... suggestions. Advisory by default. It flags; a human makes the merge call. Works next to your AI reviewer, not instead of it. It connects to CodeRabbit through MCP. Free to try. Scan a small public repo at tomosu.ai/start , VS Code: https://marketplace.visualstudio... Cursor / Antigravity (Open VSX): https://open-vsx.org/extension/t... We'd love your feedback ...

... hours, data egress, and 15 days of data retention. You can add as many users, projects, and deployments as you want. It's great for development when you're building an agent. When you're ready to ship to prod, or are monitoring your agents in prod

... Spent way too long this week watching devs debug Paddle billing issues that never reproduced locally. The pattern keeps repeating: subscription.activated arriving before subscription.created in prod, about 30% of the time. Handlers look clean, pass unit tests, handle retries correctly. But they assume events arrive in order. Paddle's sandbox just doesn't reproduce that chaos. This comes up constantly with teams building on Lovable, Bolt, Base44. The AI writes the webhook handler, it looks solid, gets shipped. Then prod

... wired, the retry logic is there, but nobody ran a confirm capture webhook fire sequence before going live. Testing is either skipped or scripted in isolation against mocked responses that don't reflect real API behavior. What does prod surface? The edge cases. Rate limits, flaky webhooks, card declines mid-flow, double-charges on retry. The stuff that only shows up when real money or real users are involved. What we're building toward: connect FetchSandbox MCP, prompt "make this ... ... survive in prod

... they give different answers. What actually helped? Re-running from identical state mattered more than I expected. Otherwise you're comparing two runs that started differently and calling it a diff. We also needed the services to behave like prod, 429s, auth failures, delayed webhooks, duplicate deliveries, without real prod

... hand: digging through traces, tuning a prompt, redeploying, hoping. The system you use to know what your agents are doing needs to be executed through the agents you use every day. This launch changes that. When something breaks in prod, you shouldn't get an alert and a spike on a dashboard. You should get the answer: what went wrong, why, and what to change. Not a debugging exercise. Not manual. Not broken by every model update. Today Prefactor lets ... ... Evaluate agents in development using production or synthetic data. Bring your own evals or use Prefactor's heuristics and technical metrics, and track designed behaviour against actual. Move agents from dev to prod

... held. That's what I'm building FetchSandbox around: reproduce the real failure, apply the fix, then prove it holds on your actual code before you ship. For those shipping AI-written integrations, are you catching this stuff before prod, or mostly finding out when something quietly breaks? Comment from Hossein Yazdi(@hosseinyazdi): The scary part is that none of these failures look like failures from the outside. Returning 200 and passing the happy path can hide a lot. Reproducing ... ... actual failure before shipping feels much more worthy than just adding more tests. Comment from Ghost Kitty(@ghost-kitty-10133997): Comment Deleted Comment from Arnold Oshenye(@oshylabs): Mostly catching it before prod

... second. so how do you even reproduce it? I stopped reading and started running. took a real express and postgres billing app, replayed the scenario in a sandbox: same stripe webhook, delivered twice, like a real retry. no prod involved. the buggy handler provisioned seats 1, then 2, then 3. signature verification was clean throughout. what did the fix look like? fixed it, reran. seats held at 1, 1, 1. two deliveries, one provision. the receipt was clear: before ... ... prove the fix on actual code using the one input code review can't simulate: the retry. how are you catching at-least-once bugs today? staging with live webhooks, a replay harness, or do you find out in prod

... five-minute end-of-day check, what actually happened, what I made up, what I'll do tomorrow, catches the spiral before it compounds, the same way a code review catches the subtle bug before it's in prod. The tools that used to gate building are gone, which is a real gift. But it means the constraint that's left is you: your attention, your judgment, your ability to stay steady when the feedback is loud and instant ... ... that. The only recovery rule I keep: never judge two days' numbers at once to catch up that's just the mid-build spiral wearing a productivity costume. Comment from Omri Ben-Shoham(@omri_ben_shoham1): the make mode vs

... watch it hold. Agents probably make this worse because they learned from the same quickstarts that only imagined one clean event. Curious what broke for you A bug that sailed through review and CI but still blew up in prod, and what would have actually caught it? (This is the itch I'm building FetchSandbox around, running the failure before customers do.) Comment from Gal Dayan(@galdayan): the "my tests didn't catch it because I wrote the fixtures" line ... ... layered: reconciliation to catch what slips through, plus something faster and cheaper checking the hot path so most of it never reaches that stage Comment from Raj Nagulapalle(@rnagulapalle): @omri_ben_shoham1  honestly.. we caught it pre-prod

... keep seeing across every AI coding community: an agent gets told not to touch something, then touches it anyway. it just never had a wall there, only a request in its instructions it decided didn't apply this time. Prod env vars gone, a repo gone, a folder that took years to build, empty. The model agreed not to do it and did it, because agreeing and being unable to are different things, and only one of them survives ...

... Velocity is great, but I've noticed I trust my own understanding of the codebase less than I used to - I'll touch one file and have no real sense of what else depends on it until CI (or prod) tells me. Ended up manually tracing imports before merging anything non-trivial, just to make sure I'm not breaking something three files away. Anyone else running into this, especially with AI-assisted code? Curious if it's a real ...

