Grace Frank

Software Engineer → AI Agent Developer 🤖
Helping businesses automate, scale & sleep better 😴

[Grace Frank @frankgracy]

ChatGPT, Claude, Gemini, Grok, Perplexity, Emergent, Higgsfield, Canva, Sider, Apple Intelligence. Full tier list is in the video.

[Grace Frank @frankgracy]

I ranked the AI tools everyone's using by how good they actually are. Where does your favorite land?

[Grace Frank @frankgracy]

1. Edit video with Remotion or Hyperframes.
2. Generate images with Nano Banana or ChatGPT's image tool.
3. Run your socials with Blotato.
4. Build slides with Canva.
5. Find leads with Apify, scraping Instagram and Google Maps into a clean outreach list.

Claude Code can basically become your employee. Reply AI and I'll show you how to set it up.

[Grace Frank @frankgracy]

5 things you didn't know you could do with Claude Code.

[Grace Frank @frankgracy]

This is probably going to piss some people off.

AI is here to stay. You can spend your energy hating your employer for making you use it, hating everyone else who's using it, or you can learn it and cut hours off the work you already do.

Instead of hating it, embrace it.

[Grace Frank @frankgracy]

There's a hidden OpenAI tool that gives you way more control over image generation than ChatGPT.

Set exact image size. Control quality. Generate up to 10 at once. Attach reference files. Transparent backgrounds.

Most people never leave the ChatGPT window. Did you know this existed?

[Grace Frank @frankgracy]

You barely need to write code to ship an app anymore.

11 vibe coding tools doing the heavy lifting right now: v0, Lovable, https://t.co/uOqmacVwrb, Cursor, Claude Code, Codex, Replit, Google AI Studio, Emergent, Base44.

Which one are you using?

[Grace Frank @frankgracy]

A client told me she's scared of AI. It can clone your face, your voice, make you say things you never said.

Here's what I told her. Every technology ever built gets used for good and for bad. Cars helped us move faster, then some robbed banks with them. The internet connected the world, then some used it for fraud.

AI is no different. That's not new. That's just how technology works.

[Grace Frank @frankgracy]

Be honest. Do you actually hate AI, or are you just scared of it?

Because those are two very different things, and most people never stop to tell them apart.

[Grace Frank @frankgracy]

@scalar__ai nice

[Grace Frank @frankgracy]

a guy was testing apps built on Lovable, and he changed one thing. he got back the data of every user on that app.

so he ran a script on 1,645 Lovable apps. 170 had the exact same problem.

the app looks fine. the demo works great. but they skipped one critical thing: row level security.

without it, anybody can query anything inside your app. they may not even need to log in to pull people's emails, names, phone numbers, even API keys.

if you built with AI coding platforms like Lovable, this might be happening in your app right now. AI is built for speed. it's not thinking about what happens when someone removes the login and tries to get in.

[Grace Frank @frankgracy]

do not let AI build your login system.

login is one of the most important security features in any app, and it's where most AI built apps quietly break.

AI will write a login that works when you test it. but what about when someone tries 50 passwords in a row? or when the session expires? or when the same email tries to sign up twice? those small edge cases are where the security loopholes live.

and sometimes the person breaking in does not even need to be a hacker.

use battle tested providers instead. Supabase, Clerk, Auth0. they all have free plans. there's no excuse to reinvent this with AI.

[Grace Frank @frankgracy]

I have abandoned antigravity, back to VS code you can't be forcing me to use gemi ai

[Grace Frank @frankgracy]

@adensdk what is your data deletion policy?

[Grace Frank @frankgracy]

@OptiRefine Exactly. And if a secret is committed even if it’s moved to an env it needs to be changed

[Grace Frank @frankgracy]

Your app works. That doesn't mean it's safe.

45% of AI generated code ships with at least one security vulnerability. Here are the 10 things I check before any vibe coded app goes live.

[Grace Frank @frankgracy]

6. Validation: validate on the server, not the form.
7. SQL and XSS: old attacks, still work.
8. Prompt injection: user input is not instructions.
9. Monitoring: Sentry, day one.
10. Rate limiting: one script can cost you thousands.

Ship fast. Ship safe. They're not opposites.

[Grace Frank @frankgracy]

1. Auth: don't let AI write your login. Use Supabase, Clerk, Auth0, or Better Auth.
2. RLS: lock your database.
3. Secrets: .env files, never commit them.
4. Headers: CSP, X-Frame, HSTS, X-Content-Type.
5. CORS: lock to your domain only.

[Grace Frank @frankgracy]

if your app is using Supabase as its database, it's possible that your database is public right now and anybody can pull your users' information.

here's the thing. when you build with Supabase they give you a key you put in your front end so your app can pull data. but that same key means anybody can pull data too.

that's what row level security is for. you use RLS to create restrictions around what people can access inside your database. you create policies like only people who are logged in can access this. people can only access their own information.

if you're vibe coding your app, this is the kind of thing that gets missed.

[Grace Frank @frankgracy]

3 security checks every vibe coder needs before shipping.

[Grace Frank @frankgracy]

AI can build your app in 10 minutes. And get you hacked in 10 seconds.