Cursor

Swipe sideways

1. Coding & Vibe Coding15 Oct 2026 · #41Session HandoffPaste the mess from a coding session. Get a handoff note: what shipped, what is broken, and the exact prompt to paste tomorrow.InBranch: feat/billing-ui→OutTomorrow's first promptEasy

   Preview this drop

   1. 0:00 The swampBranch feat/billing-ui. Auth works. Billing page half done. Stripe webhook returns 400. Receipt email never fires.
   2. 0:08 What actually shippedLogin on staging, pricing table render, stripe package installed. Plan change is still a stub. PayPal left alone on purpose.
   3. 0:16 What is brokenWebhook 400, missing signature check, BillingForm customerId null, receipt email not wired. Ranked by what blocks the rest.
   4. 0:24 Tomorrow's first promptA paste-ready prompt that starts at the webhook 400, forbids touching PayPal, and asks for a signature check plus a failing test.

   No daily video for this drop yet. The in and out lines above are the preview.

2. Coding & Vibe Coding11 Oct 2026 · #37Vibe-code Security CheckerA review prompt for vibe-coded diffs. It hunts secrets, missing auth, injection, and insecure defaults, then names the fix.InStack: Next.js route handler, TypeScript, Postgres via a query string.→OutWhat it will not doMedium

   Preview this drop

   1. 0:00 The diff that 'works'A Next.js DELETE handler reads an id from JSON, concatenates it into SQL, and returns a live-looking secret key in the response.
   2. 0:08 What it should catchA secret in source. SQL built with string concatenation. No check that this caller owns the note. The key echoed back to the client.
   3. 0:16 Severity, then the fixHigh: move the key to an environment variable and rotate it. High: parameterize the query. High: derive the user from the session and filter the delete by owner.
   4. 0:24 What it will not doIt will not hand you a working exploit. The sample key is fake. The output is the safer handler, not a payload.

   No daily video for this drop yet. The in and out lines above are the preview.