Coding agents ship UI they have never looked at.
Give yours eyes: after each change it runs Playwright, screenshots the page, reads the image back, and iterates until it matches.
Overlapping text and broken mobile layouts stopped reaching me.
A retried Stripe webhook double-charged an order in my ledger.
Stripe retries on any non-2xx. Your timeout counts.
Fix: insert https://t.co/GLpxc3zHDV with a unique index before processing. Duplicate key, return 200, do nothing.
Idempotency is a constraint, not an if.
Your users report almost none of your bugs. Your logs do.
The Friday loop:
1. Dump 7 days of 500s and unhandled rejections into one file.
2. Agent groups them by root cause, ranks by users hit.
3. It opens a branch for the top one.
Every week I fix a bug nobody told me about.
Genuine question
I've worked in the cyber security space for 4 years now and I'm curious to how much you focus on securing the apps you build?
How much focus do you have on it? Or will it be an afterthought if someone ever hacks you
Cached prompt tokens cost ~10% of fresh ones. Only if the prefix is byte identical.
Order every agent prompt:
1. Static first: system rules, specs, file tree.
2. Volatile last: today's task, diffs.
3. No timestamp at the top.
One changed char reprices everything below it.
An agent dropped a column in the same PR that stopped using it. The rollback took the data with it.
Every schema change is two deploys now:
1. Add, backfill, stop reading the old column.
2. Drop it a week later.
No DROP in a PR that touches app code.
Green tests from a coding agent prove nothing. A test written after the fix just describes the code, not the bug.
The rule I added: run every new test against the old code first. It has to fail. Only then may the fix turn it green.
Two lines in my agent spec. Fake passes gone.
An AI feature without a spend cap is a credit card with no limit.
A user looped my SEO agent 40 times in an hour. The bill landed before any alert did.
Fix: check a per-user token ledger before the call, not after. Over budget, it queues.
Caps belong in code, not dashboards.
My CLAUDE.md hit 300 lines and agents ignored half of it.
The fix:
1. Hard rules become hooks. Code can't be skipped.
2. Reference docs become skills, loaded on demand.
3. Keep only what every task needs. Under 50 lines.
Shorter file, better obedience.
Humans catch 13.6% of dangerous AI agent commands. Automated checks catch 89%. Same test, 1,053 people. We still approve 97% of permission prompts.
Clicking yes is not review. Do the review once, in config: allowlist routine commands, sandbox the rest, alert on denies.
Two AI agents editing the same repo will trample each other's diffs.
git worktree fixes it: one worktree per agent, own branch, own folder, same repo. Run them in parallel, review each branch, merge the winner.
I run 3 agents at once on my storefront. Zero conflicts.
Your coding agent reads .env like any other file. Every key in it lands in model context, and maybe in a transcript log.
The fix: agents work with placeholder secrets. Real keys live only in the deploy pipeline.
My agents ship daily. They have never seen a production key.
The cheapest SEO pages I publish start as support emails.
Weekly loop:
1. Dump the week's user questions in one file.
2. An agent drafts a page per question, answer in paragraph one.
3. Link each page to the feature it touches.
Real questions rank. Invented keywords compete.