Category · 84 posts
Vibe coding works great until you try to ship to production. Then the security holes, the missing auth, the database that doesn't scale, the AI hallucinating critical business logic — it all comes due at once.
This cluster is the honest version of what vibe coding actually delivers in 2026. Hands-on reviews of every major tool (Cursor, Claude Code, Bolt, Lovable, Replit, base44, Windsurf, Codex). Comparisons that name the trade-offs. And rescue case studies from real client work — what breaks, how to fix it, when to keep the AI code vs. start over.
Quick Answer
Curated by Justin McKelvey · 84 posts in this cluster · Updated November 2026
9 tells that a codebase was written by AI — from someone who rescues AI-built apps for a living. Why detector tools fail on code, what actually matters, and the exact order to fix things in.
Seven AI coding agents are worth using in 2026 — Claude Code, OpenAI Codex, Cursor, Windsurf, Bolt, Lovable, and Replit Agent — plus the question the tool lists skip: which AI model is actually best for vibe coding, and what it costs per month.
Cursor vs Claude Code vs Codex in June 2026: honest pricing, where each wins and loses, and the 2-of-3 stack pro developers actually run. From a fractional CTO who bills with them daily.
Anthropic's own free courses teach Claude Code in about 5 hours and 15 minutes across five of them. The courses are free, the tool isn't: you need Claude Pro or higher. Here's the order to take them in, the week of real work that goes in the middle, and the tutorial advice Anthropic now says to stop following.
Prompt injection is when text your AI feature reads carries instructions the model follows instead of yours. OWASP ranks it the #1 risk for AI apps, and there's no full fix. Here's what it looks like in a founder's app, three real cases, and the fixes that limit the damage.
Supabase the platform is secure: SOC 2 Type 2, encrypted data, regular pen tests. Your app on Supabase is only as secure as its Row Level Security rules, and those are yours to set. Here's what Supabase covers, what you own, how RLS works in plain English, and a 5-minute check for a Lovable or Bolt app.
The anon key (now called the publishable key) is meant to sit in your frontend. The service role key (now the secret key) bypasses every security rule in your database and must never leave your server. Here's the old-name to new-name map, where to find each one, and what to do if the wrong one leaked.
Auditing a vibe-coded app costs $0 to about $1,500. A pen test adds roughly $3,000 to $6,000. Fixing what the audit finds is the real bill: $15K to $50K for most rescues. Published prices for every tier, what each one actually catches, and which one you need.
Lovable the company is SOC 2 Type 2 and scans every app you publish. Your app's data rules are still your job, and a November 2026 study found 7,403 Lovable sites handing out records with email addresses to anyone. What Lovable covers, what you own, whether it holds up as users grow, and a 10-minute check.
Twelve scanners for apps built on Lovable, Bolt, Replit or Cursor, with what each one actually catches and what it costs today. Six cost $0 for a two-person team, and two more come with tools you already pay for. None of them catches the bug that leaks the most data.
Vercel Pro is $20 a month with one developer seat and $20 of usage credit, then $20 per extra developer. CDN is now a flat tier at $0, $20, $100 or $300 a month. Here's what real teams pay, and why the spend limit won't protect you by default.
GitHub Copilot is free to start, then $10 a month for Pro, $39 for Pro+ and $100 for the new Max plan; Business is $19 a seat and Enterprise $39. Since June 2026 every plan is metered in GitHub AI Credits at a cent each, and the individual plans now include more credits than they cost. What each plan buys, what uses credits and what does not, and which plan a solo developer or a small team should pick, from GitHub's own pages as of October 2026.
Cursor's pricing page sells Pro at $20, Pro+ at $60 and Ultra at $200, and describes what you get on each as "extended", "3x Pro" and "20x Pro" agent limits. It never says what Pro's limit is. Here is what is actually published as of September 2026, the one piece of arithmetic those multipliers do allow, and why Pro+ is the tier that buys you nothing per dollar.
A Base44 tutorial from someone who maintains 8+ Base44 apps: build a job tracker with a form, a table, and a status filter in ten prompts, add login and permissions, import your real data, and publish it, on the free plan's 25 credits. The exact prompt at each step, the four places builds go wrong, and the point where you stop and rebuild properly.
Emergent has a free plan, and it is exactly as free as ten credits a month. Read from emergent.sh/pricing on September 15, 2026: Free is $0 with 10 monthly credits, Standard is $20 a month ($17 annual) for 100 credits and private hosting, Pro is $200 ($167 annual) for 750 credits, Enterprise is custom. Here is what ten credits buys on an agent that plans, codes, and deploys a whole app, the moment you have to pay, how it lines up against Lovable's and Base44's free tiers, and the cost every free plan leaves off the page.
AI Automation
4 posts
AI Design Tools
6 posts
AI Visibility
16 posts
AI for Business
256 posts
AI for Founders
3 posts
Business Growth
4 posts
Founder Sales
2 posts
Fractional CTO
15 posts
Fractional Product
1 posts
Go-to-Market Strategy
3 posts
Lean Software
2 posts
Pricing Strategy
2 posts
Product Leadership
6 posts
Book a free 15-min strategy call. Specific recommendation, no pitch.
Book a Call