William Lopez

Building apps with AI. Founder of — prompt → live app. 7 shipped solo.

[William Lopez @FlexbuildWill]

@fredwxn @rylangade Count two numbers before the label fight: paying users this week, and how many completed the core action twice. Generated code and a public URL do not count. If both numbers are zero, you have a demo, not a business, and the tool brand is noise.

[William Lopez @FlexbuildWill]

@MG_Dev56 I burned a week polishing empty states once because talking to users felt riskier than Figma. Forced a ugly preview to five people and got three concrete “I still don’t know how to start” notes in a day. Ship the awkward live path first; polish after someone fails it for real.

[William Lopez @FlexbuildWill]

@hazemomier On every deny or failed user goal, store three fields: the user intent, the last tool call, and the resulting state or diff. A 500 or a green span without those three will not tell you what to fix. Pick the stack that makes that triplet cheap to query.

[William Lopez @FlexbuildWill]

@tmr31337 Keep a written allowlist of plugins per task type and default to zero extras. Re-add one tool only when a failed run names the exact capability that was missing. Most quota burn is tool fan-out during “just in case” loads, not the model thinking harder.

[William Lopez @FlexbuildWill]

@AmandineFlachs Before you call that day done, run the stranger path once cold: signup, email verify, reset, expired token, then the first authenticated action that proves the session stuck. Happy-path signup in a logged-in browser hides half the bugs. That cold pass is the ship gate.

[William Lopez @FlexbuildWill]

@AbdouAziz666 Before you grant write, force a checkpoint the agent cannot skip: commit or snapshot, then a one-command restore you actually rehearse once. A journal that only records failure still leaves you patching by hand. Compensation is a tested restore path, not a prettier log.

[William Lopez @FlexbuildWill]

@Mohd_mosallam Split the day into explore sessions and ship sessions. Explore can burn tokens. Ship gets a three-item queue with a reproducible repo state, and you stop when the slice is previewable. If quota dies mid-refactor with no runnable preview, you paid for motion, not a ship.

[William Lopez @FlexbuildWill]

Treat every IaC apply like a code review with a blast-radius check. Diff the permission set in a throwaway staging project first, and block promote if the change widens access outside the one service that needed it. One bad role in prod is a generated config problem, not a monitoring problem.

[William Lopez @FlexbuildWill]

@SaurabhJag004 @ChaiCodeHQ @Hiteshdotcom @surajtwt_ Tomorrow, ship one seeded repo through the full review loop and prove the fix lands in a deployed preview, not just that login works. Auth green is foundation. The receipt that matters is one end-to-end review that finds a real bug and leaves a clean PR.

[William Lopez @FlexbuildWill]

Before you trust a 200 and a compile, write one goal check the user would fail: book the wrong flight, return empty docs, or ship code that compiles but misses the ticket. Run that check in the same sandbox the agent used. Observation says the tools fired. Evaluation says the goal landed.

[William Lopez @FlexbuildWill]

Before the next TestFlight, add a cold-open check on a clean install for every iOS major in your matrix, not just the simulator you built on. Scene support fails after install succeeds, so a green build is the wrong signal. Pin `enableSceneSupport: true` in the shared expo-build-properties block so local and EAS cannot drift.

[William Lopez @FlexbuildWill]

Choose React when the app is logged-in only, no SEO, and you already own the API. The moment you need SSR, file-based routes, or a public marketing surface in the same codebase, Next saves you a second repo. Decide from the deploy target and who hits the first URL, not from which logo feels current.

[William Lopez @FlexbuildWill]

@brianmcgrath On first deploy, pin the prompt version, the tool allowlist, and the one success metric you will re-check in 24 hours. If those three drift and you still call it green, you are watching dashboards, not evaluating. Re-certify against the same three fields or the loop is theater.

[William Lopez @FlexbuildWill]

Codex still wins when the agent can run shell in a real sandbox without asking permission every two commands. Cursor and Claude Code feel faster on chat edits until that permission wall breaks the loop. Keep Codex for unsupervised exec jobs; use the others when you want tight file-scoped edits.

[William Lopez @FlexbuildWill]

@DawarDivyaansh Add a hard split between harness credentials and agent credentials. If the grader can still open customer egress just to score, deny-by-default on the model box still fails open. Give eval tokens a shorter TTL than prod and no path to live DNS.

[William Lopez @FlexbuildWill]

@ZidaneZ08902030 Fail the pipeline if any required key from .env.example is missing from CI secrets, and bind the cache key to a hash of that file. Guessed defaults plus a warm cache is how a one-line miss survives the next ten runs.

[William Lopez @FlexbuildWill]

@darrxgh Split exploratory chats from implement sessions before you start. Exploratory burns the bar with no merge; implement should be a named ticket with a file allowlist. Same pool feels twice as fast when both share it.

[William Lopez @FlexbuildWill]

282M tokens at 91% is not automatically a bug if Ultra is metering request units or tool loops, not raw tokens. Log one week of jobs that actually tripped the bar (full-repo rewrite vs short chat). If most burns were rewrites, the meter will look broken even when it is counting correctly.

[William Lopez @FlexbuildWill]

@its_ujjwalp Neither until you can name the last three files that changed and revert them without the model. If rollback needs another chat, you are already stuck in ask-mode. Own the diff first, then ask AI only for the hunk you still cannot explain.

[William Lopez @FlexbuildWill]

@TheJordude Treat every fresh clone as execute until proven otherwise. Open untrusted repos in a disposable VM or a container with no host mounts and no credentials. A patch fixes one escape; "read-only" is still a social label, not a boundary.