标签：#product

Exposing the keys in the GitHub Issue The Phishing Site (Notice the Spotify option) There is a golden rule in cybersecurity: the weakest link is almost always human error. But what happens when that human error comes from a malicious actor trying to orchestrate a crypto phishing scam? The result is surprisingly comedic. Here is the story of how my newly built open-source secret scanner, Sentinel, accidentally neutralized a Tether (USDT) phishing operation during a routine benchmark. The Setup: Testing in the Wild I recently released Sentinel , a statically compiled, context-aware Git secret scanner and pre-commit hook written in Go. After fine-tuning its engine to achieve near-zero false positives, I decided to benchmark it "in the wild" by scanning random, recently updated repositories on GitHub. The goal was to see if Sentinel could catch edge-case credentials that traditional, regex-heavy tools often miss or drown in noise. During the scan, Sentinel instantly flagged a critical severity finding in a rather suspicious repository. The Catch: AI Copy-Paste Gone Wrong Upon inspecting the flagged file, the issue was immediately apparent: a fully exposed, hardcoded Firebase configuration object containing the API key, project ID, and messaging sender ID. It was a textbook case of a script kiddie asking an AI for a web login template and blindly copy-pasting the frontend code into a public repository. They had effectively handed over the administrative keys to their backend infrastructure before the project even launched. The Phishing Site: Logging into Crypto with Spotify? Out of professional curiosity, I checked the Vercel deployment linked to the repository. The project was attempting to impersonate Tether (USDT), the world's largest stablecoin. It featured the official logo, a catchy slogan, and a login prompt designed to harvest credentials. However, because the scammer had blindly copied a generic consumer application template, the authentication options presented

**_Hi everyone! We're three 16-year-old friends learning to code. Instead of building "just another app," we want to solve a real problem that developers actually face. So we have one question: Think about a moment when you caught yourself saying, "Why hasn't anyone built a good solution for this yet?" What was the problem? It can be anything: something that wastes your time, something frustrating, a repetitive task, a confusing workflow, or anything that made you wish a better tool existed. We're not trying to sell anything. We're simply listening and looking for real problems worth solving. Every answer means a lot to us. Thank you!_**

I shipped the first public build of a Chrome extension two weekends ago. The marketing-ready UI took me about six hours. The four state bugs below took me the rest of those two weekends, plus parts of the following week. I am writing this down because every reviewer of "I built an X in Y hours" posts seems to skip the state-model half, and the state-model half is where the actual time goes. The extension A sidebar that lives in Chrome's side panel API. You highlight text or screenshot a region on any page, the sidebar lets you pick a destination AI tab (ChatGPT / Claude / Gemini / a custom one) and forwards the content with a small wrapper prompt. That is the whole product description. The interesting part is what happens when a user does it twice. Bug 1: the destination you "logged into" is not the destination the message lands in First failure I caught: user has two ChatGPT tabs open, one workspace, one personal. The extension forwards to whichever tab was last focused. The user sees the message arrive in the workspace, replies there, then realizes the context they wanted to capture is on the personal tab. Fix: every AI destination registers a stable tab id at extension boot, not at click time. The forwarding logic walks the registry, not the focused window. Took a morning to redesign, an afternoon to migrate existing flows. Lesson: tab identity is not the same as window focus. Chrome's chrome.tabs.query({active: true}) returns the active tab. The active tab is not necessarily the destination the user has in their head. Bug 2: the screenshot is from before the user edited it User takes a screenshot of a code block, opens the sidebar, hits "annotate", drags a red box around lines 12-15, hits send. The annotation worked. But the underlying screenshot bytes were captured at the moment the toolbar first appeared, before the user could draw the box. Fix: the sidebar cannot trust that the screenshot in memory is the screenshot the user is looking at. Either re-capture o

