A founder scanned nearly two thousand vibecoded apps and found one in four on Vercel had API keys hardcoded in the frontend. The Supabase USING (true) policy that looks like security? It means “allow everyone.”
People are now hunting vibecoded apps to exploit and sue. The AI builds the feature but never builds the guard around it.
In today’s indie hacker news:
- 🔓 Vibecoded app security audit finds the same 5 holes everywhere
- 🎥 Gemini Omni Flash: argue with a video model mid-render
- 🧠 Solo dev trained an LLM from scratch on one GPU for $0
- 🧹 Clean code makes AI agents wander 34% less
- 🐬 Flipper Zero hit a million devices then stopped development
TOP STORIES
YOUR SUPABASE RLS IS LYING TO YOU
🔓 A scan of 1,764 vibecoded apps found 453 with critical holes wide open
The story: An r/SaaS founder who vibecoded their own SaaS discovered they could pull any user’s data from a logged-out browser. That IDOR bug led to audits across apps built on Cursor, Lovable, Bolt, Rork, and Claude. A separate scan of 1,764 apps by Stefan Lederer confirmed the pattern: 453 critical vulnerabilities, RLS misconfigurations dominating.
The details:
- The five recurring holes: IDOR, open RLS, client-side price enforcement, no rate limiting on paid endpoints, broken JWT auth
- 26.9% of Vercel AI apps had hardcoded API keys in the frontend. Lovable: 0% (server-side routing by default)
- 53% of developers who shipped AI-generated code later found security issues that passed review (SonarSource)
Why builders care: The author’s 10-minute self-audit is worth doing today: change a URL ID to one that’s not yours, check your RLS policies for USING (true), and watch your checkout network tab for client-sent prices. One unprotected AI endpoint can run up a catastrophic bill in a single weekend.
Clone your voice once. Ship every video without re-recording. ElevenLabs Pro trains a voice clone in 30 minutes that sounds like you on every long-form, Short, and podcast you ship. We narrate every video on this newsletter with it. Beats hiring a VO artist on Fiverr or settling for a default TTS bot.
We get a cut if you sign up. Only added for tools we use ourselves.
GOOGLE’S VIDEO MODEL TALKS BACK
🎥 Gemini Omni Flash lets you argue with a video clip mid-render for $0.10/sec
The story: Google shipped Gemini Omni Flash, the first video-generation model with a conversational editing loop. Generate a clip at 720p (3-10 seconds), then refine it through natural language (“Make the sky darker,” “Add snowfall”) via the Interactions API, capped at 3 edit rounds per session. Pricing matches Veo 3.1 Fast at $0.10/sec but adds the editing layer on top.
The details:
- ComfyUI shipped custom nodes on July 3, enabling text-to-video and image-to-video workflows without code. The demo tweet hit 82K views
- WPP integrated it for ad asset localization. Adobe has planned Firefly integration
- Ceiling: 720p only (no 4K), max 10 seconds, no audio reference uploads, character consistency degrades on complex motion
Why builders care: The conversational editing API is the real differentiator over Sora and Kling. Builders shipping high-volume short clips (product demos, social content, e-commerce videos) can iterate without regenerating from scratch. The duration ceiling keeps it practical for short-form automation, not cinematic work.
ZERO DOLLAR LLM
🧠 Solo dev trained a 270M-parameter LLM from scratch on one A100 in 24 hours
The story: Independent researcher Pranav Upadhyaya built a decoder-only Transformer using RoPE, GQA, SwiGLU, and Flash Attention. He trained it in two stages: Wikipedia for pretraining, then Alpaca for instruction following. Hardware: one A100 80GB via Google Colab Pro+. Time: 24+ hours. Cost: effectively $0 beyond the subscription. The source code is a public Colab notebook.
The details:
- Zero benchmarks published (MMLU, ARC, HellaSwag all TBD). Learning exercise, not a SOTA claim
- r/LocalLLaMA split between support and suspicion. Multiple commenters flagged the account as a potential bot
- Upadhyaya cited Andrej Karpathy as his primary resource and admitted early projects relied on vibecoded ML code before he learned the underlying attention mechanics
Why builders care: Two years ago, RoPE and GQA were frontier techniques. Today a solo dev implements them from a Colab notebook. The Open SLM Leaderboard tracks 31 organizations competing at this scale.
MESSY CODE MAKES AGENTS WANDER
🧹 Clean code cuts Claude Code’s token burn by 8% and slashes file backtracking by 34%
The story: SonarSource researchers ran 660 controlled trials across 6 paired repos, each matched on architecture but differing in static-analysis violations. Clean code didn’t change whether Claude Code solved the task (91.3% vs. 92.1%). It changed how much the agent wandered getting there.
