r/AskVibecoders

Introducing LeakScope, again.

we've been updating it : )

LeakScope is a security scanner built for Supabase applications. Paste your app's public URL, and it checks what an attacker can learn from the outside—from exposed keys and public data access to weak RLS, leaked credentials, and insecure frontend configuration.

We've introduced two scanning modes:

Light Scan — Paste a public app URL to instantly check for exposed keys, public data exposure, leaked credentials, weak RLS, and risky frontend configuration. No account required.

Deep Scan — Authenticate to validate Row Level Security, test BOLA/IDOR, analyze JWT security, and generate detailed reports for real security validation.

Whether you're a solo founder, indie hacker, or vibe coder shipping MVPs at 2 AM, LeakScope gives you a fast way to see what your app is exposing before everyone else does.

1,936 websites scanned.
13,679 security findings identified.

Try it out at leakscope[.]tech

r/StableDiffusion, r/comfyui, r/Cursor, r/SideProject

TL;DR: Paid Cursor workspace + Python pipeline for character libraries. One identity file, each new pose chains from the last registered image, outfits dress the reference instead of redrawing. Includes 7 characters with real PNGs. No cloud API — GenerateImage runs in your Cursor subscription.

---

I kept running into the same problem:

• New prompt → new face
• New pose → outfit breaks
• New angle → accessories vanish

So I stopped treating every generation as a fresh character and built a character library workflow instead.

What it actually does

AI Character Production System — create one character once, reuse it forever. http://mskt.gumroad.com/l/jygfmp

Not another image generator. A repo you open in Cursor:

• One identity file (SSOT) — species, materials, proportions locked in YAML
• Pose chaining — each new pose builds from the last registered active.png
• Outfits — dress the reference, don't redraw from scratch
• One change per generation — pose or outfit or angle, not all three at once

Outputs are yours to take anywhere:

• YAML prompts → paste into Midjourney, ComfyUI, Flux, etc.
• active.png per pose → img2img, video, your own app
• Pick front / side / full body so accessories stay coherent

What's in the bundle

Piece	Detail
Cursor workspace	Slash commands: /new-character, /add-new-pose-hamster, /character-pose-grid, …
Docs + agent rules	Step-by-step workflows, not vibes
Python pipeline	Register, lint, 59 tests — scripts never call a model API
Image gen	GenerateImage in Cursor — your subscription

7 ready-made characters (real YAML + PNGs, not empty scaffolds):

• hamster — 15 images (richest example: poses + outfits)
• stork — 10 (costumes)
• frog, lion, tiger, tanned_girl — 9–13 each
• scooter — 3 (minimal bootstrap)

Totals: 7 characters · 55 pose prompts · 69 canonical PNGs · 92 saved generations · 11 pose grids

What it's not

No kitchen scenes, full compose pipeline, cloud hosting, or unlimited auto-gen. Character libraries only — by design.

Day one in Cursor

Paste this after opening the folder:

> Get familiar with this project. Read README.md and AGENT_START_HERE.md, then start creating new characters or experiment with the existing ones.

Disclosure

This is a paid bundle I'm selling (Gumroad / store link in comments). I'm sharing because character consistency comes up constantly in these subs and I wanted to show the approach, not drop a link with zero context.

Happy to answer workflow questions in comments — even if you never buy it. What do you use today for keeping characters consistent across poses?

Hey i finally tried liquid glass , so for now i applied it only on my navbar , so can ya review it and tell me if i should apply that to the rest of my website

https://trendingtopics.space

I see the same story in this sub every week. Someone spends six months building, ships, posts a launch thread, gets forty visitors, and concludes the product is bad. The product is usually fine. What is missing is distribution, and most of us treat it as an afterthought because building feels productive and marketing feels like shouting into the void.

Here is the mental shift that changed things for me: marketing is not a launch event, it is a daily habit that starts before the product is done. If you only remember one thing from this post, make it this. One piece of content per day, on one channel, for ninety days, before you judge anything. Not five channels. One. The founders you see everywhere are not everywhere, they are consistent in one place and it creates the illusion of omnipresence.

Choosing the channel matters less than people think, but the logic is simple. If your users are developers, write where developers read, meaning here or on Hacker News or in dev newsletters. If your users are normal humans, businesses, creators or shoppers, short form platforms are the cheapest attention available right now, and you do not need to show your face. Slideshows, screenshots with text on them and screen recordings all work fine faceless.

On the content itself, the mistake I made for months was talking about my product. Nobody cares about your product, people care about their problem. Every piece of content should name a specific pain your user recognizes, in their words, before your product is ever mentioned. "Your churn emails are ignored because they all say the same thing" will always outperform "check out my retention tool". A useful exercise is to write down twenty complaints your target user would say out loud, then turn each one into a piece of content. That is your first month done.

The last piece is expectation management. Weeks one to three will feel like posting into a void, and this is where almost everyone quits. Algorithms need time to figure out who your content is for. My own curve looked exactly like that: a first month where total views barely reached triple digits, a second month of slow movement, and then a sudden spike that came out of nowhere. The curve is not linear, it is flat and then it jumps, and you have to survive the flat part.

