Founder Built Insights
What the AI didn't warn you about.
Plain-English field notes for owners building software with AI. The build is the easy part. This is everything that comes after, and exactly what to tell your AI about it.
Handing Your App to a Developer Later: What to Write Down Now
At some point you may hire your first developer or bring on a technical co-founder. The context you have in your head never made it into a single file, and that gap is what makes a handover slow.
Read →
One User Should Not Be Able to Run Up Your AI Bill (Rate Limits and Spend Caps)
An app that calls an AI model for every user action has a cost that scales with usage, not a flat server bill. Without a ceiling, one bad loop can run up charges a normal day never would.
Read →
GDPR for Your First App: What Data You Hold, and Why It Matters
GDPR sounds like a problem for lawyers and large companies, until your first app has a signup form and a database, at which point it is already a problem for you.
Read →
Find Out Your App Broke Before Your Users Tell You (Error Monitoring)
A customer's checkout fails at eleven at night, and the first time you hear about it is three days later when they email asking for a refund, if they bother to email at all.
Read →
Why Your App's Emails Land in Spam (SPF, DKIM, and DMARC Without the Jargon)
Your app sends a password reset or a receipt, and it never arrives. Not because your code is broken, but because to Gmail your message looks exactly like something a spammer would send.
Read →
Taking Payments Before Launch: Test Mode, Webhooks, and the Refund You Will Need
AI can wire up a Stripe checkout button in an afternoon. The part that protects your business is the test you skipped, the message your server never got, and the refund you will eventually have to handle.
Read →
Insurance, Terms, and Privacy Before You Launch
Three questions arrive the moment you hold customer data and take money: who pays when it leaks, what your suppliers really owe you, and whether your privacy policy tells the truth. None need code.
Read →
The Day a Big Customer Asks for SOC 2
A bigger customer asks for your SOC 2 report and the deal goes quiet. It is not a feature you can add; it is months of evidence an auditor confirms. Here is why you start it early.
Read →
Deleted API Keys Don't Actually Disappear
Bots read public code all day looking for secret keys. You cannot make a key impossible to lose, so make each one barely worth stealing: scan your history, block leaks early, and scope every key tight.
Read →
Your Usage Limits Are Really Your Pricing
Your app's usage limits look like a safety switch to stop abuse. They are really part of your pricing, and the free tier is where you either give people a reason to pay or quietly take it away.
Read →
Rotate the Secret Keys That Run Your App
The keys that connect your app to payments, email, and your database are master keys. Keep them in a vault, replace them with no downtime, and put rotation on a timer so a leak cannot linger.
Read →
Test Your Backups Before You Need Them
Most quickly-built apps have a backup nobody has ever restored, which means nobody knows if it works. Three decisions turn a hopeful file into real protection for your customers' data.
Read →
When Cached Data Shows the Wrong Price
To make your app faster, an AI keeps a nearby copy of your data. That copy can quietly fall out of date, and on prices, access, or stock, being slightly behind gets expensive.
Read →
When Logging Out Doesn't Actually Log Out
When a customer logs in, your app hands them a digital key to prove who they are. Built carelessly, that key can be forged or work forever, so a stolen one becomes a permanent pass into the account.
Read →
Try to Break Into Your Own App First
Your AI says it added security. That is a claim, not a test. Here is how to point free tools at your own app, try the handles yourself, and find the weak spots before a stranger does.
Read →
Why Your App Breaks on Launch Day
Your app passed every test, then buckled an hour after launch. The cause is usually the outside services it depends on, and the limits your AI never mentioned. Here is how to launch without the surprise.
Read →
You Don't Need an Ops Hire Yet
Before you hire an operations person to keep your app alive, look at what three ordinary tools can do. Error tracking, caching, and managed deployment cover the work in about an afternoon.
Read →
Have Your AI Check Its Own Work
The AI can write a change in seconds and hide a fault just as fast. Here is how I have the AI read its own work before customers do, and stay the one who decides what ships.
Read →New insights are on the way. Check back soon.