Connect with the Product Hunt community

I was about to buy a custom domain to put Cloudflare in front of my Supabase project. Then I read the documentation properly and found the line that killed the plan.

When you set up a custom domain, the original project URL stays live. The docs say you can use both interchangeably. And the project ref isn't a secret it ships in the browser bundle, because that's how the client connects in the first place.

So the proxy is optional for an attacker. Open devtools, read the original hostname, talk to the database directly. I'd have paid monthly for something that protects the URL in the address bar and nothing else.

The uncomfortable part is what that implies more broadly. The entire appeal of this architecture is the browser talking straight to the database. Which means every request that matters login, reads, writes, uploads never touches my application server. A WAF in front of my app protects my landing page.

Fifteen years ago a study went back through 1,694 merges in three open-source projects with runnable test suites. 76% merged clean and stayed fine. 16% hit a textual conflict, the kind with conflict markers. And another 1% and 6% merged clean, no markers, nothing to resolve, then broke the build or failed the tests. Of all the conflicts in that study, a third were ones the VCS had reported as a clean merge.

We wanted to see what it looks like with two coding agents in two git worktrees, which is what the coding CLIs' docs offer for running work in parallel. Ten times we made a base commit, gave two agents one worktree each and two tasks that never mention each other, one of which quietly depends on the other, one renaming a field the other one reads, one changing a file format the other one parses. Both agents ran the tests before finishing. All twenty worktrees were green.

Git stopped five of the ten merges with conflict markers. It passed the other five as clean, and the merged tree failed the combined suite in all five. The failing tests were always the second agent's own, unchanged, green minutes earlier in its own worktree. One pair we ran twice and got both outcomes: the model placed a new block of code one line away from the other agent's edit and git merged; placed it directly below, git flagged a conflict.

A merge compares hunks of each file with their common ancestor and knows nothing about callers or field names. A worktree guarantees each agent never reads the other's edits, which is exactly why the two changes first meet at the merge. Recent papers on agent PRs report 20-42% textual conflict rates, and even they admit that's just a lower bound.

In August one coding-agent CLI's release note took its task-tracking tools away from its newest models and kept them for the older ones, with an environment variable to reverse it. The note gives no reason. A component study posted in mid-September is the nearest thing to the arithmetic behind a call like that: a harness part is built to cover for something the model does badly, and the same part does a different job once the model stops doing that thing badly.

The study held an agent loop fixed and swapped parts across four models of different size. Its planning scaffold, a plan re-injected every turn, added 11.6 points on the repository benchmark for the smallest model, whose median run otherwise ended after five turns, two runs in three without an edit. For the largest it trimmed cost by about 30% with a two-point drop in success, because what it cut was verification the model would otherwise keep doing. A predefined tool set showed the same crossover: worth 15 points to the small model on the repository benchmark, while the large one did better there and 53% cheaper with bash alone, bundling several edits into one script.

Our reading: whether a part helps is a question about the model, the task and the budget; what the part costs, in tokens on every turn, is charged whatever the answer. A part that was right when it shipped can be wrong a model generation later without anyone touching it.

We tried the smallest version on our own setup: one small task, one model, fifteen runs, five under each of three tool lists. Every run passed the same four checks. With the task-tracking tools switched back on, the model was offered them in every run and called them zero. With bash alone it finished in a median of 10 turns instead of 17, and the first request carried a quarter of the context. We kept the typed file tools on anyway, because path permission rules attach to them and cannot see inside a shell script.

One of the harder parts of product design for me isn t choosing between a good and bad option.

It s choosing between two reasonable options when there isn t enough data to tell you which one is better.

User feedback helps. Analytics help. Testing helps. But sometimes the decision needs to be made before you have enough of any of them.

At that point, the decision usually comes down to product context, existing patterns, and judgment.

Hi everyone,

I have been researching and building a mobile utility for field contractors and service workers. During the development process, one major architectural decision came up: Cloud vs 100% Offline.

Many field professionals (contractors, technicians, inspectors) work in areas with poor or zero cellular coverage. Cloud-based SaaS tools often freeze or fail to sync in these conditions.

On the other hand, an offline-first approach keeps all data, documents, and photos strictly local on the device, ensuring instant speed and complete privacy.

Yep, the title says it all, and if you don't believe me, have a look https://x.com/im_dimneo/status/2...
Try it yourself, and let me know what else you got the AI to do for you.

I launched my first product here cold, with no audience and no pre-launch community.

It got real feedback, which I'm grateful for. But once launch day ended, traffic dropped to almost nothing, even though I've kept posting consistently.

My takeaway: solving a problem gets people to try your product, but it doesn't bring them to you. That part is distribution, and I skipped it.

For makers who've launched a second time: what did you do differently before relaunching?

Imagine joining a first-round interview. There s no recruiter on the call. An AI asks the questions, records your answers, and evaluates your responses.

You open an AI assistant to help organize your thoughts.

Years ago, devs understood memory, protocols, and performance. Today, half our job is fighting version mismatches in node_modules.

Importing a 15MB package just to format a date string isn't engineering it's stitching together black boxes we don't fully understand.

How much actual CS knowledge do you use daily versus just gluing third-party libraries together?

