Ask ChatGPT or Perplexity "what's the best note-taking app" and you get a shortlist of three to five names. Either you're on it or you don't exist in that channel. And buying research keeps moving there. People call measuring this GEO or AEO tracking now. The way most teams do it is pasting questions into chatbots by hand and eyeballing the answers. That stops scaling at about ten questions, and you can't trend it week over week. Doing it programmatically Don't scrape the chat UIs. It's fragile, against ToS, and breaks weekly. The engines all have official APIs with web search: Perplexity's sonar models return answers with citations built in OpenAI has gpt-4o-search-preview for live web search Gemini's gemini-2.5-flash supports Google Search grounding One OpenRouter key covers all three through a single endpoint, which keeps the code boring. For each buyer question you care about, record four things per engine: was the brand mentioned, how early in the answer, was your domain cited as a source, and how often competitors appeared. That last one gives you share of voice. The packaged version I built this as an Apify actor: AI Brand Visibility Tracker . You give it a brand name, domain, competitors, and topics. It generates realistic buyer questions and returns one JSON row per check: brandMentioned , positionScore , brandCited , shareOfVoice , citedDomains , plus a per-engine summary. Schedule it weekly and you have an AI visibility trendline for client reports. $0.05 per check. The field that actually matters citedDomains is the actionable one. It tells you which sites the AI engines treat as sources for your category. Getting mentioned on those specific domains is how you move your visibility. It's link building, except the target list comes from the AI's own citations instead of a guess.

I just opened 3 security issues on two of the most popular AI agent frameworks on GitHub (combined 110K+ stars). The Issues microsoft/autogen#7917 : Docker code executor mounts host filesystem into sandboxed containers without trust boundary validation — container escape vector. microsoft/autogen#7918 : Agent self-modification patterns in Canvas memory module — agents can alter their own operating constraints during execution. run-llama/llama_index#22245 : 441 instances of unbounded recursive agent execution across 2,951 files — systemic resource exhaustion risk. All found with AgentGuard v0.6.2 (pip install dfx-agentguard), an open-source AI agent security scanner. Why Issues, Not Articles I have published 12 articles on Dev.to. Average views: 11. GitHub Issues on 50K+ star repos are read by thousands of developers and stay visible for years. This is the correct distribution channel for security findings — direct, unfiltered, and actionable. The Pattern The same vulnerability classes appear across all frameworks: Trust boundary violations (ASI10): agents crossing filesystem and network boundaries Agent recursion (ASI09): unbounded loops without circuit breakers Self-modification (ASI10): agents modifying their own state during execution These are not framework-specific bugs. They are systemic architectural gaps in how we build autonomous agents. Every framework needs guardrails for resource limits, trust boundaries, and behavioral constraints. AgentGuard detects all of them. 16 rules, 83 tests, 36 benchmark samples, 100 percent detection rate. pip install dfx-agentguard

I wanted to know when people mention a brand on Bluesky. Simple ask. Turns out Brandwatch, Mention, Hootsuite, basically every social listening tool, still doesn't cover it. They're all busy with X and Instagram while Bluesky sits at 27M+ monthly users. So I looked at doing it myself and found out something most people miss: you don't need to scrape anything. Bluesky runs on the AT Protocol, which is open by design. Public posts are searchable through a documented endpoint. No login, no API key. GET https://api.bsky.app/xrpc/app.bsky.feed.searchPosts?q=YOUR_BRAND&sort=latest&limit=100 That returns full post objects. Text, author handle, timestamps, like/repost/reply counts, embedded links, hashtags. Everything you need. Two things that broke my first version Worth writing down because most tutorials get this wrong now: The public.api.bsky.app host that older guides point to returns 403 for search. Use api.bsky.app instead. As of July 2026, unauthenticated search rejects cursor pagination. Page one works fine, page two gets you a 403 with "request forbidden by administrative rules". The nasty part is it looks like rate limiting, but it isn't. The workaround: paginate by time. Use sort=latest , then pass until= with the createdAt of the oldest post from the previous page. Dedupe on uri because the boundary post shows up twice. If you don't want to maintain any of that I packaged the whole job as an Apify actor: Bluesky Mentions Scraper . Keywords in, clean JSON out. It handles the pagination and retry stuff above, filters replies if you want, scores basic sentiment, and can pull follower counts for each author so you can sort mentions by reach. Runs on a schedule, exports CSV, plugs into Slack or n8n through Apify's integrations. It also works as an MCP tool inside Claude or Cursor. Pricing is per result, $4 per 1,000 mentions. No subscription. What I actually monitor Brand and product names plus the common misspellings. Competitor names, because share of voice on Blu

