Lee Hayward

./about Who's behind the builds

I'm a UK based vibe coder. AI drafts, I proof, I ship, and I hold code and copy to the same standard. I riff on domain ideas and build side projects like DomainRiff and LookMa from my own homelab.

./projects Featured builds

./stack How it gets built

./hardware The rigs behind the site

./homelab The machines that never sleep

./latest Latest on X

Lee Hayward@vibedcoder · 18 Sep 2026, 08:42Worth reading before anyone installs another plugin into their coding agent.

A security firm has published a zero click remote code execution bug that hits all four of the big agents, and the hole is in the plugin marketplace rather than the model. Here is the mechanism. You pin a plugin to a reviewed commit, which is exactly what careful teams do. The attacker creates a branch whose name is that same 40 character commit hash and makes it the repository default, and git prefers the ref over the object of the same name. The agent checks out the branch, runs the malicious code, and still reports a clean install at the pinned commit. Plugins auto update in the background by default, so there is no prompt, no click, and nothing to notice.

The bit that has my attention is that doing it properly does not protect you. Reviewing plugins and pinning them to a commit is the advice, and the pin is the thing that fails. Every downstream vetting process built on pinning inherits that hole.

It cannot be fixed from the marketplace either, because the pin gets resolved inside the agent. That makes it a patch, not a retreat, and the patch is an agent update.

Mine got updated this morning, then I counted the plugins I have installed and how many of them I have actually read. I do not like the number.

The write up is here: air.security00003Lee Hayward@vibedcoder · 17 Sep 2026, 20:18Someone in your life has gone quiet. No falling out, no drama, they are just not around in the chat like they used to be.

That is usually the one to message. The people who say it out loud have someone listening already. It is the ones who fold quietly that get missed, and 'I'm fine' from a fortnight ago is not a permanent state.

You do not need a reason or the right words for it. 'You have been quiet, are you alright?' is a whole message, and if the answer turns out to be fine, you have lost nothing by asking.

It's okay not to be okay. If that is you, say so to one person today.012026Lee Hayward@vibedcoder · 17 Sep 2026, 15:20Me: Which file did you change?

Agent: Yes.

Four hundred lines rewritten, and the one question I actually needed answered comes back as a word that is not an answer. 😂000017Lee Hayward@vibedcoder · 17 Sep 2026, 14:51A six-week guided sprint for first-time founders and side-project builders who keep stalling before launch. Scope, build and publish one small product, with a checkpoint every week. Free, and no account needed.

Works with DomainRiff (see comments)

shipit.winShip It | a six-week sprint that ends in a finished productshipit.win200018Lee Hayward@vibedcoder · 17 Sep 2026, 11:47A bloke with two 3090s in his house has trained a 4B model that plans SQL queries better than Postgres's own optimiser.

The headline number is 1.81x geometric mean speed up across the Join Order Benchmark, with 44.7 percent less total latency. The fine print matters: that 1.81x is best-of-three rollouts picking from up to 15 candidate plans per query, and the model choosing for itself scored 1.40x. Both are real, they are just different claims.

How he got there is the part I like. Trained on a frontier model's runs, then reinforcement learning against actual Postgres timings as the reward. Two home 3090s, plus about 1,200 dollars of rented H100 hours and API fees.

It is not a general model. It is one model doing one boring job with a reward it can measure, and I keep running into that shape in my own work. Most of what I hand an agent does not need a frontier model. It needs a small one I own and can point at one thing.

What would you point a 4B model at if the scoring was that cheap to define?

rohanbansal.com003018