Jimmy Ships

10+ year exp. SWE, building @GetMagicKit and exploring ideas in tech and indie hacking

[Jimmy Ships @jimships]

We cooked 🧑‍🍳

Google Forms look so bland and out of date. So today, we’re introducing https://t.co/F51EVjDqvK:

- Paste in a link to your Google Form
- Optionally customize further
- Publish via a beautiful landing page, one-line embed or QR code
- See form responses and get AI analysis, including easy exporting capabilities directly within @GetMagicKit

All for free 🚀

No more ugly waiting lists for your next indie hacking project...

[@levelsio @levelsio]

✨ Here's my first GPT-3 app: it generates new startup ideas and you can get early access here: https://t.co/Gn8bOsqqdE

[Jimmy Ships @jimships]

@levelsio My experience (UK) is they're mostly under kitchen worktops - with no access to the top of the washer

[Jimmy Ships @jimships]

I'd never buy a Windows machine now. However...

I got my first laptop when I was 12, a shitty $150 Windows thing, it's all my parents could afford - because I wanted to learn to code.

I was ever so grateful, and it allowed me to learn. It was a stepping stone to a great career that followed as I grew up, studied and worked.

TLDR: wanna get into tech/coding/etc and don't have the money for a Mac? That's fine, use Windows - there's no shame there

[Jimmy Ships @jimships]

And make sure .env isn't a publicly accessible file on the server (you'd be surprised how common this is)

[Jimmy Ships @jimships]

@GetMagicKit What he said ^

[Klaas @forgebitz]

frameworks:

"don't worry bruh, we take care of everything! best thing ever, just npm install one more dependency bruh"

frameworks when something bad happens:

"bruh, skill issue, git gud, don't blame us"

[MagicKit @GetMagicKit]

🚀 The Ultimate Form Question Type Cheatsheet 🚀

I've filled out over 1,000 forms and most people use form questions WRONG.

Each type is built for specific insights—but misusing them ruins your data.

Here’s your must-bookmark breakdown (so you never guess again) 🧵👇

[Jimmy Ships @jimships]

@gyurisc @levelsio £20 per month!

[Jimmy Ships @jimships]

@denizdoingstuff @buildinpublic @freemius And full of engagement farming questions. Yet I post something sensible and get the post hidden 🤷‍♂️

[Jimmy Ships @jimships]

@theo It needs an overhaul.

There has to be a better way for non-technical people to unlock the power of third parties directly in their favorite AI assistants.

[Jimmy Ships @jimships]

Not security related, but it's also so important to set spend caps on any usage based billing you're subscribed to (AI credits, bandwidth for hosting, and so on).

Don't be like some people and end up with crazy 4, 5 or 6 figure bills because you got bot attacked

[Jimmy Ships @jimships]

Indie hackers and vibe coders, I’m going to give you a quick rundown on security so you don’t get screwed…

But first, what makes me qualified to do this? I’ve held high level engineering roles throughout my career where I’ve been responsible for websites + systems with >1 million user accounts, and everything that goes into that.

1) Use rate limiting, but not just at a cloud level. I’ve seen @jackfriks and a few others struggle with bot attacks. Get a basic @Cloudflare installation up and running, it’s free. If you’re on @vercel, they have a tool natively built in for that https://t.co/i8AN0jOfCi. This helps prevent things like spammy account sign ups. But, go one step deeper - integrate rate limits in your code. Use session based rate limiting where sensitive actions within your codebase are limited to say 5 attempts every 10 minutes by tracking these attempts in a session.

2) Similar to solving the above problem, use captcha on sensitive areas - such as account creation and sign in. This provides a more reliable way of verifying that the request happening is from an actual human.

3) There’s a million ways of storing data, but regardless of what you’re doing, make sure anything sensitive is encrypted. Things like passwords should be one-way encrypted, meaning even you as the database owner cannot see it. Other things that are less sensitive but still important (e.g. someone's physical address) can still be encrypted at rest, with the option for you to decrypt to reveal that data in a frontend.

4) Never reveal your env variables, store them securely, never commit them to version control, and definitely never share them on X. If for whatever reason you manage to reveal them, immediately revoke every single one of them and start again. Imagine a world where someone has your Stripe keys - they can not only steal your customer data, they could programmatically refund everyone.

5) Don’t install random dependencies and other code packages. Anything dodgy will potentially not only have free reign over your entire codebase, but also your local machine (computer). If you’re using @github, install Dependabot :)

6) 2FA absolutely everything, preferably with app-based 2FA (not SMS). Your domain registrar, hosting login, payment providers, social accounts, the absolute lot.

