CodeWithStu

Shipping apps in public. Real traffic, real bugs and the fixes, from @onehausapp + @mcpscores. Plus dev tips I'd want someone to tell me

[CodeWithStu @CodeWithStu]

Hey hey 👋 Lots of new people recently, so let's get to know each other

I'm Stu. I'm a principal engineer who has spent years at places like Checkout and ClearBank. Whilst I'm building my future, I share interesting things and what I learn on the way

What are you working on?

[CodeWithStu @CodeWithStu]

Postgres doesn't index your foreign keys for you. The parent side has its primary key, but the column on the child table is on you

I added a test to the new project that reads the catalog and fails if any foreign key doesn't have an index starting with its columns. It found 13 :(

Without them, deleting means full table scans

[CodeWithStu @CodeWithStu]

@Bagdex My latest experience is:
- Wait a week after updating the app with localisation
- Get rejected because I forgot to submit the localisation on subscriptions (fair)
- Submit and get approved
- Resubmit app and it gets rejected again for the same reason

[CodeWithStu @CodeWithStu]

@GMFinX @Danhybridfit Waltham forest average is £100/day per child for nursery xD

[CodeWithStu @CodeWithStu]

Programmatic SEO can bring in a surprising amount of traffic. onehaus usually sits around 100 visitors a day. Yesterday it hit 183, with 124 from Google, and most of those landed on one holiday page for Ireland because of the bank holiday.

Installs didn't move though (6). So the pages work for discovery - turning that into people who actually install the app is a completely different problem

[CodeWithStu @CodeWithStu]

Before letting Claude write a single migration for the next project, I had it design the feature list and ICP first, then document those. Only after that did we move onto the data structure, then scheduled jobs

Then I asked Fable subagents three things: is anything missing, does everything earn its keep, and have we overcomplicated anything. Same prompt also said to drive out any ambiguity

Setting the right foundations for a project lets you build faster. And those foundations need to be tied to your ICP

[CodeWithStu @CodeWithStu]

Dr Eggbot: https://t.co/lQzPjOnklI

[CodeWithStu @CodeWithStu]

How I set up a small team of Grok Bots without it turning into a mess

Imported dr eggbot from the Grok Bot marketplace, a bot whose only job is designing other bots. Told it what I wanted help with, it asked a few questions, then built each one

What came out were really minimal bots. One job each, a clear list of things they're not allowed to do, and nothing else. Then daily checks for the routine stuff, so they come to me rather than me remembering to ask

Gamechanger!

[CodeWithStu @CodeWithStu]

Went through my app's regional pricing recently. 175 countries, and 8 of them had a yearly saving way out of line with everywhere else

Standardised them all to 15-20% off twelve months of monthly. Then learned the hard way that Apple only lets you use its own price points, so a nice number in a spreadsheet isn't always a real price. My pricing generator now checks every override against Apple's list

Anyone else set prices per country, or just leave Apple's auto-equalised ones?

[CodeWithStu @CodeWithStu]

Ran a bug hunt across every screen of onehaus recently. Found 95 bugs, fixed 52 and left the rest as low priority

I run these continuously now instead of saving it all for the end, and always do one final sweep right before a release

What did you find in your last bug hunt?

[CodeWithStu @CodeWithStu]

Silently dropping from 20x tier to 10x tier is not great at all. It's almost getting to a point where an open harness and a fleet of open weight models because a better option...

[Claude @claudeai]

We’re renaming our Max plans:

Max 5x → Max
Max 20x → Ultra

Max is still $100/month, and Ultra is still $200. If you’re a subscriber, there’s nothing you need to do.

We’re also removing the 5-hour limit for verified Ultra accounts, starting today with most existing subscribers. Newer accounts keep a temporary limit until they’re verified, which helps us prevent fraud and abuse. You'll get an email when it's removed.

Weekly limits remain unchanged. View our plans here: https://t.co/niRpyGF5Me

[CodeWithStu @CodeWithStu]

Starting something new for mobile devs, based on my own pains

Honestly tired of stitching together a load of platforms for every app I build

[CodeWithStu @CodeWithStu]

Small one if you're building a sign-in code screen. Use one input with autocomplete="one-time-code" and style it as six boxes, rather than six separate inputs

Six inputs looks the same but paste and autofill usually end up half broken. Just did it this way on the new project's sign-in pages and it's so much nicer :)

[CodeWithStu @CodeWithStu]

@ayaboch Grok bot has been solid. no complaints so far (in uk)

[CodeWithStu @CodeWithStu]

https://t.co/RUQbBakFlJ

[CodeWithStu @CodeWithStu]

TIL about Datadog's pathfinding project. It documents pretty much every known AWS IAM privilege escalation path, what permissions each one needs and how to spot it

Honestly worth a look if you touch AWS at all

[CodeWithStu @CodeWithStu]

@raroque I have a super low end device if you need another device for testing

[CodeWithStu @CodeWithStu]

@bas_fijneman Nice nice!! Anything we can share a sneak peak of?

i’m just cooking away, starting a new project so i can port OneHaus across to it. So just in that exciting early stage part :) will launch the homepage and start posting later this week hopefully

[Chevy Phillip @chevonphillip]

Connecting to an MCP server can be enough. Two MCP Inspector advisories, Oct 21:

- Server-chosen OAuth URL runs as PowerShell on Windows/WSL (high; fix 2.12.0)
- OAuth callback flips transport to stdio, runs a local command (critical; fix 1.0.3)

Do you vet MCP servers first?

[CodeWithStu @CodeWithStu]

Nice summary of my project @MCPScores - thanks :)

[エクシードシステム(Y.Sakamoto) @exceedsystem]

MCPサーバーの安全性を自動検証して信頼度をスコア化するサービス「VerifyMCP」がすごい😲

約4.8万のMCPサーバーを解析し、セキュリティや信頼性を100点満点で可視化できる👀

・MCPサーバーへの実接続/動作確認
・ツール定義/スキーマの検証
・TLS証明書/OAuth認証のチェック
・依存パッケージの脆弱性スキャン
・サンドボックス環境でのパッケージ検証
・毎日の再スキャン/信頼スコア更新

スコアだけで安全性を保証できるわけではないけど、MCPも機能だけでなく信頼性を確認してから導入するのをおすすめ。

https://t.co/8QBAOPU9Qe

[CodeWithStu @CodeWithStu]

@MCPScores The study if you're curious, 6M posts and accounts under 1k followers actually got more views on link posts https://t.co/ADeLtPwUzu

[CodeWithStu @CodeWithStu]

TIL putting links in a reply instead of the main post isn't really a thing anymore. X said in July you don't need to bother

Updated @mcpscores now to see if this holds true