Fable and Opus may not be the most comfortable tools for engineers who learned to code by hand. I started thinking about this after reading Simon Willison's recent note . His point is simple: with a strong coding agent like Fable, it may be better to let the model exercise its own judgment than to spell out every condition yourself. Instead of writing detailed rules like "run tests for larger features, but not for small copy changes, except for design changes...," you can simply say: write and run tests where appropriate. The same applies to cost. Rather than deciding manually which tasks should go to which model, you can ask the agent to choose an appropriate lower-cost model and delegate the work to a subagent. Manual cars and automatics This is a rough analogy, but it feels similar to driving a car. People who enjoy driving often like manual cars. They want to choose the gear themselves. They want to feel the engine speed and have the car respond directly to their intent. For people who simply want to get somewhere, an automatic is easier. Software engineers are similar. If you have written code professionally for a long time, you usually have your own way of working. You may want to get the types right first. You may prefer small diffs. You may have a specific sense for how granular tests should be. You may even have an order in which you like to read an unfamiliar codebase. (At least, I hope you do.) For someone with that kind of style, a highly autonomous model like Fable or Opus can feel a little too automatic. The stronger the model, the more small instructions get in the way This is the same structure as management in human organizations. A junior member needs concrete instructions: read this document from this angle and summarize it in this format. A senior member can take a rougher assignment: I want to solve this problem, so investigate it, come up with an implementation plan, and move it forward. Of course this does not mean throwing work over the wall.

I just shipped 5 new tools to DevNestio — a hub of 172 free, browser-only developer utilities. All tools are zero-signup, zero-upload, and work offline. 1. GraphQL Query Formatter & Minifier https://devnestio.pages.dev/graphql-formatter/ Paste any GraphQL operation and get: Pretty-print — consistent indentation Minify — strips comments and whitespace for smaller request payloads Validation — brace/parenthesis balance check Operation detection — lists all named query , mutation , subscription , fragment Useful for quick query cleanup before pasting into code reviews or API docs. 2. Protobuf (.proto) Formatter & Validator https://devnestio.pages.dev/protobuf-formatter/ Online formatter and validator for Protocol Buffer .proto files: Duplicate field number detection Message and enum structure validation Syntax-highlighted output One-click copy Great for a sanity check before pushing .proto changes in a gRPC service. 3. Docker Compose Validator https://devnestio.pages.dev/docker-compose-validator/ Paste your docker-compose.yml to catch: Missing services section Services without image or build Invalid port mappings ( 80:80 , 127.0.0.1:8080:80 , 53:53/udp , ranges…) depends_on referencing non-existent services Circular dependency detection (A→B→A) Unknown restart policies # This will flag errors: services : web : ports : - " abc:xyz" # invalid port depends_on : - missing_service # unknown service 4. Dockerfile Analyzer & Linter https://devnestio.pages.dev/dockerfile-analyzer/ Analyzes your Dockerfile for best practice violations across three categories: Security sudo usage inside RUN Container running as root (no USER instruction) Secrets baked into ENV / ARG (password, secret, token, key) Image size :latest base image tag apt-get update in a separate RUN (stale cache risk) apt-get install without --no-install-recommends apt cache not cleaned ( rm -rf /var/lib/apt/lists/* ) ADD used for local files instead of COPY Layer optimization Consecutive RUN instructions (suggest c

GA in a sentence GitHub moved its enterprise managed-settings.json to general availability on July 1, giving GitHub Enterprise Cloud admins a single JSON file that overrides Copilot behaviour in VS Code and Copilot CLI for anyone holding a Copilot Business or Copilot Enterprise seat issued from the enterprise or one of its organizations. The changelog frames it as a place to define AI standards for the tenant. In practice it is a supported home for Copilot policy that shipped one setting at a time in beta up to this point. The five keys the file accepts Five keys are documented at GA: extraKnownMarketplaces , enabledPlugins , strictKnownMarketplaces , disableBypassPermissionsMode , and model . Together they configure trust for extra plugin marketplaces, the enabled-plugins list, strict enforcement of the known-good marketplace list, whether Copilot CLI and the VS Code extension can run in bypass-permission mode, and which model a user is allowed to pick. Value shapes are not enumerated in the changelog itself; the docs page is the reference for the schema. How the file reaches a client The file lives at copilot/managed-settings.json inside the .github-private repository of the organization the enterprise nominates for the role. There is a backward-compatible path at .github/copilot/settings.json for tenants already using the older layout. Copilot clients fetch the file from the server on every authentication, hold it in memory, and refresh it hourly, per the changelog. That server-side file takes precedence over the file-based config a user may have on their own machine. Setup runs through the AI Controls tab in enterprise settings, or the equivalent API endpoint, where an admin picks the hosting organization. Anyone who followed the June rollouts of disableBypassPermissionsMode and strictKnownMarketplaces will recognise the same file and the same repo. GA is what turns the plumbing into a supported product surface. Where it will trip you Two operational details are

