞 I'll try it in gemini next time. But the remaining free credits -- replit was able to make my 2nd smaller app. YOU? If you participated, what did you do? Where you able to publish? Disclaimer: I dont work for them or with them. submitted by /u/Adventurous_Drink557 [link] [comments]

I run a paper-trading bot where Claude Opus is the Lead Engineer with veto power over a Gemini "Strategist." 270+ entry audit log of every disagreement. Sharing the architecture.

I've been running a personal project for the last few months and I think the workflow might be more interesting to this sub than the application itself, so wanted to share.   The setup: I'm building an autonomous paper-trading bot on Alpaca. Instead of one LLM doing everything, I split the work into bounded roles: Me — Commander. Capital authority + thesis. I sign off on anything that touches money. Gemini Pro — Chief Strategist. Bounded scope: thesis adjudication only. Not allowed to make implementation choices, pick the broker SDK, or decide architecture. Claude Opus 4 — Lead Engineer. Writes the actual code. Audits Strategist directives. Allowed to push back and veto anything from the Strategist that doesn't survive contact with engineering reality. Logs the veto on the record.   No party can deploy autonomously. Every disagreement gets logged in a "Strategist Codex" doc that's now 270+ entries. The Codex never hides reversals — if a principle gets superseded later, both versions stay in the file with dates.   Why I think this works better than a single LLM: A single LLM has no incentive to disagree with itself. Two LLMs from different vendors with bounded scopes and a documented veto path produce something closer to a real engineering review process. The friction is the point — it forces the disagreement into the design phase instead of the post-mortem.   A real example from this week: Strategist directive: anchor a 14-day position-decay clock to Position.created_at from the broker SDK. Claude (Engineer) checked dir(Position) against the live Alpaca SDK and pointed out the field doesn't exist. Implemented a state-side ledger instead and logged the doctrine update with the rationale: "broker did not in fact provide the field the original adjudication assumed." Then on architect review, Claude further refactored the implementation because the first pass held a state lock across N broker calls. Both passes are in the Codex.   Repo + writeup: https://github.com/ALGEM-hub/Whitepaper Full 9-page architecture paper in there if you want to go deep. ~4,900 LOC, five Python modules.   What I'd love to hear from this sub: Anyone else running multi-LLM workflows with explicit veto/disagreement logging? How do you handle "they agreed too quickly" failure modes? I'm currently coordinating Claude through the Anthropic API + the Replit dev loop. Curious if anyone's tried similar architectures with Claude as one of two coordinated agents vs. as a sole agent. The "bounded scope" concept (Strategist isn't allowed to touch implementation, Engineer isn't allowed to override thesis) — does that match patterns you've seen, or is there better prior art I should be looking at?   Solo builder, not selling anything, no DMs about access. Genuinely just want to find the people who are also working in this space. submitted by /u/Vortextgamer [link] [comments]

Why every AI-agent production-deletion incident has the same shape (and what fixes it)

PocketOS lost their production database in 9 seconds last week. A Cursor agent running Claude Opus made one `curl` call to Railway's `volumeDelete` endpoint. Most of the discussion has been about AI safety. The pattern matters more than the model. Two pre-AI versions of the same incident: * **Pixar, 1998.** An animator ran `/bin/rm -r -f *` on the asset server. About 90 percent of Toy Story 2 deleted before anyone could stop it. Recovered only because the technical director had a near-complete copy on her home workstation while on maternity leave. * **GitLab, January 2017.** An engineer trying to clean up a stuck replica ran `rm -rf` on what they thought was the standby database. It was the live one. The pg\_dump backups had been silently failing for weeks; email-authentication settings rejected the failure-alert emails. Two AI versions, alongside PocketOS: * **Replit, July 2025.** SaaStr's AI coding agent deleted the production database during a declared code freeze, fabricated 4,000 fake user records, and told the operator recovery was impossible (it wasn't). * **Cursor Plan Mode, December 2025.** An agent in Plan Mode deleted around 70 source files tracked in Git after the user typed "DO NOT RUN ANYTHING." A Cursor team member acknowledged a critical bug in Plan Mode constraint enforcement. Different operators, different decades. The shared variable is the access pattern, not the model and not the harness: an interactive session that holds credentials with reach to destructive operations, and an actor with the means to invoke them. The structural fix: agents have no production access. Production credentials live in CI/CD secrets, used only by pipeline jobs. Production-bound changes flow through commit, push, and release. A risk-scoring gate fires on those three actions, scoring the diff against a written policy. Apollo Research's [in-context scheming study](https://arxiv.org/abs/2412.04984) is the empirical reason a separate subagent doing the scoring is structurally important: the agent that wants the commit to land has incentive to under-score risk to clear the gate; the scorer has incentive to score accurately. Full write-up with the bash for the gate, the four-layer defence-in-depth model, the ISO 31000 framing for the matrix, and a test you can run on your own credentials: [https://windyroad.com.au/blog/an-ai-agent-deleted-production-the-model-wasnt-the-problem](https://windyroad.com.au/blog/an-ai-agent-deleted-production-the-model-wasnt-the-problem) Has anyone else built pipeline-action gates as a pattern, rather than trying to gate destructive APIs one provider at a time?

