CodeWithStu

Shipping apps in public. Real traffic, real bugs and the fixes, from @onehausapp + @mcpscores. Plus dev tips I'd want someone to tell me

[CodeWithStu @CodeWithStu]

Hey hey 👋 Lots of new people recently, so let's get to know each other

I'm Stu. I'm a principal engineer who has spent years at places like Checkout and ClearBank. Whilst I'm building my future, I share interesting things and what I learn on the way

What are you working on?

[CodeWithStu @CodeWithStu]

Silently dropping from 20x tier to 10x tier is not great at all. It's almost getting to a point where an open harness and a fleet of open weight models because a better option...

[Claude @claudeai]

We’re renaming our Max plans:

Max 5x → Max
Max 20x → Ultra

Max is still $100/month, and Ultra is still $200. If you’re a subscriber, there’s nothing you need to do.

We’re also removing the 5-hour limit for verified Ultra accounts, starting today with most existing subscribers. Newer accounts keep a temporary limit until they’re verified, which helps us prevent fraud and abuse. You'll get an email when it's removed.

Weekly limits remain unchanged. View our plans here: https://t.co/niRpyGF5Me

[CodeWithStu @CodeWithStu]

Starting something new for mobile devs, based on my own pains

Honestly tired of stitching together a load of platforms for every app I build

[CodeWithStu @CodeWithStu]

Small one if you're building a sign-in code screen. Use one input with autocomplete="one-time-code" and style it as six boxes, rather than six separate inputs

Six inputs looks the same but paste and autofill usually end up half broken. Just did it this way on the new project's sign-in pages and it's so much nicer :)

[CodeWithStu @CodeWithStu]

@ayaboch Grok bot has been solid. no complaints so far (in uk)

[CodeWithStu @CodeWithStu]

https://t.co/RUQbBakFlJ

[CodeWithStu @CodeWithStu]

TIL about Datadog's pathfinding project. It documents pretty much every known AWS IAM privilege escalation path, what permissions each one needs and how to spot it

Honestly worth a look if you touch AWS at all

[CodeWithStu @CodeWithStu]

@raroque I have a super low end device if you need another device for testing

[CodeWithStu @CodeWithStu]

@bas_fijneman Nice nice!! Anything we can share a sneak peak of?

i’m just cooking away, starting a new project so i can port OneHaus across to it. So just in that exciting early stage part :) will launch the homepage and start posting later this week hopefully

[Chevy Phillip @chevonphillip]

Connecting to an MCP server can be enough. Two MCP Inspector advisories, Oct 21:

- Server-chosen OAuth URL runs as PowerShell on Windows/WSL (high; fix 2.12.0)
- OAuth callback flips transport to stdio, runs a local command (critical; fix 1.0.3)

Do you vet MCP servers first?

[CodeWithStu @CodeWithStu]

Nice summary of my project @MCPScores - thanks :)

[エクシードシステム(Y.Sakamoto) @exceedsystem]

MCPサーバーの安全性を自動検証して信頼度をスコア化するサービス「VerifyMCP」がすごい😲

約4.8万のMCPサーバーを解析し、セキュリティや信頼性を100点満点で可視化できる👀

・MCPサーバーへの実接続/動作確認
・ツール定義/スキーマの検証
・TLS証明書/OAuth認証のチェック
・依存パッケージの脆弱性スキャン
・サンドボックス環境でのパッケージ検証
・毎日の再スキャン/信頼スコア更新

スコアだけで安全性を保証できるわけではないけど、MCPも機能だけでなく信頼性を確認してから導入するのをおすすめ。

https://t.co/8QBAOPU9Qe

[CodeWithStu @CodeWithStu]

@MCPScores The study if you're curious, 6M posts and accounts under 1k followers actually got more views on link posts https://t.co/ADeLtPwUzu

[CodeWithStu @CodeWithStu]

TIL putting links in a reply instead of the main post isn't really a thing anymore. X said in July you don't need to bother

Updated @mcpscores now to see if this holds true

[CodeWithStu @CodeWithStu]

@tarasshyn Also, not everyone can create software that scales. handling a few hundred requests/sec is trivial, going to thousands and beyond becomes somewhat more complex. In some aspects could != should

[CodeWithStu @CodeWithStu]

@GeoffreyHuntley @bot dr eggbot is great. Followed your recommmendation as i started fresh with grok bot - it’s really good. Just told it what i wanted to do and various things got hooked up. First time a bot felt good to use

[CodeWithStu @CodeWithStu]

The "best household management apps 2026" post is still the second most visited page on onehaus, behind only the homepage

People starting the free cleaning schedule tool went up about 65% this week too. Slowly starting to get why everyone says just keep writing content :)

[CodeWithStu @CodeWithStu]

Finally merged my staging to main PR for onehaus. It'd been open since 26 Sep and closed 278 issues 🙈

Note to self, maybe don't leave it a month next time

[CodeWithStu @CodeWithStu]

Building verifymcp has been way harder than I expected. Every MCP server gets scanned from a clean slate, so that's a full package restore every single time, across thousands of servers, on a pretty small box

CPU sat at 60-70% for days. A few changes later (caching, fewer retries, only rescanning when a package actually changes) and I think it's finally under control 😅

[Dan Patrascu-Baba @danpdc]

I honestly can't remember another week quite like October 14–21 in software security.

Just between October 14 and October 21:
- Next.js patched two critical RCE vulnerabilities (9.5/10).
- NGINX patched five security vulnerabilities.
- PHP disclosed critical RCE vulnerabilities. AWS observed exploitation attempts four days before disclosure.
- Node.js patched multiple vulnerabilities, including potential RCE and TLS validation bypasses.
- GitLab disclosed another 10/10 vulnerability allowing potential unauthenticated RCE.
- LiteLLM's compromised releases distributed credential-stealing malware.
- Railway disclosed a potential exposure of customer secrets and API keys.
- OpenCode reported a breach affecting 1.4% of its Console users.
- eMudhra had eight trivially recoverable certificate authority private keys. One of them was literally the number 4!

Also, Microsoft reported AI-orchestrated attacks targeting over 2,250 Microsoft 365 tenants, with attackers obtaining privileged access in under three hours in multiple cases.

CrowdStrike documented AI agents conducting real-world intrusions, including one that obtained domain-controller credentials in approximately 20 minutes without further human guidance.

Meanwhile, Cloudflare observed PHP exploitation attempts growing to millions within hours of disclosure. Some of the attacks even started before any public disclosure, which shows that malicious actors have ways to get to the important information way before any organization does.

All of this obviously made me think about what this means for engineering organizations.

For years, we've treated vulnerability management as something that happens periodically. We review advisories, create tickets, plan upgrades, and eventually deploy patches. Sometimes days later, sometimes weeks, and quite often months or even years.

That's not going to work anymore and technical decision-makers will need to fundamentally rethink how their organizations approach security.

Continuous monitoring, immediate exposure assessment, automated mitigation, credential rotation, and rapid patching need to become standard engineering capabilities.

We need to start measuring our security response times in minutes, not days, weeks, months, or years.

[CodeWithStu @CodeWithStu]

Last night I got Grok Bot to sort through my emails and it cleared over 11k and organised the rest for me. Honestly impressed

Far easier to set up than it was with Hermes