The details:
- Input tokens fell 7.1%, output tokens 8.5% on clean repos
- File revisitations dropped by a third on average. On commons-bcel, the drop was 69%
- At ~4M tokens per SWE-bench task, a 7% reduction is 280K tokens saved per task
Why builders care: Run a linter before feeding your codebase to an agent. SonarSource sells code quality tools (obvious conflict), but the minimal-pair methodology is sound. Codebase quality is now an infrastructure cost.
MISSION ACCOMPLISHED, GOODBYE
🐬 Flipper Zero sold 1M devices then quietly stopped full-time development
The story: CEO Pavel Zhovner announced the end of full-time firmware development. The device hit a 700KB flash ceiling, delivered Firmware 1.0 in 2024, and the team is pivoting to Flipper One (Rockchip RK3576, 8GB RAM, under $350).
The details:
- Feature requests now go through GitHub Discussions only. Weekly review of top-voted requests
- 87 stale pull requests triggered the community backlash that prompted this post
- Alternative firmware forks (Momentum, Unleashed) already absorbing users who left after official firmware removed pentesting tools
Why builders care: When you declare “mission accomplished” on a product, your users may not agree. The governance model Flipper landed on (async GitHub voting, mandatory integration testing, weekly reviews) is a pattern any open-source project founder can study.
TRENDING TODAY
🤖 Claude Code tooling explosion - Four Show HN projects in one day: peek-cli (browser screenshots for Claude Code), Handoff (git-verified context bridge), Nomlings (virtual pet that eats your token burn), and Make No Mistakes (cryptographic verification harness). The middleware layer is building itself.
🧠 Mythos-class on consumer hardware within 2 years? - r/LocalLLaMA argues the closed-vs-open gap is smaller than benchmarks suggest because closed providers add RAG and hidden tool calls on top of inference. DeepSeek V4 Flash already runs 1M-token context on an RTX 5090 via llama.cpp.
📢 SaaS distribution playbooks - Three r/SaaS posts trending at once: 300+ SaaS directories, $20 Meta ads with full metrics, and one Reddit thread to 13 paying customers. The consensus: “Distribution before features.”
DRAMA
THE GREAT UNCENSORING
🔥 Why are more and more people switching to uncensored or local models?
r/artificial is debating the migration to uncensored and local models. Dolphin holds 5 of the top 10 Ollama uncensored slots by downloads. The camps: privacy (“I don’t want OpenAI reading my code”) vs. creative freedom (“Claude refuses to write my villain’s dialogue”). Whatever the motivation, the hardware curve is real: what took a datacenter GPU two years ago runs on a 5090 today.
FIRST DOLLAR
🌙 20 NIGHTS, ONE SUBSCRIBER IN INDONESIA
💰 After 20 nights and weekends, someone in Indonesia paid for ManifestDaily
A full-stack dev built ManifestDaily (iOS affirmations app with focus timer and home-screen widgets) around a day job. First paying customer: an annual subscription from Indonesia, confirmed in RevenueCat. A commenter corroborated: “Mine was Vietnam at 3 AM.”
STACK OF THE DAY
🔍 Peek-CLI
WebSocket-based browser screenshot relay for Claude Code. Install via npm, point it at your browser, and Claude Code can see what’s on screen without manual screenshots. MIT license, free, 38 GitHub stars and climbing. Useful if you’re debugging front-end issues and want the agent to see the rendered page, not just the source.
Not sponsored. We just feature tools builders would actually use.
BOOKMARKED TODAY
📖 Introduction to Compilers and Language Design - Free textbook resurfacing on HN (284 points). Lexing, parsing, type checking, code generation. Worth bookmarking for a weekend project.
🤖 AGENTS.md vs CLAUDE.md vs Copilot instructions - Side-by-side comparison of AI coding agent config files. Which instructions each agent reads, where to put them.
📊 Why 35% of enterprises are replacing SaaS with custom software - The AI-makes-building-cheaper thesis hits enterprise procurement. Worth reading if you sell to larger companies.
Ship to one country, QA it from another. Geo-fenced Stripe checkouts, region-gated APIs, feature flags that only fire in EU. NordVPN's 6,400+ exit nodes across 110+ countries let you test a US-only paywall from EU or hit a EU-only checkout from SF. Bonus: free Meshnet for SSH across your devices.
We get a cut if you sign up. Only added for tools we use ourselves.
Curated by AI, built by a human.