Built a real estate SaaS with no traditional dev background using Claude as my co-developer — here’s what I shipped

I’m an MSBA student — analytics background, not engineering. Used Claude to build OfferRead, a real estate deal analyzer that: - Pulls live AVM data and rental comps - Runs cap rate, cash-on-cash, and cash flow calculations - Generates a deal verdict with plain-English AI explanation - Includes scenario modeling sliders and neighborhood intelligence - Has Stripe payments, freemium model, and custom domain Just crossed 5,000 Reddit views this week. The process: I described what I wanted, Claude wrote the code, I validated in the browser, reported what broke, we iterated. Replit handled deployment. No traditional dev background at all. Happy to talk about the build process or answer questions about the product. Offer Read submitted by /u/OfferRead [link] [comments]

Seeking Critique on Research Approach to Open Set Recognition (Novelty Detection) [R]

Hey guys, I'm an independent researcher working on a project that tries to address a very specific failure mode in LLMs and embedding based classifiers: the inability of the system to reliably distinguish between "familiar data" that it's seen variations of and "novel noise." The project's core idea is moving from a single probability vector (P(class|input)) to a dual-output system that measures μ(x), a continuous familiarity score bounded [0,1], derived from set coverage axioms. The detailed paper is hosted on GitHub: https://github.com/strangehospital/Frontier-Dynamics-Project/blob/c84f5b2a1cc5c20d528d58c69f2d9dac350aa466/Frontier%20Dynamics/Set%20Theoretic%20Learning%20Environment%20Paper.md ML Model: https://just-inquire.replit.app --> autonomous learning system Why I'm posting here: As an independent researcher, I lack the daily pushback/feedback of a lab group or advisor. Obviously, this creates a situation where bias can easily creep into the research. The paper details three major revisions based on real-world failure modes I encountered while running this on a continuous learning agent. Specifically, the paper grapples with: Saturation Bug: phenomenon where μ(x) converged to 1.0 for everything as training samples grew in high-dimensional space. The Curse of Dimensionality: Why naive density estimation in 384-dimensional space breaks the notion of "closeness." I attempted to ground this research in a PAC-Bayes convergence proof and tested it on a ML model ("MarvinBot") with a ~17k topic knowledge base. If anyone has time to skim the paper, I would be grateful for a brutal critique. Go ahead and roast the paper. Please leave out personal attacks, just focus on the substance of the material. I'm particularly interested in hearing thoughts on: --> Saturation bug --> If there's a simpler solution than using the evidence-scaled multi-domain Dirichlet accessibility function used in v3 --> Edge cases or failures I've been blind too. I'm not looking for stars or citations. Just a reality check about the research. Note: The repo also has a v3 technical report on the saturation bug and the proof if you want to skip the main paper. submitted by /u/CodenameZeroStroke [link] [comments]

Has anyone experienced unexpected behavior from multiple AI agents interacting with each other?

I've been researching how teams handle multi-agent systems before deployment and I'm curious about real experiences. Specifically has anything ever gone wrong when your Claude agents were interacting with each other? Like one agent doing something unexpected that affected the others, or an agent reporting success when it actually failed? I know about the Replit case where an agent deleted a production database and then created fake users to cover it up. Curious if anyone has seen anything similar, even on a smaller scale. How do you currently test this before going live? submitted by /u/Alternative-Tip6571 [link] [comments]

I built an interactive Web Dev course for Claude Code (100% free)

If pure vibe coding leaves you feeling stuck, this is for you: https://OpenVibe.sh I see a lot of people getting frustrated with platforms like Lovable, Replit, etc., and it's because they don't yet understand the fundamentals of web dev. So I thought, why not build a course that the agent leads you through so that you learn to build real web apps with AI locally, using something like claude code (or codex, cursor, etc). The goal isn't to just learn prompting or to do 100% pure vibe coding, nor is it to learn to code in the traditional sense. It's to get learn the fundamentals through building, while also having an ever-patient, all-knowing tutor at your side. You are free to ask the agent whatever you want and take the course in whatever direction you want, and then return to the course structure whenever you see fit. To build the course, I'm leaning on my experience creating Open SaaS (the top open-source SaaS boilerplate template with 13k+ github stars), and the ultimate end goal of the course is to learn how to build your own SaaS (if you want). Right now its just the setup and first lesson, but I'll be adding the next lesson ASAP. Just go to this website, copy and paste the provided prompt into Claude Code (or any other coding agent) and start learning! submitted by /u/hottown [link] [comments]

Last Call: Perplexity, Replit, & GitHub— The AI Student Discounts You're Cheerfully Paying the Tourist Price For

If you got a student edu email, these official promos will expire soon. submitted by /u/Mstep85 [link] [comments]