Every dav team claims they care about clean code. Until a deadline hits. Then hacky workarounds become permanent architecture.

"Later" never comes. We just stack patch after patch on Friday afternoons, burning out the team on bugs that shouldn't exist in the first place.

At what point does "moving fast" just become bad management?

I spent hours last week re-checking an agent's work because it skipped core steps from a spec I explicitly approved.

Having to manually audit thirty different file changes completely defeats the point of automating the build.

Now I write a separate reference file directly from existing code and force the runner to compare against it before marked complete.

How do you handle automated coding tools going off-script without spending all your time reviewing PRs?

I spent hours last week re-checking an agent's work because it skipped core steps from a spec I explicitly approved. Having to manually audit thirty different file changes completely defeats the point of automating the build.

Now I write a separate reference file directly from existing code and force the runner to compare against it before marked complete.

How do you handle automated coding tools going off-script without spending all your time reviewing PRs?

Been running a research agent (LangGraph + GPT-4o + Playwright) for competitive analysis. The pattern that kept hitting me:

• Hop 1: works fine. Agent searches, gets results, moves on.

• Hop 2: usually fine. Agent finds a reference, chases it.

• Hop 3: this is where it falls apart.

What I'm seeing at hop 3+:

• The agent re-queries with slightly different phrasing, gets near-identical results, doesn't recognize the overlap

• Context window is now 40k+ tokens of raw search results and the model starts ignoring its own instructions

• It either loops (same query, rephrased) or gives up and synthesizes from whatever's in the window, including irrelevant stuff

• When it does find a new source, it loses track of which claim came from which URL

I'm a solo founder. I make an LED light therapy mask, and I decided early that I wanted FDA 510(k) clearance rather than selling it as a generic beauty gadget. Many LED masks sold online aren't FDA-cleared at all, which tells you something about how painful the process is.

Twelve months. Roughly $140K. One person.

The single most expensive mistake I made was assuming a testing lab is a testing lab.

I picked one based on price and turnaround. Their reports looked professional. What I didn't check was whether their accreditation actually covered the specific standards my submission needed. It didn't. The data was unusable, and I had to run the testing again somewhere else months gone, and a large chunk of that $140K was just paying twice for the same tests.

When an AI agent creates a pull request, I usually want to check the diff, tests, error handling, and whether it followed the existing project patterns before merging. I m curious how other developers handle this. Do you review AI-generated PRs differently from code written by another developer?

I ve noticed coding assistants sometimes suggest a library for something that could be handled with the existing stack. That can slowly add unnecessary dependencies to a project. Do you have a rule for deciding when an AI suggested package is actually worth adding?

I went back through my DMs with early users recently. Messages from a year ago, when the product was rough and I was excited about everything.

Reading them was strange. The enthusiasm was real. Mine and theirs. They were actually rooting for me. They gave detailed feedback. They said "can't wait to see where this goes."

Almost all of them are gone now. Not angry. Just gone. No goodbye messages. Just silence.

I don't know what happened. Maybe the product didn't deliver. Maybe life got busy. Maybe they were just being nice in the beginning. I'll probably never know.

I ve found AI can build a React component quickly, but the difficult part is checking edge cases around loading states, empty data, validation, and responsive layouts. Do you have a specific testing workflow you follow before putting AI generated components into production?

I was testing an app recently that relied almost entirely on text prompts to navigate and edit settings. While it made initial onboarding really fast I quickly lost track of what the tool could actually do because there were no menus to explore.

I feel like prompt bars are great for complex execution, but visual layouts are still essential for checking data accuracy and seeing your workflow at a glance.

Where do you draw the line when deciding which features belong in a chat box vs a standard screen layout?

I ve been comparing the workflow of using React Server Components with a more traditional client rendered React setup. Server Components can reduce the amount of JavaScript sent to the browser, but they also change how I think about data fetching and component boundaries. For people building production apps, which approach has fit your workflow better and what tradeoffs have you noticed?

I spent weeks convinced I was spending most of my day writing code and talking to customers. Decided to log everything in a sheet for a month, and the numbers proved I was completely lying to myself.

Half my time went to emails, organizing task boards, and watching tutorials I didn't need yet.

Has anyone here confronted bad time habits with real data? Curious what changes you made that actually stuck.

Plan mode in coding agents sounds great on paper but actual implementation almost always deviates from the approved scope. Unwanted refactoring and premature "task finished" triggers are huge productivity killers.

Some developers use a second agent instance purely as a linter/checker, while others restrict execution to ultra strict prompt specs.

For those running agentic workflows daily: what setup has actually worked to keep implementation locked strictly to your initial plan

A lot of people say that posting daily updates on social media keeps you accountable when building a product alone.

However spending time crafting social posts can easily turn into fake productivity.

It feels like real work but it often takes focus away from actually shipping features and fixing product issues.

It seems like private accountability with a few trusted peers works way better than posting publicly.

Setting up custom domains and polished copy gives a quick psychological win but it does not validate whether a problem is worth solving.

On the flip side launching with broken branding or a generic domain can sometimes lower trust for early signups.

Where do you draw the line between looking professional enough to test an idea and burning cash on a product nobody wants?