# The Production AI Stack for Solo Builders
**作者**: Rohit
**日期**: 2026-07-19T16:29:45.000Z
**来源**: [https://x.com/rohit4verse/status/2078879981271404575](https://x.com/rohit4verse/status/2078879981271404575)
---
One-person companies now ship like ten-person teams. The ones that survive run a system: a build loop the model cannot lie to, a defense layer attackers cannot walk through, and operations that run while the founder sleeps. This is that system, end to end.
In March 2025, a SaaS founder who goes by Leo posted the tweet every builder wants to post. His product, Enrichlead, was live. Cursor had written it. "Zero hand written code," he announced. "AI is no longer just an assistant, it's also the builder." He signed off: "P.S. Yes, people pay for it."
Four days later he posted again. "Guys, i'm under attack. Random things are happening, maxed out usage on api keys, people bypassing the subscription, creating random shit on db."
Attackers had found everything the model never mentioned. API endpoints with no server-side auth. A paywall enforced only in the browser. Inputs written raw into his database. He patched with more prompts. They broke it again. The product died within weeks.
You laughed at Leo when that screenshot crossed your feed. Sit with a less comfortable fact: the distance between his stack and yours is one unchecked box.
The pattern repeats at every scale. In July 2025, the Tea app, a viral safety app for women, left a Firebase storage bucket open to the public. Around 72,000 images leaked, including 13,000 verification selfies and government IDs. Days later a researcher showed a second hole: 1.1 million private messages about infidelity, abortions, and meetups, readable by any authenticated user. Same month, a Replit agent working on SaaStr's codebase deleted the production database during an explicit code freeze, then fabricated some 4,000 fake records and passing test results to cover it. In spring 2025, researcher Matt Palmer scanned 1,645 apps published with Lovable and found 170 of them leaking emails, phone numbers, addresses, and API keys through one shared flaw: Supabase Row Level Security, off or wrong. The flaw became CVE-2025-48757, rated 9.3 critical.
The measured baseline is worse than the anecdotes. Veracode tested over 100 models across common coding tasks in 2025: 45 percent of AI-generated samples contained an OWASP-class flaw, 72 percent for Java, and the models defended against cross-site scripting in only 14 percent of cases. Newer, bigger models scored no better. A Stanford team that included Dan Boneh found the human half of the problem: developers using an AI assistant wrote less secure code and believed they had written more secure code. GitGuardian counted 23.8 million new secrets leaked on public GitHub in 2024 alone, and repos with Copilot enabled leaked about 40 percent more often than average. When Escape.tech scanned 5,600 vibe-coded apps in late 2025, it pulled out 2,000 vulnerabilities, 400 exposed secrets, and live medical records, most reachable without logging in.
One more number, because it changes how you picture your enemy. In 2024, a criminal operation called EMERALDWHALE harvested credentials from 67,000 exposed .git directories: 15,000 working cloud keys, stolen without a single clever exploit. Nobody targeted those apps. Scripts found them. Your app gets probed the same way, within hours of the domain resolving, by bots that request /.env and /.git/config all day, every day.
The trap of 2026 is precise. The model compressed "idea to demo" from months to a weekend. It did nothing to compress "demo to production," and it made the gap invisible, because the demo looks finished. Code that runs and code that survives contact with strangers are different products. Every incident above lives in that gap.
## Typing was never the job
The standard reaction to those stories is to blame vibe coding and tell builders to slow down. That reading misses what changed: typing was never the job. The job was always judgment: deciding what to build, verifying it works, defending it, operating it. AI removed the typing and left the judgment. Most solo builders responded by removing the judgment too, because nothing in the tooling forces you to keep it.
The builders winning right now kept it, and made it cheap by turning it into a system.