... Been going back and forth on this. Right now my setup lets Claude Code run migrations and seed scripts directly against a local dev database, but I've kept it firewalled off from ever touching staging or prod, even read-only. Everything that reaches prod

... rather be useful than hypey. Here's the honest map: what we test, what we don't (yet), what languages it works with, and where we're going. The failures we test for (the "it passed, then broke in prod" stuff): Double-processing the same webhook arrives twice; do you charge the customer twice? Out-of-order / late events a "canceled" and a stale "active" land in the wrong order; does a canceled account come back to life? (live ... ... being straight): Pinned/frozen scenarios our fixtures are still mutable on our end, so an update from us can shift your result. No lockfile yet. Drift detection we don't yet warn you when the real API changes shape vs

... edge than timing, honestly. ..today the generator works from the code path + known failure classes, not your real data distributions .. it doesn't peek at samples. What it can do is reason about what the code assumes vs. what it guards: if a handler does float(row['amount']) with no type check, "amount is sometimes a string / sometimes null" is exactly the shape it'll try, because the fragility is visible in the code even when the distribution ... ... type-coercion is a known class, so that one it'd likely catch. What it can't do is know a shape that only lives in your prod

... otherwise have shipped. We spent days trying to break our own work: malformed inputs, adversarial routing, the proof path itself. Every real bug we found (including two inside the chaos-order feature, caught by proving it on prod) we fixed before shipping. What's still rough (because you'll ask)? A couple of integrations we can't measure yet, the public bug corpus is too noisy. We'd rather say that than fake a number. Proof against your actual code ... ... second reviewer" isn't real yet as a solo founder. what i'm working toward is explicit criteria for what makes a red-team scenario valid: maps to a known failure mode, the API actually behaves that way in prod

... myself. a bunch of you basically handed me my roadmap. I built this because.. i kept watching ai agents write stripe and auth integrations that passed every test and then broke on the first real webhook. green ci, prod on fire. i wanted a layer that runs the full integration lifecycle before prod

... thing: make FetchSandbox something you can actually gate a release on. not "looks tested" but provably tested. what changed: bulletproofed 5 integrations end to end: Stripe, Clerk, Descope, Resend, AgentMail. tested against how these APIs actually break in prod (webhook retries, out-of-order events, fresh-resource races), not made-up failures. Paddle got the deepest treatment:v we now throw webhook events at your billing handler out of order, duplicated, and stale, then hand back the exact sequence that ...

... three bugs an ai wrote for me this week. every test green. all three would've paged me in prod: webhook retried charged the customer twice subscription.activated arrived before subscription.created they paid, app said not entitled a stale event flipped a canceled sub back to active free access, forever none of these show up in a 200. you find them from a customer or you fire the ugly event orders on purpose and find them first. we now throw every ... ... myself. be honest ...) Comment from Gal Dayan(@galdayan): #2, the out-of-order one. we had a subscription webhook handler that assumed events arrived in the order they were created, because in dev/staging they basically always did. in prod

... would want to know from your Friday: was there a signal present that nobody was watching, or was there no signal at all? Those are different builds. Comment from Dale Mooney(@dalemooney): @alex_amancio_candoa_   @aadilghani  Constant versus invariant is the useful thing here and I am taking it. One addition: you cannot separate them by observation, but you can by deliberately violating the constant once. A property that survives a test faking an unattended caller ... ... nothing, the reviewer's normal experience becomes an empty screen, and empty screens train people to expect empty. Whether the one that is not empty gets read properly on day forty is an open question. It still beats the alternative

... move on. Then one day the agent quietly changed a timeout value in a config file while it was "cleaning up," totally unrelated to what I asked for. Nothing broke locally, so it shipped. Took three days in prod before anyone noticed requests were timing out way faster than before. Now I read every diff like I'm reviewing a junior dev's PR, even the boring stuff that feels too small to matter. Slower, but I haven't gotten ...

... Hey everyone, I got tired of budgeting apps charging a monthly fee to categorize my own transactions often by sending ...

... genuinely cleaner, but because now I've burned review time on code that wasn't broken, and there's a small chance the agent introduces a subtle behavior change I won't catch until it's in prod. So now my rule is basically: only refactor if I'm already touching that code for a real feature reason, never as a standalone cleanup pass. Curious if other people have a clearer line than that, or if you just ...

... talking about the obvious stuff like "don't rm -rf prod", more the gray area tasks where the agent is probably right but you still want eyes on it before it goes out. for me it's anything that changes a pricing table or a billing calculation. I'll let an agent refactor half my codebase overnight, but the second a PR touches how much someone gets charged, I read every line myself even if the diff is three characters ... ... technical guardrail on though, since there's no diff to review, it's a judgment call the agent can't really be gated on the way a permissions PR can. Curious how you actually enforce that one in practice versus

... audit trail. It's model-agnostic and works with Node, Python, LangGraph, and Claude Code. You can wrap your dangerous tools in about 3 lines of code. Who it's for: Devs/Platform teams deploying autonomous agents with access to prod systems who need to get past their AppSec/CISO review. It's free to test right now. Would love for you to tear it apart and give me feedback on the architecture. Live app & docs: https://relay-security-lemon.ver... What ... ... guys think about the "deterministic vs