Hamza

I build brands, websites and the systems behind them. Running Loopzen. Posting the AI tools, money moves and builds that actually work.

[Hamza @imhmxi]

AI writes the code now. It doesn't write the parts that keep you out of trouble.

AI code added security flaws in 45% of Veracode's tests.

Here are the 12 concepts behind most of it, and the fix for each: https://t.co/RJmN3b0l8s

[Hamza @imhmxi]

GitHub Universe is today and tomorrow (free virtual pass) if you want to see what's next for Actions and Copilot.

[Hamza @imhmxi]

The CI file every AI-built app should have. Paste it into .github/workflows/ci.yml:

name: ci
on: [push, pull_request]
jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with: { node-version: 24,...

[Hamza @imhmxi]

Every AI-built website looks the same, and it's not the AI's fault.

It's the defaults nobody changed.

I wrote up the 9 decisions that make a site look designed instead of generated, with the numbers and the CSS.

Full Article ↓ https://t.co/TjHGMXTUav

[Hamza @imhmxi]

MCP's newest spec (2026-07-28) made the protocol stateless: no more initialize handshake or session IDs.

If you built an MCP server last year, read the changelog before your clients update.

[Hamza @imhmxi]

The line is simple: if a mistake is cheap and reversible, delegate it. If it's expensive or public, keep a human in the loop.

[Hamza @imhmxi]

Jobs I'd give an always-on AI agent:

Summarize my inbox every morning
Watch competitors' pricing pages for changes
Draft replies to routine client emails (I hit send)
Turn meeting notes into tasks
Check my sites are up and fast

Jobs I'd never give one:

Sending money
Deleting anything
Posting as me without review

[Hamza @imhmxi]

Rule 3 is the one people skip. It's how prompt injection works: the agent reads a page that says "ignore your instructions" and believes it.

[Hamza @imhmxi]

4 rules before you let an AI agent touch anything real:

1. Start read-only. Add write tools one at a time.
2. Approval before anything that sends, buys, deletes or posts.
3. Treat tool output as untrusted. Pages and files can contain instructions.
4. Set a turn limit and a ...

[Hamza @imhmxi]

Rates move. Check the exact APY on the bank's own site the day you switch, and make sure it's FDIC-insured.

[Hamza @imhmxi]

Quick math:

$10,000 in a savings account paying the national average (~0.38%): about $38 a year.

The same $10,000 at a high-yield account (~4%): about $400 a year.

Same money. Same $250,000 FDIC insurance. Ten minutes to switch.

Not advice, just arithmetic.

[Hamza @imhmxi]

CSS you can now use in every major browser:

:has()
container queries
subgrid
nesting
oklch() and color-mix()

Still not everywhere: scroll-driven animations and page-to-page view transitions. Use those as extras with a fallback.

[Hamza @imhmxi]

Sources: Butterick's Practical Typography, WCAG 2.2, Nielsen Norman Group on animation timing, https://t.co/Ri39fjSgD2 on Core Web Vitals.

[Hamza @imhmxi]

Design numbers worth memorizing:

Line length: 45–90 characters (65 is a safe default)
Line height: 120–145% of font size
Body text: 16–18px on the web
Contrast: 4.5:1 body, 3:1 large text and UI
Animations: 100–400ms, ease-out, never linear
Page speed: LCP under 2.5s, INP under 200ms, CLS under 0.1

Taste is easier when the basics are automatic.

[Hamza @imhmxi]

Cold outreach that doesn't feel cold:

1. Find one specific problem on their site or page
2. Show it (a screenshot or a 60-second video)
3. Show the fix
4. One ask: "Want me to do this for you?"

No "hope this finds you well". No 5-paragraph pitch.

[Hamza @imhmxi]

Links: https://t.co/NnRMxlF5C1 · https://t.co/2QU5HmEM7t · https://t.co/wktRXkjniW · https://t.co/LOQ9Itf6z6 · https://t.co/e4gJAAd8o3 · https://t.co/5HfKI5wIdz

[Hamza @imhmxi]

Free founder education that's better than most paid courses:

YC Startup School (+ co-founder matching)
Stripe Atlas guides: 30+ guides on starting and running a company
First Round Review: operator playbooks, no paywall
Paul Graham's essays
Lenny's Newsletter free posts
Indie Hackers interviews

Read one a day for a month and you'll know more than most "business coaches".

[Hamza @imhmxi]

5. Make every handler safe to run twice.

That's the whole game: webhooks, retries and queues are all "at least once". Design for twice and you're fine.

Which one has burned you?

[Hamza @imhmxi]

Webhooks, explained for people shipping on Monday.

5 rules. Break one and you'll eventually charge someone twice or fulfill an order nobody paid for:

[Hamza @imhmxi]

4. Expect duplicates and wrong order.

Stripe retries for up to 3 days and doesn't guarantee order. Store the event ID and skip ones you've seen.