7) Wanna stop someone from being able to access certain features or content? Don’t just prevent that from happening on the frontend, prevent it in your backend code too. Frontend only blocks are so easy to bypass.

8) Sanitize all user input, trust nothing. SQL injection is kinda a thing of the past, but it’s still possible in today's world and these kinds of attacks give people access to all of your data, including the ability to delete it.

I could go on forever, but I think this is enough for now. Any questions? LMK below... 👇

[Jimmy Ships @jimships]

And oh yes, web3 increases the scope of security screw ups even more...

Connecting wallets is a huge attack surface, then there's the whole phishing site experience where you think you're connecting your wallet to a legit site - but you aren't (bye bye funds).

Then there's email addresses - email addresses are even more valuable in web3 vs web2 because of how targeted phishers can be with their domains (to drain funds). Time to be an even bigger target for a breach.

Oh and then there's smart contract vulnerabilities. I could go on...

[Alexx @alexxshadow]

“Vibe coding” fk up of the day. This isn’t just a concern for the dev, but also anyone signing up to vibe coded websites. Also, connecting wallets etc in the world of web3 could also lead to more devastating security compromises for users.

[Jimmy Ships @jimships]

@alexxshadow Yup, this is a problem for everyone with an online presence https://t.co/g8TBDBwVtw

[Jimmy Ships @jimships]

Indie hackers and vibe coders, I’m going to give you a quick rundown on security so you don’t get screwed…

But first, what makes me qualified to do this? I’ve held high level engineering roles throughout my career where I’ve been responsible for websites + systems with >1 million user accounts, and everything that goes into that.

1) Use rate limiting, but not just at a cloud level. I’ve seen @jackfriks and a few others struggle with bot attacks. Get a basic @Cloudflare installation up and running, it’s free. If you’re on @vercel, they have a tool natively built in for that https://t.co/i8AN0jOfCi. This helps prevent things like spammy account sign ups. But, go one step deeper - integrate rate limits in your code. Use session based rate limiting where sensitive actions within your codebase are limited to say 5 attempts every 10 minutes by tracking these attempts in a session.

2) Similar to solving the above problem, use captcha on sensitive areas - such as account creation and sign in. This provides a more reliable way of verifying that the request happening is from an actual human.

3) There’s a million ways of storing data, but regardless of what you’re doing, make sure anything sensitive is encrypted. Things like passwords should be one-way encrypted, meaning even you as the database owner cannot see it. Other things that are less sensitive but still important (e.g. someone's physical address) can still be encrypted at rest, with the option for you to decrypt to reveal that data in a frontend.

4) Never reveal your env variables, store them securely, never commit them to version control, and definitely never share them on X. If for whatever reason you manage to reveal them, immediately revoke every single one of them and start again. Imagine a world where someone has your Stripe keys - they can not only steal your customer data, they could programmatically refund everyone.

5) Don’t install random dependencies and other code packages. Anything dodgy will potentially not only have free reign over your entire codebase, but also your local machine (computer). If you’re using @github, install Dependabot :)

6) 2FA absolutely everything, preferably with app-based 2FA (not SMS). Your domain registrar, hosting login, payment providers, social accounts, the absolute lot.

7) Wanna stop someone from being able to access certain features or content? Don’t just prevent that from happening on the frontend, prevent it in your backend code too. Frontend only blocks are so easy to bypass.

8) Sanitize all user input, trust nothing. SQL injection is kinda a thing of the past, but it’s still possible in today's world and these kinds of attacks give people access to all of your data, including the ability to delete it.

I could go on forever, but I think this is enough for now. Any questions? LMK below... 👇

[Jimmy Ships @jimships]

Does anything else come to mind for anyone here?

[Jimmy Ships @jimships]

Indie hackers and vibe coders, I’m going to give you a quick rundown on security so you don’t get screwed…

But first, what makes me qualified to do this? I’ve held high level engineering roles throughout my career where I’ve been responsible for websites + systems with >1 million user accounts, and everything that goes into that.

1) Use rate limiting, but not just at a cloud level. I’ve seen @jackfriks and a few others struggle with bot attacks. Get a basic @Cloudflare installation up and running, it’s free. If you’re on @vercel, they have a tool natively built in for that https://t.co/i8AN0jOfCi. This helps prevent things like spammy account sign ups. But, go one step deeper - integrate rate limits in your code. Use session based rate limiting where sensitive actions within your codebase are limited to say 5 attempts every 10 minutes by tracking these attempts in a session.

2) Similar to solving the above problem, use captcha on sensitive areas - such as account creation and sign in. This provides a more reliable way of verifying that the request happening is from an actual human.

