security has been a good reminder this week that the biggest problems aren't always in your application code.
a few things stood out to me:
eMudhra: Weak private keys in intermediate certificates raised serious concerns about HTTPS trust. Updating browsers alone may not be enough if your tools or containers use separate certificate stores.
PHP: Critical bugs can put a server at risk before your application code even gets a chance to protect itself. Keep the runtime patched.
Node.js: Runtime security updates matter too. Updating npm packages doesn't automatically update the Node.js version running in production.
The common lesson?
Your app can be perfectly fine, but the software underneath it might still be vulnerable.
If you're running production services, take a little time to:
-Check security advisories for your runtime
-Update certificate stores and rebuild outdated images where needed
-Rotate exposed credentials
-Review what is actually running in production, not just what your local machine has installed
One thing worth remembering: security isn't a one-time task you finish before launch.
It's part of maintaining a product.
And ignoring updates because everything seems to be working is a risk that isn't worth taking.
It's appealing to build a feature because a competitor has it.
They have analytics, so you add analytics.
They have AI, so you add AI.
They have a dashboard, so you build one too.
But you don't know why their users need those features.
Maybe their customers asked for them.
Maybe they're solving a completely different problem.
Maybe the feature isn't even being used.
I'd rather talk to a few actual users before spending a week copying something.
A longer feature list doesn't automatically make a better product.
People usually see the final product, not the random bugs, bad decisions, and hours spent figuring out why something isn't working.
that's most of my week building https://t.co/8TLzlRLfAT.
some days progress looks like a new feature. Other days, it's fixing one annoying issue.
both count, I guess.
ShipNLaunch was a pretty small idea when I started. now it has submissions, moderation, product pages, weekly discovery, voting search, categories, maker profiles and sponsorships. still plenty I want to change. but it finally feels like a product instead of a folder on my laptop
15 product launches in a single week on https://t.co/8TLzlRKHLl 🤩
and we've now crossed 3k+ visitors! when I started building this, I wasn't sure how quickly things would move, so seeing this progress feels pretty special.
a few milestones along the way:
Sharing the journey and learning in public
Growing from 2k+ to 3k+ visitors
Seeing more makers bring their products to the platform
there's still things to fix, improve, and figure out. But it's encouraging to see people finding ShipNLaunch and using it to launch their work.
Now the focus is on getting more eyes on the platform through SEO, social media, and community building.
One step at a time. The next milestone is waiting.
X is full of incredibly talented people, but most of them don't take content seriously
there are hundreds of ways to monetize your audience, and it only takes 1-3 hours a day to start building one
someone who's half as good as you but knows how to get attention will probably make 10x more money than you
something to think about.
Your website is live. Here is what to check BEFORE spending a single dollar on SEO:
1. Open Google Search Console and verify your domain.
2. Submit your sitemap.
3. Check that important pages return a 200 status.
4. Make sure robots.txt isn’t blocking indexing.
5. Verify canonical URLs.
6. Give every core page a distinct title.
7. Add internal links to priority pages.
8. Test the site experience on mobile.
9. Audit and fix broken links.
10. Check PageSpeed Insights performance.
Don’t expect rankings overnight. The point is to fix basic technical blockers before paying for traffic or SEO campaigns.
Bonus: Most of these checks are completely free.
Save this for your next website launch.
If your site works on desktop, that does not mean it works.
Test the actual flows on a phone:
Open the homepage.
Search for something.
Create an account.
Submit a form.
Read the pricing page.
Open a dropdown.
Tap every important button.
Try a long piece of text.
Look for the stuff developers miss on a big monitor:
tiny buttons
horizontal scrolling
menus that are hard to close
inputs covered by the keyboard
images pushing content around
slow pages on mobile data
I regularly find small issues this way on https://t.co/8TLzlRLfAT.
You don't need a perfect mobile redesign for every screen.
You do need the important actions to feel normal.
A user should not need to pinch, zoom and fight the UI just to finish one task.
Every developer eventually discovers that “quick change” is a dangerous phrase.
“I'll just change this one thing.”
3 hours later:
https://t.co/vrRYD6qK8L now has a completely different problem
If your site works on desktop, that does not mean it works.
Test the actual flows on a phone:
Open the homepage.
Search for something.
Create an account.
Submit a form.
Read the pricing page.
Open a dropdown.
Tap every important button.
Try a long piece of text.
Look for the stuff developers miss on a big monitor:
tiny buttons
horizontal scrolling
menus that are hard to close
inputs covered by the keyboard
images pushing content around
slow pages on mobile data
I regularly find small issues this way on https://t.co/8TLzlRLfAT.
You don't need a perfect mobile redesign for every screen.
You do need the important actions to feel normal.
A user should not need to pinch, zoom and fight the UI just to finish one task.
1. Never stop exercising or learning.
2.Accept compromise to begin relationships.
3. Manifest the power of compounding.
4. Never gamble.
5. Have kids and be a good parent
6. If it flies or floats, rent it.
7. Buy half the house you can afford.
8. Art in the eye of the beholder is cheap.
9. Be thankful for and to all.
10. Be charitable.
there's a point in every project where the exciting features are mostly done and the boring work starts.
SEO.
UX.
Edge cases.
Empty states.
Performance.
that's basically where https://t.co/nlui67p5yl is getting more interesting for me.
I'm starting to think the best launch directories aren't the ones with the most submissions.
They're the ones where the submissions actually help people discover something useful.
That's the standard I want https://t.co/nlui67p5yl to reach.
Most people think a 404 page is something like:
“Oops! This page doesn't exist.”
Done.
But there is a better version.
Tell the user what happened.
Give them a way home.
Add search if your site has it.
Link to useful pages.
More importantly, find out why the 404 happened.
Did you change a URL?
Did you remove a page?
Is an internal link broken?
Is another website linking to an old URL?
For important old pages, a redirect may be the better answer.
This becomes especially important as a SaaS grows because URLs multiply quickly.
More products.
More docs.
More blog posts.
More landing pages.
A little URL mess today can become a big SEO cleanup later.
ABSOLUTELY SHAMELESS.
Julia contacted me to work for @yourpersona and mentioned they were looking to hire full-time.
After our call, she took many days to reply. I assumed she was busy, so I let time pass.
Then she came back with a project and said:
“We changed it to make it easier and less time consuming. To preface, it won’t be paid (I wanted to be clear, since I mentioned that in our last call), since we just want fast work so we can speed up the hiring process. We love your work!”
Two things:
1. She never mentioned it wouldn’t be paid on our last call, but I didn’t think much of it.
2.She said she wants to speed up the hiring process.
I worked hard on the project. It took me 2-3 hours, on top of a 24-hour deadline for another client, because I wanted to make a good first impression. I submitted it and waited. I knew I did well, and I was confident my designs were better than anyone’s.
I waited patiently for days. Then she sent this:
“Hey, I have an update! The team thinks you’re a great designer and we would love to work with you, we’re just a little too early to expand right now. We’d love to stay in touch and reconnect in a month or two! I’ll hit you up then :)”
Mind you, she said they wanted to hire fast. Now they’re “a little too early to expand”? And she went on to post this engagement farming post.
Why is she posting this when she’s already “found” me? The team supposedly thinks I’m great and would love to work with me.
I contacted a few friends here on X who have viral posts like mine. They got the exact same message from her.
If you’re not ready to expand, why ask for a free trial and promise a full-time role? And why are you now shamelessly posting this to get people to do more free work and hand over more free ideas for your app?