My GPT got dumber after the update" gets blamed on the model regressing, or on you prompting worse. Both are unfalsifiable, and both send you to fix the wrong layer. The layer that actually moved is the one you can pin. "The model" is two layers. The weights — the trained network, slow to change, and when they do change it's announced under a new name. And the wrapper — the router that picks which model answers, the system prompt, the default reasoning effort, verbosity caps. The wrapper changes silently, on its own schedule, per product. It's almost always what moved under you. So stop re-tuning prompts to chase it. Pin the wrapper: Force the route. Don't leave it on Auto — set Thinking (or say "think hard") so the router can't quietly demote your prompt to a faster, weaker model. OpenAI's own GPT-5 launch post describes exactly this router (it scores prompts "simple" vs hard); after the backlash they put the picker back (Auto/Fast/Thinking — TechCrunch, Aug 2025). Pin the version. If you build on a model, call its exact versioned ID via the API. A model ID's weights don't change — new versions ship under new IDs — so router and system-prompt churn can't reach you. Own the harness. Running agents? Set the system prompt, reasoning effort, and verbosity yourself instead of inheriting a default. Anthropic's own April 23 post-mortem is the proof: six weeks of "Claude Code got worse" traced to three wrapper changes (a reasoning-effort downgrade, a reasoning-history bug, a verbosity cap their ablations put at ~3% quality) — API weights never touched. A real weights change — a new model — will still move behavior. But that's announced, and you choose when to adopt it. The silent stuff is all wrapper, and the wrapper is the part you can pin. Sources: OpenAI GPT-5 launch (router + "think hard"); TechCrunch, Aug 2025 (model picker reinstated); Anthropic April 23 post-mortem (anthropic.com/engineering/april-23-postmortem); InfoQ and VentureBeat (corroboration); Claude platfor

I’m VikingRob—Full-Stack Dev, SaaS Builder, and Solo Survivor. Hello I Just wanted to introduce myself. I’m Robert, but most people know me as VikingRob (thanks to a long red beard and a habit of grinding through hard Jobs with a foul mouth. Down to earth guy I'm a No B.S Person. I’ve been surviving in the trenches of solo entrepreneurship and freelancing for a while now. Lately, the market feels incredibly flooded, and landing solid, consistent work has become a massive mountain to climb. I’ve managed to keep things moving with some passive income from selling front-end and back-end sites I've built, but as anyone with a family knows, "passive" rarely means "enough" when consistency drops. I’m supporting a family of five—including a wife dealing with severe mental health challenges—so the pressure to secure steady, reliable income is incredibly real right now. To adapt, I am shifting my core focus toward offering full-scale services: Custom Website Architecture (End-to-end development) Front-End & Advanced Back-End Integration SaaS Product Development A lot of my heaviest back-end work is locked away under strict NDAs, which makes traditional portfolio-sharing tough, and I don't maintain standard social media accounts. But I know how to build clean, functional, scalable software that drives results. If you're looking to collaborate, need an engineering heavy-lifter for a SaaS project, or just want to swap freelance survival stories, let’s connect! What is everyone else doing to beat the market noise right now?

How I Supervise Three Engineering Workflows at Once Three Workflows, One Operator Right now, I have three engineering workflows open. One is under council review. Four AI roles are challenging an architectural proposal, and I will need to decide which objections actually change the plan. The second is already in implementation. That one does not need me at the moment. The specification is approved, the boundaries are clear, and the executor can keep moving. The third has come back from audit. The findings are valid, but corrective work is paused. A remediation plan exists, and someone other than the executor needs to review it before any more code changes. This is the part that still feels new: I can move between all three without reopening old chats and rebuilding the story in my head. A few months ago, even one workflow could take most of my attention. I carried context between every stage: rewriting role prompts, moving decisions between conversations, tracking the current document, and turning audit findings into the next round of work. The AI council itself was already useful. It produced strong reasoning and exposed assumptions I would probably have missed. But I was still the glue around it. The council improved the decisions. The system around it made those decisions easier to carry into implementation, audit, and correction without losing control. Conversations Were No Longer the Workflow The main change was simple to describe: I stopped treating the workflow as a series of conversations. Chats are good for thinking. They are not a good place to keep authority. Before this change, a decision might exist somewhere in a long discussion. The next agent had to interpret it, and I had to remember whether it was final, provisional, or already replaced. Now the state of the work lives in a small set of artifacts. Evidence becomes a source-grounded brief. Decisions become an approved specification. The specification becomes bounded implementation. The implementatio