Consider the ceiling case. Peter Steinberger founded PSPDFKit in Vienna in 2011, grew it past 70 employees, took a €100 million investment from Insight Partners in 2021, exited, and burned out hard enough to spend a year in therapy remembering why he liked computers. Agents pulled him back in April 2025. On November 24, 2025, he released a personal AI assistant called Clawdbot: an agent that lives on your own machine and answers you over WhatsApp, Telegram, or iMessage. A trademark complaint forced a rename to Moltbot, then OpenClaw. By March 2, 2026, the repo had 247,000 GitHub stars, passing React. In January alone it absorbed more than 6,600 commits; the Pragmatic Engineer profiled it like a company, and Steinberger corrected the record: "This is one dude sitting at home having fun."
His workflow is the part worth studying. He runs three to eight agents in parallel in a terminal grid, most of them in the same folder, no branches, no pull requests, straight to main. He talks instead of types. "Agentic engineering has become so good that it now writes pretty much 100% of my code," he wrote in October 2025. He watches the stream, reads the parts that can hurt him, keeps main always shippable, and fixes forward instead of reverting. He wrote per-subsystem docs so agents load the right context, and built a bot called ClawSweeper that sweeps every issue and PR weekly, so the project maintains itself. His output ceiling, in his words: "The amount of software I can create is now mostly limited by inference time and hard thinking."
Now the counterweight, because OpenClaw doubled as the era's most public security lesson. Users deployed it with the control panel facing the open internet. By January 31, 2026, Censys counted 21,639 exposed instances; SecurityScorecard later found over 40,000, with 12,812 vulnerable to remote code execution. A researcher found a one-click remote-code-execution hole, CVE-2026-25253; the fix shipped within days. Moltbook, the social network OpenClaw agents built for themselves, went live with Supabase Row Level Security disabled and an API key in the client JavaScript: 1.5 million agent tokens and 35,000 owner emails sat readable until Wiz reported it. The most capable agentic engineer alive, a man with 25 years of pattern recognition serving as his review layer, shipped the same bug class as a first-week vibe coder. Velocity without a defense layer converts small mistakes into fleet-wide exposure, and no amount of talent outruns that.
Meanwhile, the commercial proof that the one-person model works kept arriving. Maor Shlomo built Base44, an AI app builder, alone: profitable at 20,000 users by March 2025, $189,000 profit in May, sold to Wix in June for $80 million in cash, six months after incorporation, about 90 percent of the code AI-written. Zach Yadegari built Cal AI as a teenager with two friends; it passed $30 million in annual revenue with seven employees and sold to MyFitnessPal. Marc Lou cleared $1 million across twelve small products in 2025, working alone. Tony Dinh's TypingMind passed $1 million a year, solo. Pieter Levels vibe-coded a browser flight simulator in public and pulled $1 million in annualized revenue within 17 days, most of it sponsor logos on in-game blimps. William Lindholm, twenty years old, built his entire B2B platform on Lovable and reached $110,000 a month within five months. Sam Altman keeps a betting pool with other CEOs on the year the first one-person billion-dollar company appears. A quarter of Y Combinator's Winter 2025 batch shipped codebases that were 95 percent AI-generated. Claude Code's own lead reports two months without hand-writing a line, and 22 pull requests shipped in one day.
Hold both truths at once: the same tool produces the leverage and the exposure. The variable that separates Shlomo from Leo is the system wrapped around the model.
## Three layers, one person
Every durable solo operation runs some version of the same architecture, whether or not the founder has ever drawn it:
1. The build layer. A loop that keeps the model honest while it writes: specs in, gated diffs out.
2. The defense layer. Seven doors attackers try on every app, each one closed by default.
3. The operations layer. The company around the code: review, monitoring, and the inbox, run by agents on schedules, reporting to you in one daily brief.
The payoff: you ship at agent speed without donating your users' data to 4chan, incidents page you instead of ending you, and the whole thing compounds, because every production error becomes next week's spec and every review finding a permanent rule the agents obey. The rest of this piece installs the layers, with the code and the diagrams.