For transparency, I am the founder of Cinerads, which automates the short form part of this system by turning a product URL into daily TikTok slideshows. I built it because I could not sustain the daily habit manually. If you want to try it, comment and I will DM you a discount code, but honestly the system above works whether you automate it or grind it out by hand. What I would love from this thread is to hear which channel finally worked for you, because the ninety day rule applies everywhere but the right channel differs by product.

Just launched the first version of a vibe-coded travel site for curated trips to Turkey:[https://letsgotürkiye.com/\](https://letsgotürkiye.com/)

Looking for brutal feedback on what to fix, what to polish, and any creative ways I can use AI/Claude to push the interactive design further. Let me know what you think!

Hey everyone, I'm a solo indie dev and I've spent the better part of this

year building The Termi Protocol, a cozy 3D room your CLI coding agents live

and work in. I'd love your honest take on it.

Instead of watching Claude Code or Codex scroll by as text in a black

terminal tab, each agent gets a little robot with its own desk, and the room

mirrors what it's really doing, live. It sits somewhere between a dev tool

and Animal Crossing. What it does:

The mirror: nothing is a canned animation. When an agent reads a file, its

robot walks to the filing cabinet and digs through it. When it writes

app.tsx, the code streams onto its little monitor while the robot types.

npm install makes digit rain fall into a book. All of it is driven by the

agent's real activity.

Terminal: every robot's screen is a real shell. Click in and type whenever

you want to take over, and if you close the app, Claude agents resume their

exact conversation when you come back.

Messages: talk to the agent, paste screenshots, drag files in straight from

the file tree.

Tasks: a live todo board the agent maintains itself, marking work done, in

progress or up next. You can add or remove tasks while it works. Run several

agents and sync mode gives them one shared board with file locks, so two

robots never edit the same file at once. A graph view shows what they tell

each other.

Memory: everything an agent remembers, searchable, plain or semantic, with

receipts. Which file it grabbed and why, which websites it visited while

building, and which script that research ended up in.

Checkpoints: every agent snapshots its work, so when one goes off the rails

you diff and roll back. Git worktree isolation is handled here too.

Git tree: hit analyze and a small local model explains the diff between two

versions, so comparing scripts costs no tokens.

Activity and status: tokens burned and cost per agent, plus how much of your

5 hour and weekly limits are left. Checking it doesn't spend anything.

Skills: attach a skill to a specific agent with one click. It focuses the

agent and visibly cuts token cost.

Approvals: when an agent needs a yes or no, it doesn't blink in a tab you

forgot about. A card pops up over its desk with allow and deny, and you get

a native notification if you're in another app.

Code: a built in editor for when you'd rather type it yourself. Your manual

edits land right next to the agent's.

The room: this is the cozy part. Pick a palette, drag furniture in from a

catalog, adopt a pet you have to feed, throw a stress ball that really

bounces off the furniture. Sticky notes, a whiteboard you can draw on, a

pomodoro timer, a day and night cycle with occasional rain. Every project

gets its own room, and the room grows as you add agents.

The point is that your work stays on your Mac. Agents run in real local

shells under your own accounts, and their memory, boards and checkpoints are

plain files in a local folder. The semantic search and the diff analysis run

small local models. The only network traffic is your agents talking to their

own models.

Full honesty for this sub: it's Electron, because the whole app is a live

Three.js scene. It actually started as a web app, then Claude Code itself

suggested the desktop port and wrote most of it, over 90% of this project is

Claude's code on Opus 4.8. macOS first, a Windows build exists too. The app

is paid, you bring your own coding agent and your existing AI subscription,

it never resells tokens.

It's early and moving fast, updates land often and some things will break

along the way. Honest feedback is exactly what helps me fix and prioritize.

Download: https://termiprotocol.com

vibe coded 7 apps and launched 3 using claude code.

one of them is called hailee. a simple gamified imessage-like chat with 1 AI girl called “hailee.”

as you chat more your conversation can level up, and she starts sending more *photos/calls.
*now using grok for text/audio call.

i thought it died, but lately it started growing on its own so decided to double town and focus on growing it.

very early on, but designed and built using claude end to end. AMA

i run an agent that reads x every day, filters out the noise, and sends me a summary on imessage, it's a cron job, a database, and a model call running in a loop.

you can run the Agent on your own on a VPS or a already hosted version on your imessage, telegram.

Seven components

every personal agent, openclaw, hermes, or something you build yourself, breaks into the same seven parts:

1. Gateway, one long-running process connected to every chat platform, functioning like a kernel.
2. Loop, the engine, every event, message or timer, runs through this:

​

while True:
    event   = wait_for_input()        # a message, a heartbeat, a webhook, a cron
    context = load_state(event)       # history + database + memory, built into a prompt
    reply   = model.call(context)     # one "thought"

    while reply.tool_calls:           # if it wants to act, let it — then think again
        results = run_tools(reply.tool_calls)   # shell, files, browser, web
        context.append(results)
        reply = model.call(context)

    persist(event, reply)             # write it down so a restart doesn't wipe it
    if reply.text:
        respond(event.channel, reply.text)
    # else: stay quiet. doing nothing is a real output.

