Pau

Founder. Building software for growing companies.

Notes on AI, growth and how the best businesses operate.

[Pau @paublds]

That tool you connected months ago may still have access to your business.

I wrote a one-day guide to checking permissions, removing unnecessary access, and testing recovery.

Read it here ↓ https://t.co/Yl7jJi7xl1

[Pau @paublds]

Making time for the things you enjoy matters just as much as working.

Calling it a day and watching the Ballon d’Or tonight ⚽️

What do you like doing in your free time?

[Pau @paublds]

@itzSaasified Yeah, happy to connect! I’d include that in the test: could you access your backups and restore the service without the main admin account? If both depend on that login, losing it could block recovery too.

[Pau @paublds]

That tool you connected months ago may still have access to your business.

I wrote a one-day guide to checking permissions, removing unnecessary access, and testing recovery.

Read it here ↓ https://t.co/Yl7jJi7xl1

[Pau @paublds]

Where are you hosting your projects right now?

AWS, Hetzner, Vercel, something else? I’m guessing Railway isn’t everyone’s first choice after what happened 😅

Curious what you’re running and why you chose it. Would you make the same choice today?

[Pau @paublds]

The part that matters for a business: researchers got access to work email, files and calendars through a malicious app on the same phone.

Microsoft has patched it. Update Authenticator on Android.

If that were your phone, how much of your business would be within reach?

[Cyber Security News @The_Cyber_News]

‼️Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions

Details: https://t.co/bxLApplffv

Microsoft patched high-severity flaw CVE-2026-80097 (CVSS 8.6) in Authenticator for Android, allowing malicious apps with no declared permissions to steal work account access tokens due to improper authentication in its broker component.

Microsoft classified the flaw as a local elevation-of-privilege vulnerability. The issue affected Android devices with Microsoft Authenticator installed and a signed-in work account.

#cybersecuritynews

[Pau @paublds]

Didn't post yesterday. I was caught up with work and my projects.

More active here today. A few posts coming, plus the security article I mentioned: PHP, Railway, and what happens when the tools we trust become the way in.

First one soon. I'll be around.

[Pau @paublds]

@OnatAksaray This!!

[Pau @paublds]

In the article I posted, I talked about protecting your app from outside threats.

But what happens when the way in is software you already trust?

PHP patched two critical vulnerabilities this week. Railway disclosed a breach involving customer secrets. Earlier this year, Vercel's breach started through a third-party AI tool used by an employee.

That last detail matters. A tool someone used for work became a route into other systems.

Every time we connect another service, we give it access to something. An account. A database. An API key.

I'd want to know exactly how far that access goes. And I might post an article on this matter in the coming days.

If one of the tools you use was compromised today, what else could an attacker reach?

[Pau @paublds]

Earlier this month my AI built me a system with 39 passing tests and 98% coverage.

The real run log said it had run 0 times.

The tests checked the code. Nothing checked that my daily routines were actually calling it.

The same pattern shows up in 174 stories from people building with AI. What the AI reports and what actually happens need two different checks.

What I check now:
1. The real log, not the test report. Did it run today?
2. A health check on live data. Mine scored 7 of 9 while every test was green.
3. Several copies at once. 6 parallel writers found a real bug: duplicate IDs.

What's the last thing your AI "finished" that never actually ran?

[Pau @paublds]

I read 957 posts about AI-built apps breaking.

174 were firsthand stories. The first thing to break usually isn't what the checklists warn you about.

Here's what the data says: https://t.co/5XlDxYwma2

[Pau @paublds]

I run a small AI team for my content. None of them write my posts.

What they hand me every day:

1. 8:00: the posts that broke out in my niche in the last 24h, and why
2. 13:00: what 3 accounts I study shipped and what worked
3. 16:00: the fastest-growing post of the last 2 hours, in case it's worth a take
4. 19:00: a summary of everything I bookmarked
5. 20:30: my numbers, with one lesson for tomorrow

The research is theirs. The opinion, the logic and the story are mine.

Yesterday's lesson: one early reply under a big account got 1,857 impressions. More than my last 5 posts combined.

What's the first job you'd hand to an agent?

[Pau @paublds]

Security is 45% of the warnings about AI-built apps.

It was 14% of what actually broke first.

Out of 174 firsthand stories from people who built something with AI, 80 started the same way: the AI broke its own code or deleted data, files or code.

Security still matters. It was 10 of the 29 worst outcomes.

But while you're still building, the first thing to protect is your work from your own AI.

[Pau @paublds]

I read 957 posts about AI-built apps breaking.

174 were firsthand stories. The first thing to break usually isn't what the checklists warn you about.

Here's what the data says: https://t.co/5XlDxYwma2

[Pau @paublds]

@IliyaOblakov Mostly the first kind: it broke code that worked (50 of 174) or deleted something (30). The "never wrote it" kind shows up after real users, when security holes and silent failures move up. I didn't tag that split directly, so it's going in the next version.

[Pau @paublds]

I read 957 posts about AI-built apps breaking.

174 were firsthand stories. The first thing to break usually isn't what the checklists warn you about.

Here's what the data says: https://t.co/5XlDxYwma2

[Pau @paublds]

@harden_369741 Same for me. And only 8 of the 30 deletion stories even mention a backup, git or an undo. A commit before every AI session is the cheapest fix on the list.

[Pau @paublds]

@deeponailabs Close, but not in this data. Security as a whole (keys, open databases, hacks) was 24 of 174 first breaks. The AI breaking its own code or deleting things was 80.

[Pau @paublds]

@federicodonaton Thanks Federico. That gap surprised me most too. Security posts also get saved the most: 9 bookmarks per 1,000 views, vs about 2 for posts about the AI breaking things.

[Pau @paublds]

Free kit with the full dataset and copy-paste guardrails for each failure.

Comment "BREAK" and I'll send it to you. Follow me too, so the DM can reach you.

[Pau @paublds]

Later today I'm publishing what 957 posts say about what breaks first when you build with AI.

174 of them are firsthand stories from people whose own app, site or automation broke.

The most common first break isn't the one most checklists start with.

What do you think breaks first?

[Pau @paublds]

I looked at 523 lost bids on government contracts. 1 in 5 lost by less than 3 points.

Some governments publish every bid, price and score. I read them because I'm building a tender-alert tool.

What 12 months of public cleaning contracts showed:
- 473 companies bid
- 102 bids lost by under 3 points, 35 by under 1
- In 68 of the 100 close losses with prices, the winner was cheaper. Median gap: 1.6%

If I sold to governments, after every loss I'd:
1. Download the scoring report
2. Write down the gap to the winner, in points and in price
3. Work on the smallest gap before the next bid

Have you ever read the score of a bid you lost?

[Pau @paublds]

@bot I set up a Grok Bot as my whole X growth team: 10 jobs, from overnight research to a daily analytics coach.

Pages are the missing piece for those daily reports.