TL;DR Two Laravel backends started serving Flutter apps on the same day — an events platform (auth, orders, offline check-in) and a helpdesk product (ops mode for agents). gatherhub-web moved to plans-only pricing with a comparison matrix driven by one data file. A hardening pass: payment-safe queues, gateway reconciliation, one heavyweight dependency dropped. Two mobile APIs in one day Coincidence, but a useful one: two products I'm building both needed their Laravel backends to serve mobile apps this week. The events platform got the full foundation — token auth (login/refresh/logout/me), participant orders, mobile payment with status polling, push-device registration, and an offline-first staff check-in flow. That last one is the interesting bit; I wrote it up as its own post. The helpdesk product went the other way: its API was client-only, and today it became role-aware. The same endpoints now serve ops agents working tickets from their phones, with abilities deciding what each role sees. One API surface, two personas, no duplicated /admin routes. The lesson that repeated in both: API Resources are the contract. The moment a mobile dev consumes your endpoint, every field you accidentally leak becomes a field you can't remove. Plans-only pricing (public) gatherhub-web , the Next.js marketing site, dropped à-la-carte feature pricing for three plans and gained a plan comparison matrix. Everything renders from a single plans.ts — the matrix, the pricing cards, the enterprise page — so the marketing site can't drift from what's actually sold. A pricing page is a contract too; it deserves a single source of truth as much as your API does. Hardening pass Change Why Bulk email blasts isolated to their own queue one big send must never delay a payment webhook Reconciliation command for stuck pending orders webhooks fail silently; polling the gateway is the safety net maatwebsite/excel → spatie/simple-excel for exports streams rows instead of building sheets in memory, s

TL;DR A gate check-in app can't depend on live Wi-Fi: scans must work offline and sync later. Four endpoints do it: manifest download, idempotent batch push, delta pull, online search. Client-generated UUIDs + a unique index make retries safe. Duplicates are a success status, not an error. The problem Physical event, staff scanning tickets at the door, venue Wi-Fi exactly as reliable as you'd expect. If your API sits in the hot path of every scan, the queue at the gate grows at the speed of the worst signal bar in the building. So the design flips the roles: the device owns check-in, the server owns convergence. Like a cashier who keeps a paper ledger when the till goes down — record now, reconcile later. The API surface Endpoint Purpose GET /staff/events/{uuid}/manifest paginated ticket snapshot, downloaded before gates open POST /staff/events/{uuid}/check-ins/batch push queued scans; safe to retry GET /staff/events/{uuid}/check-ins?since=<cursor> pull what other devices did GET /staff/events/{uuid}/participants?q= online fallback search (lost ticket, typo) The sync loop Device Server |--- GET manifest (before event) ------->| | scan offline, queue locally | |--- POST batch [{client_uuid, ts}] ---->| dedupe on client_uuid |<-- 200 {applied | duplicate per item} -| |--- GET check-ins?since=cursor -------->| scans from other devices |<-- delta + next cursor ----------------| Idempotency is the whole trick Every scan gets a UUID generated on the device at scan time . The server puts a unique index on it and inserts-or-ignores: public function batchCheckIn ( BatchCheckInRequest $request , string $uuid ): JsonResponse { $results = collect ( $request -> validated ( 'check_ins' )) -> map ( function ( array $scan ) { $checkIn = CheckIn :: firstOrCreate ( [ 'client_uuid' => $scan [ 'client_uuid' ]], [ 'ticket_id' => /* resolved from scan */ , 'checked_in_at' => $scan [ 'scanned_at' ]], // ... ); return [ 'client_uuid' => $scan [ 'client_uuid' ], 'status' => $checkIn -> wasR

From MVP to Enterprise: Architecting AI APIs That Don't Fail at 3AM I've been on-call for enough production incidents to know that the difference between a startup's AI integration and an enterprise one isn't just budget. It's everything downstream — your p99 latency, your failover story, the size of your blast radius when a provider has a bad Tuesday. Most guides lump these two worlds together and that's exactly why teams end up rearchitecting at the worst possible moment. Let me walk you through how I think about it now, after spending years shipping LLM-backed services for both early-stage teams and Fortune 500 procurement departments. The short version: I almost always route through Global API, and the tier I pick depends entirely on what keeps me up at night. The Question Nobody Asks First: What Breaks When? When I sit down with a founder, the conversation usually starts with "which model should we use?" That's the wrong first question. The right first question is: what's your tolerance for a 3 a.m. page? If you're a seed-stage startup with a handful of users, your answer is probably "none, but I'll deal with it." If you're a publicly traded company processing loan applications, your answer is "I need a 99.9% SLA in writing, multi-region failover, and a support escalation path that doesn't start with a Discord server." Those two answers produce two completely different architectures. Let me show you what I mean. The Startup Reality: Speed and Optionality Here's the dirty secret about direct provider integration for startups: it feels free, and then it isn't. I watched a team burn six weeks trying to wire up DeepSeek's API directly. They needed a Chinese phone number for verification, an Alipay or WeChat account for payment, and they were stuck the moment they wanted to A/B test against Qwen or another model. Their CTO told me afterward, "We spent a sprint on payment infrastructure before we shipped a single feature." That pain compounds. Every new model is a ne