I agree that Vibe coding has completely changed over the last 6 months to a year. When I vibed another app I did not see any security checks except for maybe the use of paywalls and things. In the Home Assistant HACS App I made I did not ask the AI for much in security but it added it in by itself. 1. The Human-in-the-Loop (Approval Workflow) The most important security layer is that no changes are applied automatically. - Visual Diffs: The agent generates a visual diff showing exactly which lines will be added, removed, or changed. - Explicit Approval: You must manually review and hit "Approve" before the agent writes anything to your disk. - Multi-File Changes: If a request affects multiple files (e.g., creating a template sensor and adding it to a dashboard), you see all proposed changes in one batch before they go live. 2. Automated Backups & Versioning In src/config/manager.py, I built a robust backup system: - Automatic Backups: Every single time the agent writes to a file, it creates a timestamped backup in a separate folder first. - Rotation: It keeps the last 10 versions of every file it touches, so you can always roll back to a known-good state from days ago. - Restore Tool: There is a dedicated internal tool to list and restore these backups if something isn't right. 3. Validation & Atomic Operations To prevent a "broken boot" scenario where HA won't start: - Pre-Flight Validation: Before finalizing a change, the agent uses the HA Supervisor API (or internal HA core check) to run a full configuration validation. - Automatic Rollback: If the validation fails (e.g., the AI suggested a typo in a YAML key), the agent automatically restores the backup and notifies you, leaving your HA instance untouched. - Atomic Writes: The agent writes to temporary files first (.tmp) and then moves them. This prevents "partial writes" if the system crashes mid-operation. 4. Path Traversal & Secrets Protection To protect your privacy and system integrity:

I just wanted to let people know this. I used Claude for awhile but found their limits suffocating. I now use Antigravity which allows Claude usage and All the Gemini Models along with a couple OpenAI models. Google AI Pro includes higher rates for AntiGravity, large Google Drive usage, Notebook LLM with larger usage, some usage on Google Cloud to use Firestore DB. It also allows usage of almost all Google or Gemini features. It's normal cost is $20/month, same as Claude. Google's Antigravity, an agentic AI coding platform, has usage limits similar to Claude's Pro plan. Both enforce hard limits with 5-hour resets for paid users and additional weekly caps to manage heavy usage. Limit Structures Claude Pro offers ~45 short messages per 5-hour session, with strict weekly caps across models, blocking further use upon exceedance. Antigravity's Google AI Pro provides generous quotas resetting every 5 hours plus higher weekly limits, also hard-enforced based on task complexity (e.g., one complex task equals 50–100 standard prompts). Both prioritize paid users with priority access but can frustrate heavy users via dynamic, strict throttling. With Google AntiGravity I can use Claude Sonnet and Opus and still use the other AI's when I am limited correct Yes, Google Antigravity allows using Claude Sonnet and Opus models alongside its own Gemini models. When Claude quotas are hit, you can switch to other available AIs like Gemini to continue working without interruption. Model Access Antigravity integrates Claude Sonnet (e.g., 4.6) and Opus (e.g., 4.5/4.6 "thinking" variants) via a model selector dropdown, plus Google models like Gemini Pro/Flash. Users report Claude usage depleting faster, prompting switches to Gemini for execution tasks. Limit Handling Claude limits in Antigravity are separate from Gemini's—hitting Claude's 5-hour or weekly cap (e.g., ~20 hours/week for Opus) blocks only Claude models, letting you pivot to unlimited Gemini tab completions or other features. Paid tiers like AI Pro provide higher non-Google (Claude) quotas, but enforcement is per-model group.

I had Gemini 3.0 Flash implement this plan and it took less than 2 minutes.

@Chop On Skool There "may" be some reasons I cannot go more in depth about some of these AI Models in AntiGravity but I can let Perplexity or Gemini 3.0 Pro say things about them: Gemini 3.0 Pro says: If Gemini 3.0 Flash is your speedy intern, Gemini 3.1 Pro is your Lead Systems Architect. Google specifically designed 3.1 Pro for complex, long-horizon tasks where simpler models lose the plot. It was built into Antigravity to handle deep reasoning, massive codebases, and multi-step agentic workflows that require careful planning. Why 3.1 Pro Shines in Antigravity - Deep Architectural Reasoning: It excels at designing complex systems from scratch. On rigorous logic benchmarks like ARC-AGI-2, 3.1 Pro scores 77.1% (more than double its predecessor, 3.0 Pro). It can look at an entire project, spot structural flaws, and architect a robust, multi-file solution. - Massive Output Capacity: One of the biggest practical upgrades in 3.1 Pro is its 65,536-token output limit. In Antigravity, this means the agent can completely rewrite or refactor massive code files in one go, without abruptly stopping halfway through and needing a "continue" prompt. - Adjustable "Thinking" Levels: 3.1 Pro features a new multi-tier thinking system. You can dial in the agent's compute time—letting it "think" longer and harder about complex database migrations or security rules, or dialing it back for standard tasks to balance speed and logic. - Native Visuals & "Vibe Coding": 3.1 Pro has an incredibly strong grasp of design intent. It can generate, animate, and render website-ready SVGs or interactive 3D structures purely through code right inside the Antigravity workspace. The Catch: Speed and Cost Because 3.1 Pro thinks so deeply, it is noticeably slower and more resource-intensive (in terms of premium rate limits) than Flash. If you use 3.1 Pro to write a simple regex or change a CSS color, you are using a sledgehammer to swat a fly. It will take longer to formulate its response and consume your quota for a task Flash could have done instantly.

@Corbin Brown See my posts above.

@Corbin Brown Be very careful using this: OpenClaw carries significant security risks due to its broad system access (files, credentials, browser history) and local execution model, making it vulnerable to prompt injections, where malicious web content tricks it into leaking data or running unauthorized actions. Recent issues include CVE-2026-25253 (patched in v2026.1.29), enabling one-click remote code execution via WebSocket hijacking from malicious links, even on loopback-only setups. Misconfigurations have exposed databases, API keys, and chats publicly, with malicious skills and fake downloads spreading malware. Experts recommend isolating it in VMs, monitoring closely, and using latest versions, but risks remain non-zero for advanced users. This is really the same as Clawdbot or MoltBot or a bunch of these AI Agents that leave your computer open. @Corbin Brown I'm figuring you know how to secure your machine but other may not. Be very careful with these and it is best that if you are going to run it do so in a VM, so you can just destroy the machine if needed.