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is free and source-available on Github. Star git-lrc to help devs discover the project. Do give it a try and share your feedback. You've been using the terminal for months/ years. Maybe you cd into a folder, ls around, run your script, and call it a day. That's fine. That's like knowing how to boil water and calling yourself a chef. But the terminal has layers . It's basically an onion that occasionally makes you cry, usually around 12 AM when a script fails silently and you have no idea why. So grab your coffee and let's talk about the command line tricks that actually make your life better. Not the "did you know ls -la shows hidden files" tier tips. Your Terminal Has A Memory. Use It. Most devs mash the up arrow like it's 2007 and they're trying to beat a Flash game. Stop that. Press ctrl-r instead. It searches your command history live. Type a few letters, it finds the last matching command. Press ctrl-r again to cycle back further. Found it? Hit Enter to run it, or the right arrow to drop it into your prompt so you can edit it first. ctrl-r ( reverse-i-search ) ` docker run ` : docker run -it --rm -v $( pwd ) :/app node:20 bash Pair this with ctrl-w (delete last word) and ctrl-u (nuke the line back to the cursor) and you'll start editing commands like you're speedrunning a text adventure. And if you're the type who types a whole essay of a command and then realizes you forgot something at the start, ctrl-a jumps to the beginning of the line and ctrl-e jumps to the end. No more holding the left arrow key like it owes you money. Pro tip: if you're a TUI fan and ctrl-r's default search feels a bit flat, check out McFly xargs Is The Friend Who Actually Shows Up Pipes ( | ) are great. They pass output from one command into another. But sometimes you don't want to pass output as input , you want to pass it as arguments . That's where xargs comes in, and once you get it,

Take on sand, snow, mud, gravel—this is the ebike for all your off-roading adventures.

Give your AI agents design taste from existing websites Discussion | Link

Whether it’s through Google Maps or Emergency SOS, there are plenty of ways to quickly let your loved ones know where you are.

Most apps that grew an "AI" feature in the last two years talk to one of a handful of cloud APIs, and almost all of them speak the same dialect: the OpenAI Chat Completions format. That one detail is the reason you can pull the cloud out and run the whole thing locally on a Mac without the app ever noticing. Here is the trick, why it works, and the gotchas that bite. The one interface everything agrees on OpenAI's /v1/chat/completions endpoint became the de facto standard. So when an app lets you "use your own key" or "set a custom base URL," it is almost always going to POST to {base_url}/chat/completions with a JSON body of messages and read back the same shape. It does not care what is on the other end, only that the response matches. Local runners leaned into this. Both popular Mac ones expose exactly that endpoint: Ollama serves an OpenAI-compatible API at http://localhost:11434/v1 (its native API lives on /api , but the /v1 path speaks the OpenAI dialect). LM Studio has a built-in server you switch on from the Developer tab, serving on http://localhost:1234/v1 . So "make this app local" usually reduces to: point its base URL at one of those, put any non-empty string where it wants an API key, and pick a model you have pulled. The 60-second version Ollama: brew install ollama # or the .dmg from ollama.com ollama serve & # server on :11434 ollama pull llama3.1:8b # pull a model once Confirm it speaks OpenAI: curl http://localhost:11434/v1/chat/completions \ -H "Content-Type: application/json" \ -d '{ "model": "llama3.1:8b", "messages": [{"role": "user", "content": "say hi in 3 words"}] }' If that returns a choices[0].message.content , any OpenAI-compatible client can use it. In the app, set: Base URL: http://localhost:11434/v1 API key: ollama (or literally anything; it is ignored) Model: llama3.1:8b LM Studio is the same idea with a GUI: load a model, toggle the server on, and use base URL http://localhost:1234/v1 . Pointing real tools at it The pattern shows up

If you've worked with OpenAPI for any length of time, chances are you've used Redocly CLI. It's one...