## Layer 1: A build loop the model cannot lie to
Start with an unpopular claim: hallucination and drift are context problems before they are model problems. Andrej Karpathy defined vibe coding in February 2025 as the mode where you "fully give in to the vibes, embrace exponentials, and forget that the code even exists," and in the same breath scoped it to throwaway weekend projects. For anything with users, the failure arrives on a schedule. Chroma's July 2025 "context rot" study measured 18 models and found performance degrading as input grows, even on tasks a child could do. Anthropic's engineering team calls it a finite attention budget: every stale error message and abandoned approach still sitting in your session competes with your actual instructions. Their fix is blunt: after two failed corrections, clear the session, because "a clean session with a better prompt almost always outperforms a long session with accumulated corrections."
So the build layer has three moves: write the constitution, gate every loop, starve the context.
Move 1: Write the constitution
Agents read a memory file before touching your code. Claude Code reads CLAUDE.md, Codex and OpenClaw read AGENTS.md, Cursor reads its rules directory. This file is the highest-leverage document you will write this year, and most builders either skip it or bloat it into a novel the model skims. Anthropic's guidance gives the editing test: for each line ask, "Would removing this cause the model to make mistakes?" If no, cut it, because a bloated constitution gets ignored at the moment you need it.
A constitution for a real product looks like this:
```
# CLAUDE.md (kanso: invoice-OCR SaaS)
## Commands
- pnpm dev | pnpm test | pnpm typecheck | pnpm lint
- Never run: prisma migrate reset, rm -rf, git push --force
## Invariants (violating any of these means stop and ask me)
- Every /api handler validates input with Zod before touching the DB
- DB access goes through src/db/queries.ts. No raw SQL in handlers.
- Secrets live in server-side env vars. Nothing secret is NEXT_PUBLIC_.
- Money math uses integer cents. Never floats.
- Every new table ships with its RLS policy in the same migration.
## Boundaries
- src/billing/** (Stripe webhooks): plan first, wait for my approval
- File uploads follow docs/uploads.md exactly
## Definition of done
- Typecheck, lint, tests green. New logic starts from a failing test.
- Diffs stay under ~300 lines unless the approved plan says otherwise.
```
Then stop prompting features and start writing specs. One task per session, planned before written. Claude Code ships a plan mode (Shift+Tab) that forces the agent to read and propose before it edits; approve the plan, then let it write. For bigger builds, GitHub's Spec Kit and AWS Kiro turn this into ceremony, numbered requirements and all, though Thoughtworks' Birgitta Böckeler notes the tradeoff: spec tools generate "a LOT of markdown files" you now have to review too. The solo-builder version is lighter. Steinberger keeps per-subsystem docs in the repo so any agent picks up local context in one read. Copy that: a docs/ folder where each subsystem gets one page of intent, written by you, updated by the agent, reviewed by you.
Move 2: Gate every loop
Your constitution is advisory. The model can ignore it, and under context pressure it will. Hooks are the escalation: shell commands that fire on the agent's lifecycle, and the agent cannot skip them. Anthropic's docs draw the line in one sentence: unlike memory-file instructions, "hooks are deterministic." Two hooks change everything. A PostToolUse hook runs typecheck and lint after every edit, so a type error surfaces in seconds instead of compounding for an hour. A Stophook runs your test suite when the agent tries to declare itself finished, and exit code 2 refuses the declaration, which sends the agent back to work with the failure text in front of it.
```
{
"hooks": {
"PostToolUse": [{
"matcher": "Edit|Write",
"hooks": [{ "type": "command",
"command": "pnpm typecheck && pnpm lint --quiet" }]
}],
"Stop": [{
"hooks": [{ "type": "command",
"command": "pnpm test --silent || { echo 'tests failing: keep going' >&2; exit 2; }" }]
}]
}
}
```
Pair the gates with test-first prompting. Before implementation, have the agent write the failing test that defines success, run it, watch it fail, then implement. A test is a spec the model cannot argue with, and it outlives the session that wrote it. The alternative, asking the model whether its own work is correct, measures nothing. Anthropic's own docs warn that an LLM reviewer "prompted to find gaps will usually report some, even when the work is sound," and the mirror failure is worse: a model grading its own homework passes it. Deterministic checks, compilers, linters, tests, scanners, are the only opinions in your pipeline that cannot be sweet-talked.
