Abdurehman Saleemi

I check AI-built SaaS before real users touch it: what could break, leak or get expensive, and what to fix first. Founder, Norvance · CEO, Texagon.

[Abdurehman Saleemi @arsaleemii]

Built a small open-source tool called “cc-budget” to bring some of that real-world engineering budgeting mindset into the workflow.

Seeing a lot of companies burn through their Claude Code tokens in just a few days.

LINK IN THE COMMENTS

[Abdurehman Saleemi @arsaleemii]

@ItsAbuzar_ @norvance_io True mate - lets gooo 🚀🚀🚀

[Abdurehman Saleemi @arsaleemii]

@ItsAbuzar_ i was shocked to see such mistakes and was even more surprised to find them hidden inside code

Non technical founders should to be very careful about launching AI built app

[Abdurehman Saleemi @arsaleemii]

@CleanFix_Dev indeed it is and also the issues around demo logins + things breaking down unexpectedly during production

[Abdurehman Saleemi @arsaleemii]

hi i'm saleemi

• from lahore, somehow ended up checking american founders' apps
• i run norvance
• people build with lovable / bolt / cursor, ship it, then strangers can see each other's invoices
• i check it as an engineer and tell you what breaks before real users do
• not a thought leader. more like the guy who ruins your launch week in a good way

built something with ai and about to put real people on it?

drop the url. i'll be mean for free once!

[Abdurehman Saleemi @arsaleemii]

@ItsAbuzar_ 🚀

[Abdurehman Saleemi @arsaleemii]

@wllsmi_ Congrats on shipping GetOvr, one thing I'd double-check before Plus goes live: those private chats and journals are the most personal thing people will ever type into your app. If a stranger ever saw someone else's match thread or check-ins, trust is gone overnight!

[Abdurehman Saleemi @arsaleemii]

@gyndok really liked that door codes stay locked until the walk starts. Curious how you handle a walker who leaves midweek. Does their access to past visits and codes go away the same day?

[Abdurehman Saleemi @arsaleemii]

A founder's app got hacked last week. 35,000 user profiles, deleted. In his own words, he'd left his database open so anyone could delete everyone.

On Friday, Supabase (the database behind a lot of Lovable and Bolt apps) stops leaving new parts open by default. What you've already built stays as it is.

Would you even know where to look in yours?

https://t.co/O3t9fvzAvh

[max @MaxHirsch13]

My app got hacked last night and 35,000 profiles were wiped. Here’s what happened / how to prevent it:

I bypassed RLS with a view so users could see each other's profiles, and didn't revoke Supabase's default anon permissions, so the public key could delete everyone through it (a truly awful rookie mistake from me).

Here’s a prompt so this NEVER happens to you:

Audit my Supabase project for security holes. Assume the anon key is public and anyone can call my REST API with it, logged out or with a free account. Check and fix:

1. Every table in public has RLS enabled, and every policy scopes rows to auth.uid(). Flag any policy that is just "true", especially on INSERT, UPDATE or DELETE.
2. Every view: is it security_invoker = true? Can anon or authenticated INSERT, UPDATE or DELETE through it? Revoke write grants on all views.
3. Revoke delete and truncate on all tables from anon, and set alter default privileges so new tables don't get them.
4. List every ON DELETE CASCADE from user tables and confirm that nothing a client can delete cascades into data it shouldn't.
5. Every security definer function: who can execute it, and does it trust a user id passed as a parameter instead of auth.uid()?
6. Every profile column that grants access (pro flags, trial dates, roles, admin) can only be changed by the server. Add a trigger that ignores client writes to those columns.
7. Every API route: it reads the user from the verified JWT, never from the request body, and checks ownership before reading or writing.
8. Crons and webhooks fail closed when their secret is missing, and webhooks verify signatures.
9. No temporary auth bypasses, hardcoded keys or guessable passwords.
10. Add a safety net: limit deletes per request on key tables, keep an audit copy of deleted rows, alert when row counts drop, and confirm backups work.

For each finding, show the exact SQL or code fix and explain what an attacker could do today. Then run Supabase Security Advisor and fix everything it reports.

[Abdurehman Saleemi @arsaleemii]

@antariksakita @grok which phone is this

[Abdurehman Saleemi @arsaleemii]

@MattPRD @Muse Neeed it mate

[Abdurehman Saleemi @arsaleemii]

@MrAhmadAwais @CommandCodeAI @realaliarain Got you - will move to provider api then but thanks for the information 🙌

[Abdurehman Saleemi @arsaleemii]

Forked t3 code - added @CommandCodeAI as a provider and now will be working next few days to make it more stable, support skills and other stuff.

Maybe integrating the taste learning popup that appears when we command code first time inside any codebase

Source code: https://t.co/hVM8wzFQT5

@MrAhmadAwais what do you think about this idea mate?

[Abdurehman Saleemi @arsaleemii]

@realaliarain @MrAhmadAwais @CommandCodeAI Sure mate, thanks i am on it @realaliarain

[Abdurehman Saleemi @arsaleemii]

Ah, no not the official provider api instead the headless mode of the command code. just wrote an adapter that:
- Launches command-code as a child process.
- Uses headless mode with -p --output-format json.
- Sends the user prompt through stdin.
- Reads Command Code’s JSON/NDJSON events from stdout.
- Converts those events into T3’s canonical messages, reasoning items, and tool-call items.
= Uses Command Code’s session ID with --resume for subsequent turns.

[Abdurehman Saleemi @arsaleemii]

@CommandCodeAI Opened an issue on official repo to get this listed: https://t.co/p2lkIiqflS

[Abdurehman Saleemi @arsaleemii]

@CommandCodeAI Listed command code in the providers list as well

[Abdurehman Saleemi @arsaleemii]

the fact that gemini 3.1 pro, opus 4.7 and gpt 5.5 are so close doesnt make sense (from gemini 3.1 pro perspective)

also 0.1% difference in 5.4 mini (a smaller model) and 3.1 pro (a significantly larger model) speaks a lot

[Cognition @cognition]

Introducing FrontierCode: a coding eval that raises the bar for difficulty & quality. Each task took 40+ hrs of work by leading open-source maintainers.

Models write sloppy code that works but isn’t maintainable. Our eval is first to measure: would you actually merge this code?

[Abdurehman Saleemi @arsaleemii]

Most people still think AI agents = terminal + setup hell.

Hermes Desktop changes that.

You install it like a normal app.
That’s it.

Now imagine this:

* an agent running on your PC 24/7
* message it from WhatsApp/Telegram/Discord
* ask it to research things while you sleep
* wake up to generated docs, spreadsheets, reports
* let it edit local Excel/files on your machine
* run scheduled tasks every morning automatically

The crazy part?

It’s open-source.
And you can login using your ChatGPT account.

I’m honestly thinking of forking it and connecting it to my Gmail so every morning I only get the most important emails summarised for me.

Feels like the first AI agent setup normal people might actually use.

Great tool by @NousResearch