One of my favorite words in the startup and product-building world is pivot. For a long time, I thought a failed project meant wasted time. Today, I see it differently. Every project I worked on—even the ones that never gained users or reached the finish line—taught me something I couldn't have learned from books alone. They taught me how to validate ideas, communicate with users, make technical decisions, prioritize features, and, most importantly, when to change direction. I've come to believe that many successful founders didn't succeed because they had the perfect first idea. They succeeded because their previous attempts gave them the experience to recognize a better opportunity. In fact, I think that if many of them had started directly with the project that eventually made them successful, they might have failed. They first needed the lessons, the mistakes, and the discipline that came from building things that didn't work. I'm still on that journey. Some of my own projects didn't succeed the way I had hoped, but I don't consider them failures. They were investments in experience. Every project made me a better builder and helped me better understand what I want to create and how I should create it. One principle that keeps me moving comes from the Quran: «"Indeed, Allah will not change the condition of a people until they change what is within themselves." (Quran 13:11)» And another verse that reminds me to stay patient during difficult times: «"Allah does not burden a soul beyond what it can bear." (Quran 2:286)» If you're building something today and it isn't working, don't be afraid to pivot. Sometimes changing direction isn't giving up—it's applying everything you've learned so far. I'm curious: Have you ever pivoted a project? What did it teach you?

The most interesting model comparison of 2026 isn't a benchmark table. It's a product exec quietly changing the question everyone asks about models — and getting a completely different ranking as a result. Claire Vo (founder of ChatPRD, host of the How I AI podcast) ran a head-to-head between OpenAI's new GPT-5.6 lineup (Soul / Terra / Luna) and Anthropic's Claude Fable and Sonnet. The result was an upset: the most theoretically intelligent model, Claude Fable, lost to the one she could actually collaborate with, GPT-5.6 Soul. Here's what that upset actually reveals. She killed "vibes" — then bet 70% back on her own taste Tired of vibe-checking, Vo built a real benchmark across the work she does every day: writing PRDs, prototyping apps, debugging multi-step code, and talking to an agent. Scoring had two layers — an LLM-as-judge (she picked the harshest judge, GPT-5.5) and her own hand-graded "taste test," where she clicked through every artifact and wrote notes. Then the key move: she weighted the final score 70% her taste / 30% the machine. "It's my show. I trust my own taste more." That's the first insight. Benchmarks are getting more rigorous, but the final call is still human taste. The point of blind testing isn't to replace taste — it's to force it to be honest . Cover the labels, react to the work itself, then put your judgment back at the center. Theoretically brilliant vs. practically effective On raw intelligence, Fable is elite. But Vo's verdict is the sharpest line on models I've seen this year: Fable is theoretically hyper-intelligent. Soul is practically effective. She describes Fable as "an engineer who has never met a human." Precise to the point of pedantry — it scores every risk, hardens every edge. In one case it hardened a tool-calling loop so tightly that only one specific model could run it at all. It optimized itself into a corner. Soul's edge was the opposite: it gets out of its own head. Same stuck problem — she moved it to Codex, said "sto

As developers , we often face challenges keeping our workspaces perfectly synchronized across devices and collaborators. Whether it’s dealing with slow cloud sync, merge conflicts, or latency issues, these problems can disrupt our workflow and productivity. That’s why I’m excited to introduce OrBit , a local-first workspace synchronization engine designed to keep your development environments in sync with sub-millisecond latency — all while supporting offline work and peer-to-peer collaboration. What is OrBit ? OrBit is built around a multi-layered architecture that combines the power of Rust, Tauri, and VS Code to deliver a seamless synchronization experience: Rust-based local watcher daemon: Monitors file system changes with kernel-level events for ultra-low latency. Tauri-based native desktop dashboard: Provides a lightweight, secure, and cross-platform interface to manage your sync settings. VS Code extension: Integrates directly with your editor for smooth, real-time syncing of your code workspace. Unlike traditional cloud-based sync solutions, OrBit uses peer-to-peer connections and Conflict-free Replicated Data Types (CRDTs) to ensure your workspaces stay consistent even during network partitions or offline periods. Key Features Real-time sync with sub-millisecond latency: Changes propagate instantly across your devices. Offline support: Work uninterrupted without internet, with automatic merging when reconnected. Conflict resolution: CRDTs handle concurrent edits gracefully, preventing data loss. Native desktop and editor integration: Manage sync easily via the desktop app and VS Code extension. Peer-to-peer architecture: No heavy cloud servers required, enhancing privacy and speed. Why OrBit ? OrBit is designed for developers who demand speed, reliability, and seamless collaboration. It eliminates the frustration of slow syncs and merge conflicts, letting you focus on coding. Whether you’re working solo across multiple devices or collaborating with a team,

