Vibe Coded This Week — Issue #1 (Beehiiv-ready, DRAFT for approval)

Subject line options

  1. Google Play now runs your vibe-coded apps
  2. You can mod Claude Code now (+ Epic vibe coded its launcher)
  3. Issue #1: the week vibe coding went mainstream

Preview text

Claude Code mods, Cursor on your phone, private AI-built Android apps, and one security habit to steal.

October 14, 2026 · ~5 min read

Hey, welcome to issue #1. Every week: what shipped for people who build with AI, what it means for you, and one habit that keeps your app from getting owned. Every item links to its source.

🛠 Tool drops

You can now "mod" Claude Code (Oct 1). Anthropic launched mods: small TypeScript functions that hook into Claude Code's events. A mod can rewrite a prompt, block or retry a tool call, approve or deny a permission request, redact secrets from tool output, or add UI. Mods ship inside plugins (install with /plugin) and work in the CLI and desktop app. The built-in /diff is now a mod you can turn off or replace. One catch: mods are not sandboxed and run with Claude Code's access to your machine, so only install them from sources you trust. → Anthropic announcement · The Lab Notes: shipped in v2.1.287 on Oct 1 Steal this: Anthropic's own example is a "production safeguard" mod that requires confirmation before any command touches production config. Ask Claude Code to write you one that guards .env.

Cursor agents, from your phone (Oct 6). You can now see and reply to the local agents running on your computer from the Cursor iOS app. It's on by default for everyone except Enterprise orgs: download the app, sign in, and your computers show up. → Cursor changelog

Cursor SDK gets steering (Oct 6). If you build your own agents on the Cursor SDK: run.steer() lets you inject a message into a running agent, background subagents now report results back to the parent, and custom tools can carry MCP hints like readOnlyHint and destructiveHint so the model can tell a lookup from a delete. → Summary of Cursor's posts (RSS.bz)

Origin's app marketplace (Oct 13). Origin, Cursor's code hosting, now integrates with 20+ apps for deploys, CI, code review, security and monitoring, from partners including Cloudflare, Linear, Sentry and Socket Security. The marketplace is now open to public submissions. → Cursor changelog · vibecoding.tech breakdown

📱 Vibe coding goes mainstream

Google Play will run your private, vibe-coded Android apps (Oct 13). Build an app in Google AI Studio and launch it on your own phone through Google Play with a normal Google account, no developer account needed. The apps stay private and don't show up in Play search. It's rolling out to users 18+ in the U.S. and select markets. Google says sharing with a small group of friends is coming, plus a path to publish publicly later. Ars Technica notes private apps aren't reviewed by Google. → Google blog · TechCrunch · Ars Technica Why it matters: "an app just for my kid's T-ball league" (TechCrunch's example) is now a realistic weekend project.

Epic "vibe coded" its new games launcher. 🎮 Epic released a preview of a rebuilt Epic Games Launcher that's faster, has a new look, and now supports Linux. Epic's post: "Programming is hard. So, instead of doing that, we vibe coded a new Epic Games Launcher." Epic's Martin Keely told The Verge agents wrote and reviewed much of the code, with the team supervising. Epic itself warns the preview "will have some bugs" and is light on features. Ars' testing found it reaches the store page a few seconds faster than Steam from a cold start. → The Verge · Ars Technica Lesson: even Epic ships AI-built code as a "preview" with a feedback form. Label your early versions honestly too.

🔒 Habit of the week: turn on RLS

If your app uses Supabase, open the Table Editor and check every table has Row Level Security enabled. Your anon key is in the browser by design. With RLS off, anyone holding it can read that table. Then ask your AI: "For every table, show me the RLS policies and explain who can read and write each row." Read the answer yourself.

📦 From us

Our first pack is live: Next.js + Supabase + Stripe SaaS Starter. It includes Cursor rules, AGENTS.md, CLAUDE.md, a step-by-step prompt playbook, and a security checklist, and comes with a beginner README. $19 → rulesdrop.com

Built something with AI? Hit reply with the link and the prompts you used, and you might be featured next week.

Know someone vibe coding? Forward this, or send them here: subscribe free.