For people who build software by talking to AI — how the machine thinks, what's really running your app, and how not to get burned · page 3
It was snappy with ten rows and crawls with ten thousand. Almost always it's one of three things — a missing index, fetching everything then filtering in the browser, or no caching — and none needs you to read code.
Aliteq Team · Sep 26 · 6 min
It's not a bug — it's your database refusing to let the wrong person write a row. Why the error shows up the moment security is on, and the right way to fix it (never "disable RLS").
Aliteq Team · Sep 26 · 6 min
Before you share a Replit app, six things to check so strangers can't read each other's data or run up your bill — including the one backup check behind Replit's most infamous 2025 data-loss story.
Aliteq Team · Sep 26 · 7 min
v0 turns a prompt into a real Next.js app on Vercel — but who's allowed to see your data is a setting you have to confirm. Six things to check before you ship, starting with the one Next.js setting that quietly puts keys in the browser.
Aliteq Team · Sep 26 · 7 min
Cursor works in the project you bring, and what that project connects to is your call — so every security check is yours. Six things to confirm before you ship, and the one (reading the code) that matters most.
Aliteq Team · Sep 26 · 7 min
Bolt built it and its scan catches two of the big risks — but four checks are still yours before you share the link, so nobody can read each other's data or run up your AI bill.
Aliteq Team · Sep 26 · 7 min
You built it by describing it to Lovable — now, before you share the link, six things to check so strangers can't read each other's data or run up your bill. Lovable helps with some; these are the rest.
Aliteq Team · Sep 26 · 7 min
Ninety percent of "it's tiny on mobile" is one missing tag. Here's "make this page work on phones" three ways, with the real code — from a lonely media query to a proper mobile-first layout.
Aliteq Team · Sep 26 · 6 min
A naive "send a daily email" loop fires at the wrong time, breaks on one bad address, and can email someone a hundred times. Here's the request three ways, with the real code, and the guards that keep you off spam lists.
Aliteq Team · Sep 26 · 6 min
Row Level Security is deny-by-default, so the danger isn't forgetting to lock a table — it's a lazy policy that quietly unlocks all of them. Here's the request three ways, with the real SQL each produced.
Aliteq Team · Sep 26 · 6 min
The naive way to vibe-code a Stripe button puts your secret key in every visitor's browser. Here's the same request three ways, with the real code — and the one rule that separates a demo from a safe checkout.
Aliteq Team · Sep 26 · 6 min
Every vibe coder types "add login with Supabase" and gets working code. Here's what changes when you ask for it vaguely, specifically, and with the guardrails spelled out — with the real code each version produced.
Aliteq Team · Sep 26 · 6 min
The vibe-coder trap is fixing AI code until it's a knot. When a clean rewrite wins over another patch, shown with a real before-and-after and a simple rule for deciding.
Aliteq Team · Sep 26 · 5 min
Most AI tools let you pick a model, and the wrong pick burns time and money. When a fast, cheap model is plenty, and when a slow, thinking one earns its keep.
Aliteq Team · Sep 26 · 5 min
You don't need to write code to vibe code, but you do need to read it. Three things to look for in a diff — logged secrets, scope creep, silent data changes. Try reading one.
Aliteq Team · Sep 26 · 5 min
The habit that separates people who ship safe apps from people who ship bugs: generate, then ask the model to break what it just wrote. Shown with a real before-and-after.
Aliteq Team · Sep 26 · 5 min
The single biggest upgrade to vibe coding is treating a prompt as a spec. See the same request go vague → specific → constrained, with the real code each version produced. Try building one.
Aliteq Team · Sep 26 · 5 min
A rate limit caps how many requests someone can fire in a window, so bots, bugs and abuse can't swamp your app or your bill. Why every public endpoint needs one. Tap to watch it hold.
Aliteq Team · Sep 26 · 4 min