The Smartest AI Workflow I Have Ever Seen Ran on Three Pages of Prompt Project managers are quietly building their own AI chief of staff. The duct tape is the interesting part. A few weeks ago I was talking with a project manager who runs large industrial projects. Real ones, with safety officers and subcontractors and go-live dates that cost serious money when they slip. Somewhere in the conversation he mentioned, almost apologetically, a side project of his. Every week, he feeds an AI model his project charter, the project plan, the risk register, the action tracker, and the last six weeks of status reports. Then he adds the current week's meeting notes and any relevant emails. On top of all that sits a prompt he has iterated on for months. It covers three A4 pages in font size 10. Out the other end comes a list of specific open topics he needs to chase down before writing his end-of-week status report. He has a second prompt that helps him prepare sharp questions for the weekly team meeting. A third one, about 200 lines, assembles everything and drafts the status report itself. He even runs scenario checks: the safety officer found discrepancies during vehicle inspections, the subcontractor says compliance takes two extra weeks, does this move the critical path and the go-live date? He called it manual and clunky. I think it is one of the most sophisticated AI workflows I have ever seen a working professional build, in any field. And I have been building software for a long time. But he was right about the clunky part. And the reason it is clunky tells you almost everything about where AI in project work is actually stuck. The analysis was never the hard part Here is the thing he said that stuck with me, close to verbatim: The AI is good at analysing lots of text sources. The challenge is to obtain all the information, and the effort to write it down comprehensively. Read that again. The intelligence is not the bottleneck. The bottleneck is assembly. Every single

The request was eight words Monday morning. I open the outgoing email queue: six hundred and forty-seven drafts waiting, six hundred and seventy-two sent. Nobody clicks Send . First-contact emails are prepared by a pipeline and they sleep, because the last step assumes a human. That human, I had stopped believing she would have the time. I state the decision: automate sending . The response comes in seconds. Three levels of automation. Four channels. Three risk thresholds. All correct, all fit for a half-day architecture workshop. I had not asked for a workshop. Pauline walks behind me, glances at the screen, says nothing. Three timed reframes First reframe , brief: too strange, let's simplify . The agent drops two axes, keeps four residual layers, progressive warm-up over three weeks, deterministic anti-replay hash, configuration table in the database, manual Phase 1 followed by an automated Phase 2 to validate after two weeks of measurement. The target stays the same, that an email leaves without a human click. The path has grown accordingly. Second reframe , drier: simple, three safeguards, a kill-switch, we do this in one day . The agent re-architects, accepts the one-day target, keeps the three safeguards. But slips in three prostheses it calls industry standard : real-time dashboard, exponential retry, structured audit log in a new table. Each justifiable in isolation. None of them requested. Third reframe , shorter still: I don't understand why you're adding this . An opening line almost embarrassed, which I had never read from it before: "you're right, I'm over-engineering without necessity." And the version that should have arrived on the first round. A function that takes the draft record, checks three conditions, calls the send engine, returns. // lib/email-outbox.ts — generateFirstContactDraft (commit 3756e63) if ( ! EMAIL_REGEX . test ( input . email )) { return { success : false , error : ' email_invalide ' } } if ( BLACKLIST_EMAILS . has ( input . ema

PR volume went up, ticket quality didn't, and the gap got filled with LLMs on both sides of the review: bots reviewing, bots replying, bots occasionally arguing with bots about priorities that only existed in a teammate's head. Our CEO named the actual problem, and it's bigger than code review.

Learn how GPT-5.6 powers Microsoft 365 Copilot with stronger AI capabilities across Word, Excel, PowerPoint, Chat, and Cowork for faster, higher-quality work.

When people picture "coding," they picture fast typing and features coming to life. Nobody pictures the real majority of the job: staring at a stack trace or lets say a particular project trying to figure out why something that should work, isn't. Here's what nobody tells you starting out — getting good at debugging has almost nothing to do with how well you write code, and everything to do with how well you read. The real difference between beginners and experienced devs isn't complex knowledge — it's that experienced devs read carefully and form a hypothesis before touching anything. Beginners (me included) tend to skip straight to changing code and hoping. It feels faster. It rarely is. One thing i'd like to advise other fellow beginner devs is ....Slow down, read the error properly, and follow the stack trace to where it actually starts — not where it ends up. What's a bug that taught you this the hard way?