Skip to content
One Agent a DayIn → agent → out
MenuClose

Build

Coding & Vibe Coding

Risk reviews, test plans, and env audits for diffs an AI just wrote. Paste them into Cursor or Claude.

How Coding & Vibe Coding agents work

Vibe coding gets a feature onto the screen before you have a theory of the change. The model writes the route, the component, and the migration, and you are left holding a diff that looks finished. This shelf is the pause before you push. It is for people who already have Cursor, Claude, or ChatGPT open next to a branch, and who want a second pass that talks about behavior instead of vibes.

The agents here take a real artifact from the session: a unified diff, the prompt you used to generate the feature, or a .env.example beside the code that reads it. A risk review names the behavior that changed and the check that would catch a regression. A test plan lists the cases the original prompt forgot, including the empty state and the person who is not the author. An environment audit compares the keys the code expects with the keys the example file admits, and it flags names that look like live secrets.

None of these agents replace a reviewer who knows the system, and none of them teach you how to attack someone else's. The security checker on this shelf refuses exploit steps on purpose. Paste the smallest input that still shows the behavior. If the model invents a line that was not in your diff, tell it to quote the hunk or drop the finding.

Swipe sideways

  1. Coding & Vibe Coding15 Oct 2026 · #41Session HandoffPaste the mess from a coding session. Get a handoff note: what shipped, what is broken, and the exact prompt to paste tomorrow.InBranch: feat/billing-uiOutTomorrow's first promptEasy
    Preview this drop
    1. 0:00 The swampBranch feat/billing-ui. Auth works. Billing page half done. Stripe webhook returns 400. Receipt email never fires.
    2. 0:08 What actually shippedLogin on staging, pricing table render, stripe package installed. Plan change is still a stub. PayPal left alone on purpose.
    3. 0:16 What is brokenWebhook 400, missing signature check, BillingForm customerId null, receipt email not wired. Ranked by what blocks the rest.
    4. 0:24 Tomorrow's first promptA paste-ready prompt that starts at the webhook 400, forbids touching PayPal, and asks for a signature check plus a failing test.

    No daily video for this drop yet. The in and out lines above are the preview.

  2. Coding & Vibe Coding11 Oct 2026 · #37Vibe-code Security CheckerA review prompt for vibe-coded diffs. It hunts secrets, missing auth, injection, and insecure defaults, then names the fix.InStack: Next.js route handler, TypeScript, Postgres via a query string.OutWhat it will not doMedium
    Preview this drop
    1. 0:00 The diff that 'works'A Next.js DELETE handler reads an id from JSON, concatenates it into SQL, and returns a live-looking secret key in the response.
    2. 0:08 What it should catchA secret in source. SQL built with string concatenation. No check that this caller owns the note. The key echoed back to the client.
    3. 0:16 Severity, then the fixHigh: move the key to an environment variable and rotate it. High: parameterize the query. High: derive the user from the session and filter the delete by owner.
    4. 0:24 What it will not doIt will not hand you a working exploit. The sample key is fake. The output is the safer handler, not a payload.

    No daily video for this drop yet. The in and out lines above are the preview.

  3. Coding & Vibe Coding29 Sep 2026 · #25Env Var AuditorPaste .env.example and the code that reads it. Get missing keys, unused keys, and names that look like live secrets.In.env.exampleOutThe fixMedium
    Preview this drop
    1. 0:00 The driftPORT and DATABASE_URL are read. DATABASE_URL is required. FLY_REGION is read and missing from the example.
    2. 0:08 UnusedNothing in the example is unread. FLY_REGION is the gap, the other way.
    3. 0:16 The live-looking valueSTRIPE_SECRET_KEY's example starts with sk_live_. That prefix does not belong in an example even if they say it is fake.
    4. 0:24 The fixAdd FLY_REGION=local. Change the Stripe example to a sk_test_ placeholder. Do not print a real key.

    No daily video for this drop yet. The in and out lines above are the preview.

  4. Coding & Vibe Coding17 Sep 2026 · #13Test Plan from the PromptPaste the prompt you used to vibe-code a feature. Get the checks to run before merge, including the case that prompt forgot.InPrompt I gave Cursor:OutLaterMedium
    Preview this drop
    1. 0:00 The original promptA refund button for paid orders under 7 days, a POST, and a success toast. No failure, no double click, no permissions.
    2. 0:08 The forgotten casesA 500 from the API, a second click, an order already refunded, and a viewer who is not allowed to refund.
    3. 0:16 Before mergeThree checks: the happy path you asked for, the failed POST does not say Refunded, and a double click does not send two POSTs.
    4. 0:24 LaterThe 7-day boundary and the hidden button are listed as follow-ups, not pretended to be done.

    No daily video for this drop yet. The in and out lines above are the preview.

  5. Coding & Vibe Coding5 Sep 2026 · #01Diff Risk ReviewerRead a vibe-coded diff for behavior risk: what changed, what can break, and which check to run before you push.Indiff --git a/app/api/orders/route.ts b/app/api/orders/route.tsOutThe checkMedium
    Preview this drop
    1. 0:00 The intended changeOne sentence: checkout should trust the price the server already computed.
    2. 0:08 The hunk that movedThe reducer that summed item.price * qty is gone. total now comes from body.total.
    3. 0:16 The riskA client can post any total, including zero or a negative, and the route marks the order paid.
    4. 0:24 The checkSend the old cart fixture and assert the stored total matches the server sum, not the body.

    No daily video for this drop yet. The in and out lines above are the preview.

Questions about Coding & Vibe Coding

What does vibe coding mean on this shelf?

Steering a model in Cursor, Claude, or ChatGPT until a feature exists, then reviewing the result before you ship it. The agents assume you are the author of the change.

Will an agent patch the repository for me?

No. It names the risk, the missing test, or the safer shape of a line you already wrote. You apply the change in your editor and run the check yourself.

How is this different from a penetration test?

It is a first pass on your own diff. It is not a pentest, a dependency audit, or permission to probe a system you do not own. Findings that need an exploit stay as impact, not as steps.

Tomorrow's drop

Get the daily agent

One email when the drop goes up. The same list as the signup on the page.