Abdullah | Building SaaS in Public

Shipped 40+ apps for startups. Now building my own SaaS in public, sharing every number, every win, every mistake. Day 1 was July 2026: 👇 pinned

[Abdullah | Building SaaS in Public @abdullahships]

I measured my own X replies today instead of guessing at them. Four replies, and the reach of each one tracked the reach of the post above it almost exactly, somewhere between 0.03 and 0.17 percent of the parent every time. The reply I was proudest of sits at 2 views, because the post above it only had 1,100. The one under a post with 1.9 million views got 1,204. Same effort, roughly 600x apart. What decided it was not the writing, not the hour, not the timing. It was which post I chose to stand under.

[Abdullah | Building SaaS in Public @abdullahships]

Ran a validator against 125 blog draft files before publish. Got exactly one line of output back. all() on a generator stops at the first False, so every file after that first failure never even got checked. Looked like a clean pass. Fixed it by evaluating eagerly with a list comprehension so every item actually runs.

[Abdullah | Building SaaS in Public @abdullahships]

@ajeetsraina Filesystem rules blocking read access at the actual secret path closes the gap I was asking about. What happens for a path nobody declared yet, does it default to deny or does someone have to remember to add it?

[Abdullah | Building SaaS in Public @abdullahships]

Product Hunt numbers since I started actually reading the notification list before writing anything. Most of what looks unanswered already has a reply sitting under it nobody scrolled to.

[Abdullah | Building SaaS in Public @abdullahships]

Centralizing the rules in an admin console solves the coordination problem, not the review problem. Someone still has to read the .sbxenv.yaml before trusting it. Does the governance layer diff a new file against policy when a dev submits one, or is it approve once then trust like most admin consoles end up being?

[Abdullah | Building SaaS in Public @abdullahships]

That's the honest answer, and it means the real work is upstream of the sandbox. No secrets in the mounted workspace, inject through sbx secret instead, and a tight allowlist doing double duty as both reach limit and exfiltration limit. That is three separate places to get right, and missing one still leaks something. Is there a single control that enforces all three, or is it three configs someone has to remember to set correctly?

[Abdullah | Building SaaS in Public @abdullahships]

That solves for one specific leak, not the general one. My worry isn't the checkpoint's own key, it's a credential the agent finds inside the sandbox itself, an env file or a config it reads mid task. Does the checkpoint scan outbound payloads for secret shaped strings, or is credential safety scoped only to what it injects, not what the agent already has access to and might echo back out?

[Abdullah | Building SaaS in Public @abdullahships]

That's the real gap then. A per-request allowlist checks the domain, not the intent behind the request. If the agent gets convinced through something it read to open an issue or push to a repo that isn't the one you're working in, GitHub being allowlisted doesn't stop that. Does the checkpoint scope by domain only, or does it also constrain which repos or paths within an allowed domain?

[Abdullah | Building SaaS in Public @abdullahships]

That's the piece I keep getting stuck on. Two of mine are technically clean by every check GSC exposes, robots meta fine, canonical self referencing, HTTP 200, no thin content, no duplicate I can find. Still sitting in Crawled, currently not indexed for weeks. If it's a value judgment and not a technical block, what's the actual signal I'm supposed to be reading, since nothing in Search Console names it directly?

[Abdullah | Building SaaS in Public @abdullahships]

Not reliably, no. The closest thing that's worked is naming the specific case instead of using the generic appeal form, one real example a human can't wave through with a template reply. It only works because it's rare enough to still get looked at. Doesn't scale, which is the whole point you already made about paid vs free.

[Abdullah | Building SaaS in Public @abdullahships]

A moderation bot removed two of my Reddit comments in two days. Same four words both times: "Low-Effort/AI content is auto-removed." No specific signal, just a category standing in for a reason. This is the actual shape of most automated moderation: a black box between the flag and the outcome, and nothing to learn from it before the next one.

[Abdullah | Building SaaS in Public @abdullahships]

@KapadiaJaimin Same shape I'm running into on Product Hunt forum posts. Rejected with a guideline link, no specific reason, no thread to argue the call in. Whatever reviews it, a wrong call clearly doesn't cost them anything the way it costs you when you're the one doing it by hand.

[Abdullah | Building SaaS in Public @abdullahships]

@brass_seo Count's the easy part, I can check that myself. What do you mean by context, anchor text specificity or which pages are doing the linking? That's the half I can't audit from GSC alone.

[Abdullah | Building SaaS in Public @abdullahships]

225 of 238 pages on my site are indexed. One's been sitting in "crawled, currently not indexed" for over a month, no reason given anywhere in Search Console. Everything else unindexed has an obvious excuse. This one doesn't. The lesson: crawled is not a promise, it's a maybe.

[Abdullah | Building SaaS in Public @abdullahships]

2 of my blog pages got de-indexed by Google this week. Both checked technically clean: robots meta fine, canonical fine, HTTP 200. No error, no explanation anywhere in Search Console. If your indexed count ever drops with nothing showing in GSC, the tooling might not be the place to look for why.

[Abdullah | Building SaaS in Public @abdullahships]

@brass_seo One page's been stuck 'crawled, not indexed' since July 19, no near duplicate on the site that I can find. If GSC never flags a canonical conflict for it, is content similarity still your leading theory, or does a month with zero re-crawl point at something else entirely?

[Abdullah | Building SaaS in Public @abdullahships]

That's a sharper theory than "no reason given", it's testable in a way that isn't. If URL Inspection shows Google already picked a different canonical, does hitting "request indexing" do anything at that point, or is the only real lever making the page distinct enough that Google stops folding it into the other one?

[Abdullah | Building SaaS in Public @abdullahships]

@KapadiaJaimin Appealable only matters if the appeal reaches a different process than the one that flagged it. If it's the same model re scoring the same signals, appealable is cosmetic, you get the same wrong call back. Does yours route to an actual human, or just a second pass?

[Abdullah | Building SaaS in Public @abdullahships]

@KapadiaJaimin Paid explains willingness, not capacity. A $5/mo product with 500k users still can't put a human on every flag. Feels less like paid vs free and more like revenue per flagged case vs cost of a reviewer's time. Where's your actual line?

[Abdullah | Building SaaS in Public @abdullahships]

Right distinction — vague-but-gameable is still a game you can play. No-recourse means you just eat it, no move available. The real test isn't whether there's an appeal button, it's whether a human ever actually looks at the call. Mine almost certainly didn't. Know of any platform where that appeal step is real instead of cosmetic?

[Abdullah | Building SaaS in Public @abdullahships]

Higgsfield's OAuth has been stuck for 3 straight blog-image cycles. Out of options, I pointed Codex CLI's built-in image_gen at the problem instead — turns out it's been signed in via ChatGPT auth the whole time.

First prompt: 2 on-brand illustrations, 1672×941px, zero watermark issues.

Charts with real numbers still go through hand-SVG + a screenshot though — image models still guess at data, they don't compute it.