--- title: I finally found a vibe-coding tool I can trust with my... description: Tines 3B is a vibe-coding platform that addresses a critical security gap in AI-assisted development: credentials never touch the AI or the generated code.... canonical: https://daily.dev/posts/i-finally-found-a-vibe-coding-tool-i-can-trust-with-my-home-lab-and-the-ai-never-sees-a-single-api--gqzaa3kbs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: I finally found a vibe-coding tool I can trust with my home lab, and the AI never sees a single API key | daily.dev og:description: Tines 3B is a vibe-coding platform that addresses a critical security gap in AI-assisted development: credentials never touch the AI or the generated code.... og:url: https://daily.dev/posts/i-finally-found-a-vibe-coding-tool-i-can-trust-with-my-home-lab-and-the-ai-never-sees-a-single-api--gqzaa3kbs og:image: https://api.daily.dev/og/posts/GqzAa3KBS.png og:image:alt: I finally found a vibe-coding tool I can trust with my home lab, and the AI never sees a single API key og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # I finally found a vibe-coding tool I can trust with my home lab, and the AI never sees a single API key **[XDA Developers](https://daily.dev/sources/xda-developers)** · 9 min read · 0 upvotes · 0 comments ## Summary Tines 3B is a vibe-coding platform that addresses a critical security gap in AI-assisted development: credentials never touch the AI or the generated code. Instead, API keys and secrets are injected at request time via a proxy sitting outside the execution environment, so the model literally cannot read or leak them. Each workflow step runs in an isolated gVisor-based sandbox (a userspace kernel implementation), making cross-contamination architecturally impossible. Home lab services connect through a mutual-TLS tunnel with no firewall changes required, and CIDR-scoped access is configurable from the control panel. The platform supports 1,032 connectors covering static secrets, token-fetching flows, and cryptographic signing schemes. Code is portable standard Python and TypeScript, branches map to git branches, and a self-healing feature (Autofix/Autotune) proposes fixes as pull requests without touching live workflows. Pricing starts with a one-time $50 AI credit, after which users bring their own model subscription. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Tines 3B prevent an AI coding tool from ever seeing API keys or credentials? Credentials live in a separate configuration called a connector, and when a workflow step calls an external service, a proxy sitting outside the execution environment injects the credential into the request at runtime. The generated code only makes plain HTTP requests with no auth headers, so the code itself never reads or can print the credential. _Developers weighing AI coding tools against credential-leak risk can track approaches like this on daily.dev._ ### What isolation technology does Tines 3B use to sandbox AI-generated workflow steps? Each step runs in a custom environment built on Google's gVisor sandbox runtime rather than a standard container. gVisor implements a kernel in userspace between the workload and the real kernel, intercepting system calls so a hostile or buggy step has drastically reduced access to the host kernel compared to a normal Docker container using only namespaces and cgroups. _Engineers evaluating sandboxing for AI-generated code can follow gVisor-based approaches on daily.dev._ ### How prevalent is data leakage in vibe-coded applications published to app marketplaces? Roughly one in ten of 1,645 apps published to Lovable's marketplace were found to be leaking user data through an authorization flaw. This demonstrates that credential and data exposure is not a hypothetical concern but a measured, widespread problem in AI-generated applications deployed without proper security review. _Teams shipping AI-generated apps can keep tabs on vibe-coding security risks via daily.dev._ ## Similar posts on daily.dev - [Harnessing the Power \(and Taming the Risks\) of Vibe Coding in API Development](https://daily.dev/posts/harnessing-the-power-and-taming-the-risks-of-vibe-coding-in-api-development-ysvyhlqmb) · Nordic APIs · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-coding](https://daily.dev/tags/ai-coding), [#vibe-coding](https://daily.dev/tags/vibe-coding) [View this post on daily.dev](https://daily.dev/posts/i-finally-found-a-vibe-coding-tool-i-can-trust-with-my-home-lab-and-the-ai-never-sees-a-single-api--gqzaa3kbs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"I finally found a vibe-coding tool I can trust with my home lab, and the AI never sees a single API key","url":"https://daily.dev/posts/i-finally-found-a-vibe-coding-tool-i-can-trust-with-my-home-lab-and-the-ai-never-sees-a-single-api--gqzaa3kbs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/i-finally-found-a-vibe-coding-tool-i-can-trust-with-my-home-lab-and-the-ai-never-sees-a-single-api--gqzaa3kbs"},"datePublished":"2026-07-28T13:02:52.490Z","dateModified":"2026-09-14T08:42:44.522Z","description":"Tines 3B is a vibe-coding platform that addresses a critical security gap in AI-assisted development: credentials never touch the AI or the generated code....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/34e8991c07ed68fade2a74c72a1e5559?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/34e8991c07ed68fade2a74c72a1e5559?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"XDA Developers","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"XDA Developers","logo":"https://media.daily.dev/image/upload/s--kCg6yyAP--/f_auto,q_auto/v1774964407/logos/xda-developers?_a=BAMAMiWQ0","url":"https://daily.dev/sources/xda-developers"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/i-finally-found-a-vibe-coding-tool-i-can-trust-with-my-home-lab-and-the-ai-never-sees-a-single-api--gqzaa3kbs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-coding,vibe-coding","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"XDA Developers","item":"https://daily.dev/sources/xda-developers"},{"@type":"ListItem","position":3,"name":"I finally found a vibe-coding tool I can trust with my home lab, and the AI never sees a single API key"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/i-finally-found-a-vibe-coding-tool-i-can-trust-with-my-home-lab-and-the-ai-never-sees-a-single-api--gqzaa3kbs#faq","mainEntity":[{"@type":"Question","name":"How does Tines 3B prevent an AI coding tool from ever seeing API keys or credentials?","acceptedAnswer":{"@type":"Answer","text":"Credentials live in a separate configuration called a connector, and when a workflow step calls an external service, a proxy sitting outside the execution environment injects the credential into the request at runtime. The generated code only makes plain HTTP requests with no auth headers, so the code itself never reads or can print the credential. Developers weighing AI coding tools against credential-leak risk can track approaches like this on daily.dev."}},{"@type":"Question","name":"What isolation technology does Tines 3B use to sandbox AI-generated workflow steps?","acceptedAnswer":{"@type":"Answer","text":"Each step runs in a custom environment built on Google's gVisor sandbox runtime rather than a standard container. gVisor implements a kernel in userspace between the workload and the real kernel, intercepting system calls so a hostile or buggy step has drastically reduced access to the host kernel compared to a normal Docker container using only namespaces and cgroups. Engineers evaluating sandboxing for AI-generated code can follow gVisor-based approaches on daily.dev."}},{"@type":"Question","name":"How prevalent is data leakage in vibe-coded applications published to app marketplaces?","acceptedAnswer":{"@type":"Answer","text":"Roughly one in ten of 1,645 apps published to Lovable's marketplace were found to be leaking user data through an authorization flaw. This demonstrates that credential and data exposure is not a hypothetical concern but a measured, widespread problem in AI-generated applications deployed without proper security review. Teams shipping AI-generated apps can keep tabs on vibe-coding security risks via daily.dev."}}]} ```