Move 3: Starve the context, then cross-examine
Give each task a fresh session and the smallest context that can support it. The 2025-26 tooling wave exists to make that ergonomic. Subagents run in separate context windows and return summaries, so research trash never pollutes the implementation session; define a read-only security-reviewer subagent that can grep and read but never edit. Skills (October 2025, an open standard since that December) are folders with a SKILL.md that load into context only when relevant: write your upload-handling checklist once and every future session applies it. Plugins bundle the whole kit, commands, subagents, skills, hooks, MCP servers, into one installable unit, and any git repo can be a marketplace. Your hard-won process becomes infrastructure instead of memory.
Then cross-examine. The reviewer must not be the author. Claude Code's docs state the reason: "A fresh context improves code review since Claude won't be biased toward code it just wrote." Cheapest version: open a fresh session, or run the bundled /code-review skill, which spawns a clean subagent against your diff. Stronger version: cross-model review, Codex on Claude's diff or the reverse, because different models have different blind spots and their disagreements point at the code you should read yourself.
You will meet people running the far edge of autonomy. Geoffrey Huntley's "Ralph" technique is a bash while-loop that feeds the same prompt to an agent forever; he claims a $50,000 contract delivered for $297 in tokens. Respect the edge, and note who pushed back. Armin Ronacher wrote in June 2026 that uninterrupted loops still yield slop for code he cares about, and that the failure mode is verification drifting from deterministic tests to model judges. Simon Willison's rule survives every tooling generation: he will not commit code he could not explain to someone else. Mitchell Hashimoto ships AI-written features into Ghostty and says the quiet part: "I'm not shipping code I don't understand." At agent velocity you cannot read everything, so read like an auditor: the 20 percent that touches auth, money, deletion, and uploads gets your eyes, every time.
The whole layer fits in one picture.
## Layer 2: Seven doors, three fronts
Forget the movie hacker. Your adversary is a script that probes every new domain for the same seven doors, because those doors are open often enough to fund the scanning. Rate limiting, input validation, secrets, dependencies, error handling, information leakage, file uploads. AI-generated code leaves them open by default because the training data is full of tutorials, and tutorials skip defense to stay readable. Complexity compounds the problem, which is why Pieter Levels runs his seven-figure portfolio on PHP, jQuery, and SQLite on a single VPS: a stack he can audit in an afternoon. Whatever you deploy on, the seven doors close in a week of evenings. Grouped by front:
The front door: rate limiting and input validation
An endpoint with no rate limit is an invitation, and if the endpoint calls a model API, it is a checkbook. Leo's maxed-out keys were this door standing open; OWASP now lists "unbounded consumption" in its LLM Top 10 because token-metered endpoints turn abuse into a bill. The fix costs fifteen minutes. Key limits per authenticated user first (IPs rotate; NATs and phone carriers share them), fall back to IP for anonymous traffic, and put your platform's edge rules (Cloudflare, Vercel WAF) in front as tier zero. Then set a hard monthly spend cap and an alert at 50 percent, so the worst case is a boring email instead of a four-figure invoice.
```
// middleware.ts (Next.js edge middleware)
import { Ratelimit } from "@upstash/ratelimit";
import { Redis } from "@upstash/redis";
const limiter = new Ratelimit({
redis: Redis.fromEnv(),
limiter: Ratelimit.slidingWindow(20, "1 m"), // 20 requests/min
prefix: "rl",
});
export async function middleware(req: Request) {
const userId = await getUserId(req); // session lookup
const key = userId ?? req.headers.get("x-forwarded-for") ?? "anon";
const { success, reset } = await limiter.limit(key);
if (!success) {
return new Response("Too many requests", {
status: 429,
headers: { "Retry-After": String(reset) },
});
}
}
export const config = { matcher: ["/api/:path*"] };
```
Validation is the other half of the same door. Models trust input because example code trusts input. Production code treats every body, query string, and URL param as hostile until a schema proves otherwise. Zod at the boundary kills the whole class of "creating random shit on db" that ended Enrichlead, and parameterized queries through your ORM kill SQL injection on the same day. One rule with no exceptions: user input never gets concatenated into a query string. And if any feature fetches a user-supplied URL (webhook tester, "import from link," image proxy), block private address ranges before fetching, or attackers will use your server to read your own cloud metadata endpoint.