3) There’s a million ways of storing data, but regardless of what you’re doing, make sure anything sensitive is encrypted. Things like passwords should be one-way encrypted, meaning even you as the database owner cannot see it. Other things that are less sensitive but still important (e.g. someone's physical address) can still be encrypted at rest, with the option for you to decrypt to reveal that data in a frontend.

4) Never reveal your env variables, store them securely, never commit them to version control, and definitely never share them on X. If for whatever reason you manage to reveal them, immediately revoke every single one of them and start again. Imagine a world where someone has your Stripe keys - they can not only steal your customer data, they could programmatically refund everyone.

5) Don’t install random dependencies and other code packages. Anything dodgy will potentially not only have free reign over your entire codebase, but also your local machine (computer). If you’re using @github, install Dependabot :)

6) 2FA absolutely everything, preferably with app-based 2FA (not SMS). Your domain registrar, hosting login, payment providers, social accounts, the absolute lot.

7) Wanna stop someone from being able to access certain features or content? Don’t just prevent that from happening on the frontend, prevent it in your backend code too. Frontend only blocks are so easy to bypass.

8) Sanitize all user input, trust nothing. SQL injection is kinda a thing of the past, but it’s still possible in today's world and these kinds of attacks give people access to all of your data, including the ability to delete it.

I could go on forever, but I think this is enough for now. Any questions? LMK below... 👇

[Jimmy Ships @jimships]

@michelifelse Damn yeah, I've just covered some of these here https://t.co/g8TBDBxtj4

[Jimmy Ships @jimships]

Indie hackers and vibe coders, I’m going to give you a quick rundown on security so you don’t get screwed…

But first, what makes me qualified to do this? I’ve held high level engineering roles throughout my career where I’ve been responsible for websites + systems with >1 million user accounts, and everything that goes into that.

1) Use rate limiting, but not just at a cloud level. I’ve seen @jackfriks and a few others struggle with bot attacks. Get a basic @Cloudflare installation up and running, it’s free. If you’re on @vercel, they have a tool natively built in for that https://t.co/i8AN0jOfCi. This helps prevent things like spammy account sign ups. But, go one step deeper - integrate rate limits in your code. Use session based rate limiting where sensitive actions within your codebase are limited to say 5 attempts every 10 minutes by tracking these attempts in a session.

2) Similar to solving the above problem, use captcha on sensitive areas - such as account creation and sign in. This provides a more reliable way of verifying that the request happening is from an actual human.

3) There’s a million ways of storing data, but regardless of what you’re doing, make sure anything sensitive is encrypted. Things like passwords should be one-way encrypted, meaning even you as the database owner cannot see it. Other things that are less sensitive but still important (e.g. someone's physical address) can still be encrypted at rest, with the option for you to decrypt to reveal that data in a frontend.

4) Never reveal your env variables, store them securely, never commit them to version control, and definitely never share them on X. If for whatever reason you manage to reveal them, immediately revoke every single one of them and start again. Imagine a world where someone has your Stripe keys - they can not only steal your customer data, they could programmatically refund everyone.

5) Don’t install random dependencies and other code packages. Anything dodgy will potentially not only have free reign over your entire codebase, but also your local machine (computer). If you’re using @github, install Dependabot :)

6) 2FA absolutely everything, preferably with app-based 2FA (not SMS). Your domain registrar, hosting login, payment providers, social accounts, the absolute lot.

7) Wanna stop someone from being able to access certain features or content? Don’t just prevent that from happening on the frontend, prevent it in your backend code too. Frontend only blocks are so easy to bypass.

8) Sanitize all user input, trust nothing. SQL injection is kinda a thing of the past, but it’s still possible in today's world and these kinds of attacks give people access to all of your data, including the ability to delete it.

I could go on forever, but I think this is enough for now. Any questions? LMK below... 👇

[Jimmy Ships @jimships]

👇

[MagicKit @GetMagicKit]

@ThePeterMick Making another free tool... you?
Convert form responses to insights
CSV → Testimonials
CSV → Churn risks
CSV → Roadmap cards
CSV → Key takeaways
https://t.co/HUmN8Q0O5P

[Jimmy Ships @jimships]

RIP Google Forms 🪦

Import your waitlist, contact form, whatever you have in Google Forms into https://t.co/cKt5SNVlgq and see for yourself...

https://t.co/UnP8IzJcCI

[Jimmy Ships @jimships]

@dreamerjavier What field of work will you be going into when that happens?

[Jimmy Ships @jimships]

Most of the image converters on the web are slow, full of ads, and/or upload your images to unknown servers.

So I built a new one for myself, but also as an SEO play for @GetMagicKit. Try it out at https://t.co/XcawlYv3S2 and let me know your thoughts

- 🔐 Free and secure
- ❌ Ad-free
- ✅ Everything happens browser side