• Claude Code - AI agent that works in your terminal • Supabase - open-source, database • Next.js - web framework everyone uses • Vercel - hosting • Stripe - payments • Canva - design things quickly, even with zero design skills • Dribbble/Mobbin - great places to find UI inspiration • Namecheap - buy and manage your domain • GitHub - save progress and roll back mistakes • ChatGPT - brainstorming, planning, and problem-solving
High-performance (24+ GB VRAM, preferably with multiple GPUs)
• Kimi K2 - 1T params, 32B active. MoE beast • GLM-4.7 (Z AI) - 30B-A3B MoE, SWE-bench 73.8% • DeepSeek V3.2 - 671B / 37B active. Still the open-source king • Qwen3 235B-A22B - insane quality/cost ratio if you have the iron
Mid-range (16-24 GB VRAM / RAM)
• Qwen3 30B-A3B - punches way above its weight, stable on long context • Gemma 3 27B - Google's best open release yet • Nemotron 3 Nano 30B - Math500: 91%. Best-in-class if you need math
Lightweight models (8-16 GB RAM, can run without a dedicated GPU)
• Qwen3 8B / 4B / 1.7B - the best small model family right now • Gemma 3 4B - surprisingly capable on CPU • Phi-4 (14B) - Microsoft doing a lot with a little
The local AI stack is genuinely catching up to the cloud
Skills needed to get hired as a $10k/mo AI engineer:
AI-specific skills:
> Prompt engineering > Multi-agent systems > MLOps / AI deployment in production > NLP / transformer models > LLM limitations: context window, latency/cost > Responsible AI / AI safety
> Strong communication (especially with non-technical stakeholders) > Problem-solving > Self-directed / autonomous work > Ability to explain complex things simply
90% of vibe-coded apps have at least one critical vulnerability
15 security rules every vibe coder needs before shipping:
1. Never build authentication with AI alone use proven auth providers 2. Keep every secret in environment variables, never inside your code 3. Set session expiration so stolen tokens cannot live forever 4. Verify every package AI suggests before installing it 5. Sanitize all user inputs before they touch your database 6. Add rate limits to your APIs to stop bots and abuse 7. Always enforce permissions on the server, never trust the frontend 8. Make storage private by default so users only access their own files 9. Restrict CORS to your real domains instead of allowing everything 10. Remove debug logs before deploying to production 11. Validate redirect URLs so attackers cannot hijack them 12. Set spending limits on AI APIs to avoid runaway costs 13. Verify webhook signatures before processing external events 14. Log critical actions like payments, role changes, and deletions 15. Keep test and production environments completely separate