BuildBench Weekly #1
Hey builders, this is the first BuildBench weekly. Every Friday: the releases that matter for vibe coders, what moved in our rankings, and one "skip this for X" pick. Full rankings live at BuildBench.
Top new releases this week
- Supabase local dev without Docker (Oct 15). You can now run Supabase locally without Docker, and each coding agent can get its own local project, so parallel agents stop clobbering each other's database. If you run more than one agent at a time, this is the one to try. Supabase on X
- Meta's Muse Wonder lands in Cursor (Oct 15). Selectable in Cursor; Cursor reports 46.1% on CursorBench at default effort, priced at $4 per million input tokens and $20 per million output tokens. Meta also released Muse Spark Open, an open-weight model (816B parameters, 42B active, 1M context) aimed at coding and agents. Cursor on X · Meta: Muse Spark Open
- Lovable keeps expanding past "build" (Oct 14–16). Growth tools to launch ads on Google, YouTube, Facebook and Instagram and generate marketing images, video and copy from your build; WhatsApp messaging for your app's customers; and SSO access to the Lovable MCP server from Claude for Business and Enterprise workspaces. Growth tools · WhatsApp · Changelog
- GitHub Copilot in Slack and Teams goes multi-repo (Oct 15), plus Gemini 4 Argon is now GA in Copilot (Oct 13) and GitHub's agentic autofix and AI scans for PRs are GA. Copilot in Slack/Teams · Gemini 4 Argon
Ranking changes
No scores moved in launch week; we only change a score on corroborated evidence. Two "avoid for" notes were added:
- Claude Code (still 9/10): now flagged for "uninterrupted all-day use on lower-tier plans." Several independent builders reported hitting session and weekly usage limits this week, while still praising output quality.
- Lovable (still 8/10): now flagged for "apps holding user data shipped without a security review." A 2025 scan by Replit's Matt Palmer and Kody Low found 170 of 1,645 showcased Lovable apps exposed user data through weak Supabase row-level security (statement, CVE-2025-48757). Lovable disputes the CVE.
Skip this for X
Skip shipping a Lovable app that stores user data straight to production without checking your Supabase RLS policies. Lovable is still one of our top picks for getting an MVP up fast. The risk isn't the builder, it's skipping the step where you confirm every table has row-level security that actually limits who can read what. Before launch: open each table in Supabase, confirm RLS is on, and test reads while logged in as a different user. If you can't do that yourself, get someone who can before real users sign up.
On our radar (not verified yet)
- Posts claim Claude Code's new fast mode costs about 2x per token and has its own rate limit. We're waiting for an Anthropic source before adding it.
- One report says GitHub Copilot silently switched models mid-task after a rate limit. Single report; watching for more.
That's the week. Reply and tell us which tool you want ranked next, or what we got wrong.
Timothy, BuildBench buildbench-50e.pages.dev · @BuildBenchHQ on X