1. Memory, state on disk, a transcript plus a searchable database.
2. Skills, reusable procedures in markdown, written by a person or, in hermes's case, by the agent itself.
3. Tools, shell, files, browser, web, where the agent gets useful and where it gets risky at the same time.
4. Heartbeat, a timer that injects a synthetic event into the loop, my x reader is a heartbeat and nothing else.
5. Model, the llm behind a swappable interface, cloud or local.

Two different Agent

openclaw runs hub-and-spoke, one gateway daemon coordinating fifteen-plus chat platforms, a skill marketplace called clawhub, and agents that can spawn other agents, the internal codename for the rewrite was "the agent os," and it's an accurate label, the bet is breadth.

hermes, from nous research, bets on depth instead, its loop solves a task, writes down what worked, retrieves it later, and refines from there, and when a task takes multiple steps or needs a correction, the agent writes its own skill file:

---
name: deploy-staging
triggers: ["deploy to staging"]
uses: 7
---
## Steps
1. Build the web app. If it fails, read the error, fix the import, retry once.
2. Run the tests. Only continue on green.
3. Deploy to staging. Post the URL to #eng.

its always-loaded memory has a hard character cap, forcing it to keep what matters and search the rest on demand instead of dumping full history into every prompt.

openclaw scales out across channels while hermes scales in on one private history, and both are closing the gap from opposite directions, openclaw is adding memory, hermes is adding integrations.

Security is the constraint

any personal agent sits at lethal trifecta, it can add untrusted input like emails or web pages and you get prompt injection, since models can't reliably separate data from instructions.

openclaw's early versions ran shell commands with no approval step at all, that fast, open growth meant a fast attack surface, real vulnerabilities, poisoned skills on clawhub, and researchers finding roughly a quarter of a million exposed openclaw instances sitting on the open internet.

hermes built the boundary in from the start instead, deny-by-default access plus a hardline blocklist that nothing can override

Run the Agent on VPS or use the hosted one they have tend to keep you secure as they are not running in your machine.

I got tired of watching Coding sessions re-read the same files over and over. A 2,000-token file read 5 times = 10,000 tokens gone. So I built sqz.

The key insight: most token waste isn't from verbose content - it's from repetition. sqz keeps a SHA-256 content cache. First read compresses normally. Every subsequent read of the same file returns a 13-token inline reference instead of the full content. The LLM still understands it.

Real numbers from my sessions:

Scenario	Savings	How
Repeated file reads (5x)	86%	Dedup cache: 13-token ref after first read
JSON API responses with nulls	7–56%	Strip nulls + TOON encoding (varies by null density)
Repeated log lines	58%	Condense stage collapses duplicates
Large JSON arrays	77%	Array sampling + collapse
Stack traces	0%	Intentional - error content is sacred

That last row is the whole philosophy. Aggressive compression can save more tokens on paper, but if it strips context from your error messages or drops lines from your diffs, the LLM gives you worse answers and you end up spending more tokens fixing the mistakes. sqz compresses what's safe to compress and leaves critical content untouched.

Works across 4 surfaces:

• Shell hook (auto-compresses CLI output)
• MCP server (compiled Rust, not Node)
• Browser extension - Firefox approved. Works on ChatGPT, Claude, Gemini, Grok, Perplexity, Github Copilot
• IDE plugins (JetBrains, VS Code)

Install:

cargo install sqz-cli
sqz init

Also available via npm (npm i -g sqz-cli) and pip (pip install sqz).

Track your savings:

sqz gain    # ASCII chart of daily token savings
sqz stats   # cumulative compression report

Single Rust binary. Zero telemetry. 1000+ tests including 57 property-based correctness proofs.

GitHub: https://github.com/ojuschugh1/sqz

Docs: https://ojuschugh1.github.io/sqz/

If you try it, a ⭐ helps with discoverability - and bug reports are welcome since this is v1.0.5 so rough edges exist.

Have anyone else facing this problem ? Happy to answer questions about the architecture or benchmarks.

I'm looking to sell Inspect Mode Pro, a Chrome extension built for developers, designers, and indie hackers who want to inspect websites more efficiently.

The product is fully functional and includes Polar payment integration, making it easy to manage one-time purchases, licenses, and customer access without additional setup.

What it does:

• Inspect fonts, colors, spacing, and UI elements
• Extract website assets and images
• Analyze website design systems
• Faster workflow than digging through DevTools for common tasks

What's included:

• Full source code
• Chrome Web Store listing
• Branding and assets
• Existing user base
• Documentation and deployment instructions

Why I'm selling:
I'm currently focused on other projects and don't have the time to continue growing and marketing this one.

Potential growth opportunities:

• SEO content around web design and development
• YouTube tutorials and demos
• Partnerships with design communities
• Expansion into Firefox and Edge extensions
• Additional premium features for agencies

If you're interested, send me a DM and I'll share details on users, revenue, traffic, tech stack, and asking price.

Happy to answer any questions.