Shaikh | Ship With Agents

• Building SaaS from scratch using AI coding agents. 🛠️
• Documenting the entire journey—wins, failures, and real numbers. 📈
• Zero to launch. Let's ship.👇

[Shaikh | Ship With Agents @ShaikhBuilds]

I'm starting from zero.

I don't know how to code, how to build SaaS, how startups work.

So I'm going to learn by actually building.
I'm using AI coding agents to see how far one person can go.

I'll share the wins, failures, lessons and numbers.

Day 1 starts today. 🧵

[Shaikh | Ship With Agents @ShaikhBuilds]

@GergelyOrosz Don't worry, management is on top of it. They're planning a 6-month initiative to form a committee that will eventually draft a mandate for a token leaderboard. Just hang tight and definitely don't do anything autonomous while they figure it out.

[Shaikh | Ship With Agents @ShaikhBuilds]

@Mubbi_sk If the 'AI developer' actually understands the code, can debug it, and delivers 3x faster... aren't they just a senior developer using better tooling? It’s about leveraging efficiency.

[Shaikh | Ship With Agents @ShaikhBuilds]

I thought I was ready to test the password-recovery fix.

Then Supabase returned HTTP 429.

The latest test was rate-limited before I could verify whether the PKCE change worked.

No more repeated emails. I'll wait for the limit to reset and run one controlled test.

[Shaikh | Ship With Agents @ShaikhBuilds]

@StacySchulphks Jake is about to try and copy your entire business model now, isn't he? 😂

[Shaikh | Ship With Agents @ShaikhBuilds]

@paul_spala Well said, Paul. That false positive is exactly what makes debugging PKCE issues so frustrating. Appreciate you sharing that perspective!

[Shaikh | Ship With Agents @ShaikhBuilds]

I learned something new about Supabase PKCE today.

A verifier cookie can exist and still be the wrong verifier for the authorization code.

Presence isn't proof of correctness.

That one distinction changed how I approached debugging InvoiceFlow's recovery flow.

[Shaikh | Ship With Agents @ShaikhBuilds]

@Mubbi_sk Syntax is Googleable. Problem-solving and algorithmic thinking are not.

[Shaikh | Ship With Agents @ShaikhBuilds]

Today's debugging lesson:

A password-reset email arriving doesn't mean password recovery works.

Delivery, link verification, PKCE exchange, and session creation are different steps.

I used to see one error page. Now I'm learning to find the exact stage that fails.

[Shaikh | Ship With Agents @ShaikhBuilds]

Day 16 building InvoiceFlow in public.

Today I traced a password-recovery failure to a PKCE bad_code_verifier error, implemented a recovery-only flow-ID change, and passed lint + TypeScript checks.

Still not fixed end to end.
Next: test properly.

This is part of the build.

[Shaikh | Ship With Agents @ShaikhBuilds]

Day 15 recap:

• Found a Supabase 429 during password recovery
• Confirmed reset emails can arrive
• Recovery links still fail at the callback
• Asked the coding agent to investigate before edits

No fake “shipped it” update today. Just the next debugging step.

[Shaikh | Ship With Agents @ShaikhBuilds]

Build-in-public isn’t just posting wins.

Sometimes it’s showing the bug, reading the logs, and resisting the urge to make five changes at once.

Day 15: recovery flow still broken. Next step: inspect, understand, then fix.

[Shaikh | Ship With Agents @ShaikhBuilds]

@hiii_firoj Great work..More to come Inshallah..♥️

[Shaikh | Ship With Agents @ShaikhBuilds]

Today’s reminder: a working login screen is not the same as secure multi-company access.

InvoiceFlow still needs company-scoped permissions and RLS work. I’m not calling tenant isolation “done” until it’s tested.

[Shaikh | Ship With Agents @ShaikhBuilds]

Quick question for freight, AP, and invoice-processing teams:

When an invoice is flagged for review, what usually happens next in your workflow—spreadsheet, email thread, ERP note, or another tool?

I’m researching the real process before building more into InvoiceFlow.

[Shaikh | Ship With Agents @ShaikhBuilds]

@Mubbi_sk It's always a typo. Always.

[Shaikh | Ship With Agents @ShaikhBuilds]

@taylorotwell Learn more, build more, ship more... sleep less. 😅

[Shaikh | Ship With Agents @ShaikhBuilds]

@ogxaryan Spot on, Raj. Separating identity from membership early saves massive migration headaches down the line. Appreciate the wisdom!

[Shaikh | Ship With Agents @ShaikhBuilds]

SaaS founders: What’s one security or architecture decision you wish you’d made earlier?

I’m building InvoiceFlow and mapping out multi-tenant access control before adding database-heavy features.

Drop your hard-earned wisdom below 👇

[Shaikh | Ship With Agents @ShaikhBuilds]

Debugging rule I’m trying to follow: stop guessing when the logs can narrow it down.

InvoiceFlow’s recovery request returned HTTP 429. The link then failed with otp_expired.

I’m asking my coding agent to inspect the flow before approving any fix.

[Shaikh | Ship With Agents @ShaikhBuilds]

Beginner lesson from today: “The email arrived” doesn’t mean “password recovery works.”

The link still has to survive the callback, token exchange, and session handling.

I’m learning to test the whole flow—not just the first step.

[Shaikh | Ship With Agents @ShaikhBuilds]

Day 15 building InvoiceFlow.

Today wasn’t about shipping a shiny feature. I traced a password-reset failure, found Supabase returning 429, and confirmed the recovery link still fails.

Next: inspect the callback before changing more code.