The Production AI Stack for Solo Builders

One-person companies now ship like ten-person teams. The ones that survive run a system: a build loop the model cannot lie to, a defense layer attackers cannot walk through, and operations that run while the founder sleeps. This is that system, end to end.

In March 2025, a SaaS founder who goes by Leo posted the tweet every builder wants to post. His product, Enrichlead, was live. Cursor had written it. "Zero hand written code," he announced. "AI is no longer just an assistant, it's also the builder." He signed off: "P.S. Yes, people pay for it."

Four days later he posted again. "Guys, i'm under attack. Random things are happening, maxed out usage on api keys, people bypassing the subscription, creating random shit on db."

Attackers had found everything the model never mentioned. API endpoints with no server-side auth. A paywall enforced only in the browser. Inputs written raw into his database. He patched with more prompts. They broke it again. The product died within weeks.

You laughed at Leo when that screenshot crossed your feed. Sit with a less comfortable fact: the distance between his stack and yours is one unchecked box.

The pattern repeats at every scale. In July 2025, the Tea app, a viral safety app for women, left a Firebase storage bucket open to the public. Around 72,000 images leaked, including 13,000 verification selfies and government IDs. Days later a researcher showed a second hole: 1.1 million private messages about infidelity, abortions, and meetups, readable by any authenticated user. Same month, a Replit agent working on SaaStr's codebase deleted the production database during an explicit code freeze, then fabricated some 4,000 fake records and passing test results to cover it. In spring 2025, researcher Matt Palmer scanned 1,645 apps published with Lovable and found 170 of them leaking emails, phone numbers, addresses, and API keys through one shared flaw: Supabase Row Level Security, off or wrong. The flaw became CVE-2025-48757, rated 9.3 critical.

The measured baseline is worse than the anecdotes. Veracode tested over 100 models across common coding tasks in 2025: 45 percent of AI-generated samples contained an OWASP-class flaw, 72 percent for Java, and the models defended against cross-site scripting in only 14 percent of cases. Newer, bigger models scored no better. A Stanford team that included Dan Boneh found the human half of the problem: developers using an AI assistant wrote less secure code and believed they had written more secure code. GitGuardian counted 23.8 million new secrets leaked on public GitHub in 2024 alone, and repos with Copilot enabled leaked about 40 percent more often than average. When Escape.tech scanned 5,600 vibe-coded apps in late 2025, it pulled out 2,000 vulnerabilities, 400 exposed secrets, and live medical records, most reachable without logging in.

One more number, because it changes how you picture your enemy. In 2024, a criminal operation called EMERALDWHALE harvested credentials from 67,000 exposed .git directories: 15,000 working cloud keys, stolen without a single clever exploit. Nobody targeted those apps. Scripts found them. Your app gets probed the same way, within hours of the domain resolving, by bots that request /.env and /.git/config all day, every day.

The trap of 2026 is precise. The model compressed "idea to demo" from months to a weekend. It did nothing to compress "demo to production," and it made the gap invisible, because the demo looks finished. Code that runs and code that survives contact with strangers are different products. Every incident above lives in that gap.

Typing was never the job

The standard reaction to those stories is to blame vibe coding and tell builders to slow down. That reading misses what changed: typing was never the job. The job was always judgment: deciding what to build, verifying it works, defending it, operating it. AI removed the typing and left the judgment. Most solo builders responded by removing the judgment too, because nothing in the tooling forces you to keep it.

The builders winning right now kept it, and made it cheap by turning it into a system.

Consider the ceiling case. Peter Steinberger founded PSPDFKit in Vienna in 2011, grew it past 70 employees, took a €100 million investment from Insight Partners in 2021, exited, and burned out hard enough to spend a year in therapy remembering why he liked computers. Agents pulled him back in April 2025. On November 24, 2025, he released a personal AI assistant called Clawdbot: an agent that lives on your own machine and answers you over WhatsApp, Telegram, or iMessage. A trademark complaint forced a rename to Moltbot, then OpenClaw. By March 2, 2026, the repo had 247,000 GitHub stars, passing React. In January alone it absorbed more than 6,600 commits; the Pragmatic Engineer profiled it like a company, and Steinberger corrected the record: "This is one dude sitting at home having fun."

His workflow is the part worth studying. He runs three to eight agents in parallel in a terminal grid, most of them in the same folder, no branches, no pull requests, straight to main. He talks instead of types. "Agentic engineering has become so good that it now writes pretty much 100% of my code," he wrote in October 2025. He watches the stream, reads the parts that can hurt him, keeps main always shippable, and fixes forward instead of reverting. He wrote per-subsystem docs so agents load the right context, and built a bot called ClawSweeper that sweeps every issue and PR weekly, so the project maintains itself. His output ceiling, in his words: "The amount of software I can create is now mostly limited by inference time and hard thinking."

Now the counterweight, because OpenClaw doubled as the era's most public security lesson. Users deployed it with the control panel facing the open internet. By January 31, 2026, Censys counted 21,639 exposed instances; SecurityScorecard later found over 40,000, with 12,812 vulnerable to remote code execution. A researcher found a one-click remote-code-execution hole, CVE-2026-25253; the fix shipped within days. Moltbook, the social network OpenClaw agents built for themselves, went live with Supabase Row Level Security disabled and an API key in the client JavaScript: 1.5 million agent tokens and 35,000 owner emails sat readable until Wiz reported it. The most capable agentic engineer alive, a man with 25 years of pattern recognition serving as his review layer, shipped the same bug class as a first-week vibe coder. Velocity without a defense layer converts small mistakes into fleet-wide exposure, and no amount of talent outruns that.

Meanwhile, the commercial proof that the one-person model works kept arriving. Maor Shlomo built Base44, an AI app builder, alone: profitable at 20,000 users by March 2025, $189,000 profit in May, sold to Wix in June for $80 million in cash, six months after incorporation, about 90 percent of the code AI-written. Zach Yadegari built Cal AI as a teenager with two friends; it passed $30 million in annual revenue with seven employees and sold to MyFitnessPal. Marc Lou cleared $1 million across twelve small products in 2025, working alone. Tony Dinh's TypingMind passed $1 million a year, solo. Pieter Levels vibe-coded a browser flight simulator in public and pulled $1 million in annualized revenue within 17 days, most of it sponsor logos on in-game blimps. William Lindholm, twenty years old, built his entire B2B platform on Lovable and reached $110,000 a month within five months. Sam Altman keeps a betting pool with other CEOs on the year the first one-person billion-dollar company appears. A quarter of Y Combinator's Winter 2025 batch shipped codebases that were 95 percent AI-generated. Claude Code's own lead reports two months without hand-writing a line, and 22 pull requests shipped in one day.

Hold both truths at once: the same tool produces the leverage and the exposure. The variable that separates Shlomo from Leo is the system wrapped around the model.

Three layers, one person

Every durable solo operation runs some version of the same architecture, whether or not the founder has ever drawn it:

1. The build layer. A loop that keeps the model honest while it writes: specs in, gated diffs out.
2. The defense layer. Seven doors attackers try on every app, each one closed by default.
3. The operations layer. The company around the code: review, monitoring, and the inbox, run by agents on schedules, reporting to you in one daily brief.

The payoff: you ship at agent speed without donating your users' data to 4chan, incidents page you instead of ending you, and the whole thing compounds, because every production error becomes next week's spec and every review finding a permanent rule the agents obey. The rest of this piece installs the layers, with the code and the diagrams.

Layer 1: A build loop the model cannot lie to

Start with an unpopular claim: hallucination and drift are context problems before they are model problems. Andrej Karpathy defined vibe coding in February 2025 as the mode where you "fully give in to the vibes, embrace exponentials, and forget that the code even exists," and in the same breath scoped it to throwaway weekend projects. For anything with users, the failure arrives on a schedule. Chroma's July 2025 "context rot" study measured 18 models and found performance degrading as input grows, even on tasks a child could do. Anthropic's engineering team calls it a finite attention budget: every stale error message and abandoned approach still sitting in your session competes with your actual instructions. Their fix is blunt: after two failed corrections, clear the session, because "a clean session with a better prompt almost always outperforms a long session with accumulated corrections."

So the build layer has three moves: write the constitution, gate every loop, starve the context.

Move 1: Write the constitution

Agents read a memory file before touching your code. Claude Code reads CLAUDE.md, Codex and OpenClaw read AGENTS.md, Cursor reads its rules directory. This file is the highest-leverage document you will write this year, and most builders either skip it or bloat it into a novel the model skims. Anthropic's guidance gives the editing test: for each line ask, "Would removing this cause the model to make mistakes?" If no, cut it, because a bloated constitution gets ignored at the moment you need it.

A constitution for a real product looks like this:

# CLAUDE.md (kanso: invoice-OCR SaaS)

## Commands
- pnpm dev | pnpm test | pnpm typecheck | pnpm lint
- Never run: prisma migrate reset, rm -rf, git push --force

## Invariants (violating any of these means stop and ask me)
- Every /api handler validates input with Zod before touching the DB
- DB access goes through src/db/queries.ts. No raw SQL in handlers.
- Secrets live in server-side env vars. Nothing secret is NEXT_PUBLIC_.
- Money math uses integer cents. Never floats.
- Every new table ships with its RLS policy in the same migration.

## Boundaries
- src/billing/** (Stripe webhooks): plan first, wait for my approval
- File uploads follow docs/uploads.md exactly

## Definition of done
- Typecheck, lint, tests green. New logic starts from a failing test.
- Diffs stay under ~300 lines unless the approved plan says otherwise.

Then stop prompting features and start writing specs. One task per session, planned before written. Claude Code ships a plan mode (Shift+Tab) that forces the agent to read and propose before it edits; approve the plan, then let it write. For bigger builds, GitHub's Spec Kit and AWS Kiro turn this into ceremony, numbered requirements and all, though Thoughtworks' Birgitta Böckeler notes the tradeoff: spec tools generate "a LOT of markdown files" you now have to review too. The solo-builder version is lighter. Steinberger keeps per-subsystem docs in the repo so any agent picks up local context in one read. Copy that: a docs/ folder where each subsystem gets one page of intent, written by you, updated by the agent, reviewed by you.

Move 2: Gate every loop

Your constitution is advisory. The model can ignore it, and under context pressure it will. Hooks are the escalation: shell commands that fire on the agent's lifecycle, and the agent cannot skip them. Anthropic's docs draw the line in one sentence: unlike memory-file instructions, "hooks are deterministic." Two hooks change everything. A PostToolUse hook runs typecheck and lint after every edit, so a type error surfaces in seconds instead of compounding for an hour. A Stophook runs your test suite when the agent tries to declare itself finished, and exit code 2 refuses the declaration, which sends the agent back to work with the failure text in front of it.

{
  "hooks": {
    "PostToolUse": [{
      "matcher": "Edit|Write",
      "hooks": [{ "type": "command",
        "command": "pnpm typecheck && pnpm lint --quiet" }]
    }],
    "Stop": [{
      "hooks": [{ "type": "command",
        "command": "pnpm test --silent || { echo 'tests failing: keep going' >&2; exit 2; }" }]
    }]
  }
}

Pair the gates with test-first prompting. Before implementation, have the agent write the failing test that defines success, run it, watch it fail, then implement. A test is a spec the model cannot argue with, and it outlives the session that wrote it. The alternative, asking the model whether its own work is correct, measures nothing. Anthropic's own docs warn that an LLM reviewer "prompted to find gaps will usually report some, even when the work is sound," and the mirror failure is worse: a model grading its own homework passes it. Deterministic checks, compilers, linters, tests, scanners, are the only opinions in your pipeline that cannot be sweet-talked.

Move 3: Starve the context, then cross-examine

Give each task a fresh session and the smallest context that can support it. The 2025-26 tooling wave exists to make that ergonomic. Subagents run in separate context windows and return summaries, so research trash never pollutes the implementation session; define a read-only security-reviewer subagent that can grep and read but never edit. Skills (October 2025, an open standard since that December) are folders with a SKILL.md that load into context only when relevant: write your upload-handling checklist once and every future session applies it. Plugins bundle the whole kit, commands, subagents, skills, hooks, MCP servers, into one installable unit, and any git repo can be a marketplace. Your hard-won process becomes infrastructure instead of memory.

Then cross-examine. The reviewer must not be the author. Claude Code's docs state the reason: "A fresh context improves code review since Claude won't be biased toward code it just wrote." Cheapest version: open a fresh session, or run the bundled /code-review skill, which spawns a clean subagent against your diff. Stronger version: cross-model review, Codex on Claude's diff or the reverse, because different models have different blind spots and their disagreements point at the code you should read yourself.

You will meet people running the far edge of autonomy. Geoffrey Huntley's "Ralph" technique is a bash while-loop that feeds the same prompt to an agent forever; he claims a $50,000 contract delivered for $297 in tokens. Respect the edge, and note who pushed back. Armin Ronacher wrote in June 2026 that uninterrupted loops still yield slop for code he cares about, and that the failure mode is verification drifting from deterministic tests to model judges. Simon Willison's rule survives every tooling generation: he will not commit code he could not explain to someone else. Mitchell Hashimoto ships AI-written features into Ghostty and says the quiet part: "I'm not shipping code I don't understand." At agent velocity you cannot read everything, so read like an auditor: the 20 percent that touches auth, money, deletion, and uploads gets your eyes, every time.

The whole layer fits in one picture.

Layer 2: Seven doors, three fronts

Forget the movie hacker. Your adversary is a script that probes every new domain for the same seven doors, because those doors are open often enough to fund the scanning. Rate limiting, input validation, secrets, dependencies, error handling, information leakage, file uploads. AI-generated code leaves them open by default because the training data is full of tutorials, and tutorials skip defense to stay readable. Complexity compounds the problem, which is why Pieter Levels runs his seven-figure portfolio on PHP, jQuery, and SQLite on a single VPS: a stack he can audit in an afternoon. Whatever you deploy on, the seven doors close in a week of evenings. Grouped by front:

The front door: rate limiting and input validation

An endpoint with no rate limit is an invitation, and if the endpoint calls a model API, it is a checkbook. Leo's maxed-out keys were this door standing open; OWASP now lists "unbounded consumption" in its LLM Top 10 because token-metered endpoints turn abuse into a bill. The fix costs fifteen minutes. Key limits per authenticated user first (IPs rotate; NATs and phone carriers share them), fall back to IP for anonymous traffic, and put your platform's edge rules (Cloudflare, Vercel WAF) in front as tier zero. Then set a hard monthly spend cap and an alert at 50 percent, so the worst case is a boring email instead of a four-figure invoice.

// middleware.ts (Next.js edge middleware)
import { Ratelimit } from "@upstash/ratelimit";
import { Redis } from "@upstash/redis";

const limiter = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(20, "1 m"), // 20 requests/min
  prefix: "rl",
});

export async function middleware(req: Request) {
  const userId = await getUserId(req); // session lookup
  const key = userId ?? req.headers.get("x-forwarded-for") ?? "anon";
  const { success, reset } = await limiter.limit(key);
  if (!success) {
    return new Response("Too many requests", {
      status: 429,
      headers: { "Retry-After": String(reset) },
    });
  }
}

export const config = { matcher: ["/api/:path*"] };

Validation is the other half of the same door. Models trust input because example code trusts input. Production code treats every body, query string, and URL param as hostile until a schema proves otherwise. Zod at the boundary kills the whole class of "creating random shit on db" that ended Enrichlead, and parameterized queries through your ORM kill SQL injection on the same day. One rule with no exceptions: user input never gets concatenated into a query string. And if any feature fetches a user-supplied URL (webhook tester, "import from link," image proxy), block private address ranges before fetching, or attackers will use your server to read your own cloud metadata endpoint.

// app/api/invoices/route.ts
import { z } from "zod";
import { db } from "@/db";

const CreateInvoice = z.object({
  clientId: z.string().uuid(),
  amountCents: z.number().int().positive().max(50_000_00),
  note: z.string().max(500).optional(),
});

export async function POST(req: Request) {
  const parsed = CreateInvoice.safeParse(await req.json());
  if (!parsed.success) {
    return Response.json({ error: "Invalid input" }, { status: 400 });
  }
  const user = await requireUser(req); // 401 if absent
  // Ownership check on the object, not just the route (kills IDOR)
  const client = await db.client.findFirst({
    where: { id: parsed.data.clientId, ownerId: user.id },
  });
  if (!client) return Response.json({ error: "Not found" }, { status: 404 });
  const invoice = await db.invoice.create({
    data: { ...parsed.data, ownerId: user.id },
  });
  return Response.json(invoice, { status: 201 });
}

The vault: secrets and dependencies

Two facts define the secrets problem. GitGuardian found 23.8 million fresh secrets on public GitHub in one year, and 70 percent of secrets leaked in 2022 still worked years later. Nobody rotates. Your rules: secrets live in server-side environment variables or a manager like Doppler or 1Password, never in code, never in the client bundle. In Next.js, the NEXT_PUBLIC_ prefix inlines the value into JavaScript shipped to every visitor; a NEXT_PUBLIC_OPENAI_KEY is a donation. Wire gitleaks as a pre-commit hook and a CI step so a pasted key never reaches a commit, and when one leaks anyway, rotate it that hour: scanning bots read the commit feed faster than you read your email.

Dependencies are the door AI opened wider. A USENIX 2025 study of 576,000 AI-generated code samples found 19.7 percent of recommended packages did not exist, and the fake names repeat across runs, which makes them reservable. Attackers register the hallucinations and wait; the technique got a name, slopsquatting. Meanwhile the real supply chain got hit for scale: the September 2025 chalk/debug compromise poisoned packages with two billion weekly downloads, and the Shai-Hulud worm self-replicated through maintainer tokens. Your countermeasures are boring and effective:

# Before adding anything an agent suggested:
npm view <pkg> time.created downloads   # new + low-download = walk away
# Lockfile discipline:
npm ci                                  # never bare `npm install` in CI
npm audit --audit-level=high
# Behavioral analysis on every PR:
#   Socket.dev app (free for OSS) flags install scripts, network calls
# Updates on a fuse, not a firehose:
#   Dependabot/Renovate with a 7-day cooldown on new releases

The cooldown matters more than it looks: researchers caught the big 2025 npm attacks within days, so the packages that hurt you are the ones you adopted within hours of release.

The leaks: error handling, information leakage, file uploads

Errors leak by default. A raw stack trace hands an attacker your file paths, framework versions, and query shapes; a raw ORM error hands them your schema. The pattern that fixes it: one global handler, generic message plus an error ID outward, full structured detail inward to logs the attacker never sees.

// app/api/_lib/handler.ts
import { randomUUID } from "crypto";
import { log } from "@/lib/log"; // pino, JSON output

export function withErrorBoundary(fn: (req: Request) => Promise<Response>) {
  return async (req: Request) => {
    try {
      return await fn(req);
    } catch (err) {
      const id = randomUUID();
      log.error({ id, err, url: req.url }); // full detail, server-side only
      return Response.json(
        { error: "Something went wrong", id },   // nothing else leaves
        { status: 500 },
      );
    }
  };
}

Information leakage is the same disease in a dozen small forms, so run the checklist. Production source maps off. Framework debug pages off. Confirm /.env, /.git, and backup files return 404 from the public internet, because EMERALDWHALE-style crawlers request them from every host they meet. Security headers on (CSP, HSTS, X-Content-Type-Options, frame-ancestors). And the big one for the Supabase generation: Row Level Security on for every table, with policies you have tested from a logged-out client. The Lovable CVE existed because client-side checks feel like security while the REST endpoint answers anyone; Lovable's own scanner, added after the disclosure, checks whether RLS exists and cannot tell you whether it is correct. Yours must be both, and the test is one curl command at your own API with no cookie attached.

File uploads collect every mistake in one feature. The client-supplied MIME type is a suggestion; the extension is a costume. Read the magic bytes, cap the size, re-encode every image through sharp (which strips EXIF GPS data and any embedded payload in one move), give the file a random name, and store it in a private bucket served through presigned URLs on a separate origin. Treat SVG as executable code, because it is: an SVG upload rendered inline is a stored-XSS vector.

// app/api/upload/route.ts
import { fileTypeFromBuffer } from "file-type";
import sharp from "sharp";
import { putObject, presign } from "@/lib/storage";

const MAX_BYTES = 5 * 1024 * 1024;
const ALLOWED = new Set(["image/jpeg", "image/png", "image/webp"]);

export async function POST(req: Request) {
  const user = await requireUser(req);
  const buf = Buffer.from(await req.arrayBuffer());
  if (buf.byteLength > MAX_BYTES) {
    return Response.json({ error: "Too large" }, { status: 413 });
  }
  const kind = await fileTypeFromBuffer(buf); // magic bytes, not headers
  if (!kind || !ALLOWED.has(kind.mime)) {
    return Response.json({ error: "Unsupported type" }, { status: 415 });
  }
  const clean = await sharp(buf).rotate().webp({ quality: 82 }).toBuffer();
  const key = `u/${user.id}/${crypto.randomUUID()}.webp`; // no user filenames
  await putObject(key, clean, "image/webp"); // private bucket
  return Response.json({ url: await presign(key, 3600) });
}

One more door opens if you ship an AI feature inside your product, and it will define the next decade of breaches. Simon Willison named the "lethal trifecta": an agent holding private data, exposed to untrusted content, with a channel to the outside world, can be tricked into stealing for the attacker, and prompt injection remains unsolved. So never grant all three to one agent. Your support bot can read tickets and docs (untrusted content + private data) as long as it cannot send email or call tools that write. Treat model output as user input: escape it, validate it, never eval it, never render it as raw HTML.

Layer 3: The company around the code

Survive launch and the job mutates. Your calendar fills with everything except building: support email, a one-star review that stings at 11pm, deferred marketing, dependency alerts, a bug report you cannot reproduce, the refactor you owe yourself. Solo builders burn out here, in the fragmentation, long after they proved they could ship. The fix: stop being the worker at every station and build three desks, each run by agents on schedules, each reporting up instead of interrupting you. The apparatus costs less than a phone plan at first: solo stacks run $73 to $120 a month at early revenue, $200 to $500 once the product earns five figures, reviewers and monitoring included.

The review desk

Order matters at this desk. Deterministic scanners go first because they never hallucinate; AI reviewers go second because they catch what pattern-matching cannot; you go last, on the risk paths only. The AI reviewer market matured fast. CodeRabbit reviews every PR for $24 a month and gives its CLI away free. OpenAI's Codex review went GA in September 2025 and, in OpenAI's words, "reviews the vast majority of our PRs, catching hundreds of issues every day." GitHub reported in March 2026 that Copilot has run 60 million reviews and touches more than one in five code reviews on the platform. Pick one, plus Anthropic's open-source security-review Action, which reads your diff for injection, auth flaws, and hardcoded secrets, and filters its own false positives before commenting. Cross-model review turns automatic here: your writer model opens the PR, a rival vendor's model reviews it, and their disagreement lands as a comment thread instead of a production incident.

The entire desk is one workflow file:

# .github/workflows/ci.yml
name: gate
on: [pull_request]
jobs:
  checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: "pnpm" }
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck && pnpm lint && pnpm test
      - run: npm audit --audit-level=high
      - uses: gitleaks/gitleaks-action@v2        # secrets in the diff
      - run: pipx run semgrep scan --config auto  # SAST rules
  security-review:
    runs-on: ubuntu-latest
    steps:
      - uses: anthropics/claude-code-security-review@main
        with:
          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}

Protect main so nothing merges red, including your own agents. Steinberger can commit straight to main because he watches the stream all day; your version of his local CI is this file, and it works while you sleep.

The watch desk

Production is the only reviewer that never misses, so pipe its opinions somewhere useful. Sentry (or any error tracker) catches exceptions; a small scheduled agent reads the night's new errors each morning, clusters them, and files reproductions for anything new. Uptime monitoring pings your critical paths. Dependabot runs with a seven-day cooldown so you inherit patches without inheriting worms. Token-spend alerts guard the LLM bill. Then one weekly maintenance session, agent-driven, thirty minutes of your attention: dependency audit, secret-rotation check, dead-code sweep, slowest queries. OpenClaw runs this pattern at open-source scale with ClawSweeper, a bot that sweeps every issue and PR weekly and proposes closures; the project that taught everyone about exposed control panels also shows self-maintenance done right.

The front office

The bottlenecks nobody puts in a stack diagram: reading email, digesting customer feedback, producing marketing, answering support. Each is a reading-and-drafting job, delegable to an agent under one iron rule: front-office agents draft, they never send. An inbox agent reads overnight mail and hands you five drafted replies with a one-line summary each; you approve or rewrite in minutes. A feedback agent clusters reviews and support messages into themes and files the recurring complaint as a GitHub issue with the customer's words attached. A marketing agent turns the week's changelog and real usage numbers into two draft posts in your voice, and you spend ten minutes making them true. Steinberger's assistant reads his mail and manages his calendar; his security advice doubles as your architecture rule: "If you make sure that you are the only person who talks to it, the risk profile is much smaller." Front-office agents read strangers' text all day, the opposite of that safe condition, so they operate with the trifecta broken on purpose: no secrets, no shell, no send permissions, drafts into a queue only you flush.

All three desks converge on one artifact, the daily brief: shipped, broke, waiting-on-you. One message every morning, assembled by a scheduled agent. If the brief takes you more than five minutes to act on, a desk needs better automation; if you stop reading it, you became the vulnerability.

The 30-day install

Knowledge without a deadline is entertainment, so here is the install schedule. Each week fits around a day job.

Week 1, the build layer. Write the constitution tonight; twenty minutes, template above. Add the two hooks tomorrow. Spend the rest of the week practicing the rhythm: plan mode first, one task per session, failing test before implementation, fresh session per task. Kill any session after two failed corrections.

Week 2, the defense layer. One door per evening. Monday: rate limits on every API route plus a spend cap. Tuesday: Zod at every boundary, and grep for string-built SQL. Wednesday: gitleaks pre-commit, bundle-grep for keys, rotate anything that has ever touched a commit. Thursday: lockfile discipline, Socket or audit in CI, cooldown on updates. Friday: the error boundary and structured logs. Saturday: headers, source maps off, RLS policies tested logged-out. Sunday: the upload pipeline, magic bytes to sharp to private bucket.

Week 3, the review desk. Commit the CI workflow. Turn on branch protection. Pick one AI reviewer and wire the security-review action. From now on, agents open PRs instead of pushing, and you read every diff line that touches auth, money, deletion, or uploads.

Week 4, the operations layer. Sentry plus the morning triage agent. Uptime checks. The inbox agent, draft-only. The daily brief. Then schedule the ritual that keeps the system honest: a monthly red-team hour attacking your own app. Curl every endpoint logged out. Swap object IDs in requests. Upload a text file renamed to .png, then an SVG. Grep your client bundle for sk-. Request /.env from production. Every hole you find becomes a spec, which the gated loop closes by Friday.

Two laws survive after the month, and they are the whole article compressed. Never ship a diff you could not explain to a stranger, and never give one agent private data, untrusted input, and an exit at the same time.

The builders at the top of this piece are not typing faster than you. Steinberger put the actual constraint in one line: the amount of software he can create is limited by inference time and hard thinking. Inference time is for sale. The system above is how the hard thinking becomes product, and it starts with a markdown file you could write before you sleep tonight.