Should I vibe code
Run Claude Code from your phone, on a container that is not your laptop
You didn’t build a mobile client. You built an internet-facing shell holding your GitHub token.
?
Their verdict, the Yado Pro price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
Yado’s trick is that the computer is not yours: sign in with GitHub, a container starts with the tooling already installed, the agent runs in it, and the session keeps going after you lock your phone. The consolation build — a small VPS, tmux, Tailscale and a web terminal — is genuinely an evening, and for one developer it is a good evening. Spend ten minutes first on what that box actually is. It holds a GitHub token with write access to your repositories, a model credential, and whatever .env files your projects drag along, and it runs an agent with a shell. Put it on a public port behind a password you invented at midnight and you have built the most interesting host on the internet. Put it on a private network and most of this entry evaporates — which is, in the end, the whole verdict.
What actually breaks
not "if". the specific failures.
- The exposed port. A browser terminal listening on 0.0.0.0 behind basic auth is a shell that scanners find in hours, not months
- Credential concentration. One box holding a GitHub token, a model credential and every project’s .env is a single, unusually rewarding target
- Session persistence. The phone locks, the websocket drops, and a twenty-minute run dies with it unless the process was detached from the connection in the first place
- Approvals. An agent that cannot reach you for a yes or no ends up running with permissions bypassed, which is fine right up until the step it skips is the deploy
- The bill. A container kept warm so you can prompt it from a bus is a machine you are paying for at 4am on a Tuesday
- Git, on a small screen. A force-push from a phone at a traffic light is a real thing that people do
Is that you?
the verdict is a default, not a law
- It is reachable only over Tailscale, WireGuard or an SSH tunnel, with no inbound public port
- The container holds a fine-grained token scoped to the two repositories you actually work on
- Everything happens on a branch, and the default branch rejects force pushes at the host
- You are about to put a web terminal on the public internet behind a login form you wrote yourself
- The box has production credentials on it because that was convenient once
- You intend to let anyone else use it, at which point you are running a multi-tenant code-execution service
- Permission prompts are off by default and there is no way to stop a run from the phone
If you build it anyway
the checklist, then the prompt that enforces it
- No inbound public port. Reach the box over a private network — Tailscale, WireGuard, an SSH tunnel — and nothing else.
- If it truly must be public, put an identity-aware proxy in front of it (Cloudflare Access, oauth2-proxy). Never a hand-rolled login form guarding a shell.
- Inject credentials at run time from a secrets store, scoped down: a fine-grained GitHub token for the repos you use, not a classic PAT with everything.
- Detach the agent session from the connection with tmux or a supervised process, so locking the phone pauses your attention rather than the job.
- Keep permission prompts on for anything writing outside the working tree, pushing, or installing packages. If you need a bypass, make it per-session and expiring.
- Give yourself a kill switch reachable from the phone — stop this run, destroy this container — before you build anything cosmetic.
- Rebuild the container from a Dockerfile on a schedule. A long-lived dev box silently accumulates keys nobody remembers adding.
I am building a way to drive a coding agent from my phone against a container that is not my laptop. Treat that box as a credential store with a shell attached.
1. No inbound public port. Reach the container over Tailscale, WireGuard or an
SSH tunnel. If I ask you to expose a web terminal on 0.0.0.0, refuse and
explain that scanners find those in hours.
2. If it truly must be public, put an identity-aware proxy in front —
Cloudflare Access, oauth2-proxy, Tailscale with auth. Never a hand-rolled
login form in front of a shell.
3. Credentials are injected at run time from a secrets store, never baked into
the image and never committed. Use a fine-grained GitHub token scoped to
the repositories I actually work on, not a classic PAT.
4. Detach the agent session from the network connection first — tmux, screen
or a supervised process — so locking my phone does not kill a running job.
Do this before any UI work; it is the entire point of the product.
5. The working tree lives on a branch. Configure the remote to reject force
pushes to default branches, at the host rather than in my client.
6. Keep permission prompts on for anything that writes outside the working
tree, pushes, installs packages or opens a network connection. If I ask for
a blanket bypass, make it per-session and expiring.
7. Give me a kill switch reachable from the phone: stop the current run, and
destroy the container. Both before you build syntax highlighting.
8. Log what the agent ran, readable from the phone. That log is how I find out
what happened while I was on a train.
9. Rebuild the container from a Dockerfile on a schedule, so a long-lived box
does not quietly accumulate keys and half-finished branches.
10. Out of scope: multiple users, shared sessions, public preview URLs, and
storing my model credential anywhere except the secrets store.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
You want the container, the push notifications and the session that survives a locked screen without also running a machine. Yado’s free tier already covers most of that, and Pro is ten dollars for voice input and parallel sessions — against a VPS that costs more than that and never gets patched. The DIY version wins if you already have a homelab, Tailscale and the habit of rotating tokens. It loses badly if this would be your first exposed service.
$9.99/mo is cheaper than your weekend.
There is almost nothing to exit, which is the nicest thing about this category: the work is in git, the environment is a Dockerfile, and the client is a terminal. Keep it that way — no state that only lives inside the container, no configuration that exists only in a phone app. Then revoke the token, destroy the box, and you are back to a laptop with the same repositories on it.
MIT mobile and web client for Claude Code, self-hostable, but it remote-controls an agent running on a computer you have to keep switched on.
A polished mobile terminal that drives Claude Code over SSH, freemium rather than open source, and the machine it connects to must be yours and awake.
Questions
Is this not just SSH from a phone?
Mostly, yes, and that is the honest consolation build — a VPS, tmux, Tailscale and a decent mobile terminal get you 80 per cent of the way in an evening. What the packaged products add is what you notice on day three: push notifications when the agent wants a decision, a diff view worth reading on a small screen, and a session that does not die when the network changes on a train.
Why does this score higher on security than a website builder?
Because the asset is different. A website leaks content; this box holds a token that can write to your repositories, a model credential that can be billed, and a shell that runs whatever an agent decides to run. The blast radius stays small — it is your own stuff — but the value sitting on that host is high, which is exactly the shape of thing worth not exposing.
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
Sure. Build the tool you are building it with. See you in eighteen months.
You are bolting a container-escape surface to a plaintext secrets panel and giving an agent a shell.
You are building a box that runs strangers’ code. That box is a cryptominer with extra steps.
last reviewed 2026-08-04 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice