Author
Theo Lindqvist covers the tools and technology choices behind one-person products. Pen name; see our Editorial Policy.
Bannerbear's founder recorded the flat 18 months as carefully as the good ones. The two changes that ended the flat line were a rebuild as an API and a price that went from $9 to $49.
Danny Postma wrapped a public image model around one job people already pay for. The programme that pays reviewers to recommend it brings in a reported $50,000 a month by itself.
Emmanuel Crouvisier added a Pro tier to his credit card app at the last minute. Within a year it was earning more than his day job, on costs he puts in the hundreds per month.
Shared conversations and Artifacts turned up in search results this week. On a domain you do not own you cannot set a noindex tag, which leaves exactly two levers. Here are the operators to run and the revoke path for each surface.
Hugging Face says the intrusion started in a dataset loader and that public models are clean. The useful response is not panic: it is pinning every download to a full commit hash, scoping tokens per app, and refusing pickled weights.
The 2026-07-28 revision removes initialize, the Mcp-Session-Id header and stream resumability, and makes server/discover mandatory. What replaced each of them, and the order to work through your own server.
SB 2420 became enforceable on 4 June 2026 and both stores now hand developers an age category. The statute puts the duty on the developer: assign ratings, read the signal, and decide what counts as a significant change.
The codex-security CLI is open source and gated to approved customers. Here is what a one-to-five person team can install this afternoon instead, with the free-tier limits and per-contributor costs that decide it.
ShipFast took about a week to package and, per Starter Story, made $528,000 in four months. Lou's own public dashboard now shows it as the fifth line in his portfolio at $4.8k a month.
Text a human never sees is text a model still obeys. If your product summarises uploaded files, tickets or web pages, the exposure is not the hidden instruction, it is what the model is allowed to do after reading it.
A researcher typed a base path into a browser and got a directory listing of unguarded internal endpoints. The class of bug is OWASP API5, the most boring one there is, and the audit for it fits in an evening.
A federal judge dismissed both of Google's DMCA claims against SerpApi on 20 July 2026. The reason was not that scraping is legal: it was a clause in section 1201 that almost no site owner has read.
Kimi K3's open release landed on Hugging Face today. Published GPU rental and API prices put the crossover at roughly 4.2 billion tokens a month against Kimi's own API and 46 billion against DeepSeek V4 Pro. Here is the arithmetic, with the duty-cycle and caching adjustments most comparisons skip.
A report this week described the relay market that proxies frontier model access at a fraction of list price. The arithmetic says where the money comes from, and Anthropic's terms say who pays when a key leaks.
Balsamiq launched in June 2008 and its founder reported profitability within three weeks. Eighteen years later it is still bootstrapped, and its 2024 revenue was $6.58 million, down 6%.
One switch became three, free on every plan, with new-domain defaults changing on 15 September. The Googlebot trade-off that makes one of the three expensive, a setting matrix by site type, and the exact dashboard path.
In March 2014 a Dutch developer promised to launch one product a month for a year. A decade later he publishes six-figure monthly revenue from products he still builds alone.
In July 2025 the Swedish company Lovable announced $100 million in annual recurring revenue, roughly eight months after launch. The growth looks like an accident. The channels it came through were chosen deliberately.
Before Zapier launched publicly, three founders in Missouri had already taken money from 800 people. The channel was free, public, and sitting in other companies' support forums.
Buffer launched on November 30, 2010 and had a paying customer within days. The famous landing page test that preceded it is widely imitated and almost always copied wrong.
OpenAI's worldwide outage this morning lasted about 50 minutes. The published uptime numbers say this is routine, the SLAs pay in credits, and a working fallback path is an afternoon of work rather than an architecture project.
From September 30, apps must be registered by a verified developer to install in four countries, with global rollout in 2027. The dates, the $25 versus free account decision, and what verification leaves alone.
A rejection is not a verdict, it is the start of a documented process most developers never read. Fix and resubmit, reply, appeal, expedite: what each lever is for, the exact screens, and the timeline math for your launch.
A developer asked Codex for a homepage redesign and got his entire git history uploaded to OpenAI infrastructure. The training and retention switches in Copilot, Claude Code, Cursor and the OpenAI API, with exact paths.