```
// app/api/invoices/route.ts
import { z } from "zod";
import { db } from "@/db";
const CreateInvoice = z.object({
clientId: z.string().uuid(),
amountCents: z.number().int().positive().max(50_000_00),
note: z.string().max(500).optional(),
});
export async function POST(req: Request) {
const parsed = CreateInvoice.safeParse(await req.json());
if (!parsed.success) {
return Response.json({ error: "Invalid input" }, { status: 400 });
}
const user = await requireUser(req); // 401 if absent
// Ownership check on the object, not just the route (kills IDOR)
const client = await db.client.findFirst({
where: { id: parsed.data.clientId, ownerId: user.id },
});
if (!client) return Response.json({ error: "Not found" }, { status: 404 });
const invoice = await db.invoice.create({
data: { ...parsed.data, ownerId: user.id },
});
return Response.json(invoice, { status: 201 });
}
```
The vault: secrets and dependencies
Two facts define the secrets problem. GitGuardian found 23.8 million fresh secrets on public GitHub in one year, and 70 percent of secrets leaked in 2022 still worked years later. Nobody rotates. Your rules: secrets live in server-side environment variables or a manager like Doppler or 1Password, never in code, never in the client bundle. In Next.js, the NEXT_PUBLIC_ prefix inlines the value into JavaScript shipped to every visitor; a NEXT_PUBLIC_OPENAI_KEY is a donation. Wire gitleaks as a pre-commit hook and a CI step so a pasted key never reaches a commit, and when one leaks anyway, rotate it that hour: scanning bots read the commit feed faster than you read your email.
Dependencies are the door AI opened wider. A USENIX 2025 study of 576,000 AI-generated code samples found 19.7 percent of recommended packages did not exist, and the fake names repeat across runs, which makes them reservable. Attackers register the hallucinations and wait; the technique got a name, slopsquatting. Meanwhile the real supply chain got hit for scale: the September 2025 chalk/debug compromise poisoned packages with two billion weekly downloads, and the Shai-Hulud worm self-replicated through maintainer tokens. Your countermeasures are boring and effective:
```
# Before adding anything an agent suggested:
npm view <pkg> time.created downloads # new + low-download = walk away
# Lockfile discipline:
npm ci # never bare `npm install` in CI
npm audit --audit-level=high
# Behavioral analysis on every PR:
# Socket.dev app (free for OSS) flags install scripts, network calls
# Updates on a fuse, not a firehose:
# Dependabot/Renovate with a 7-day cooldown on new releases
```
The cooldown matters more than it looks: researchers caught the big 2025 npm attacks within days, so the packages that hurt you are the ones you adopted within hours of release.
The leaks: error handling, information leakage, file uploads
Errors leak by default. A raw stack trace hands an attacker your file paths, framework versions, and query shapes; a raw ORM error hands them your schema. The pattern that fixes it: one global handler, generic message plus an error ID outward, full structured detail inward to logs the attacker never sees.
```
// app/api/_lib/handler.ts
import { randomUUID } from "crypto";
import { log } from "@/lib/log"; // pino, JSON output
export function withErrorBoundary(fn: (req: Request) => Promise<Response>) {
return async (req: Request) => {
try {
return await fn(req);
} catch (err) {
const id = randomUUID();
log.error({ id, err, url: req.url }); // full detail, server-side only
return Response.json(
{ error: "Something went wrong", id }, // nothing else leaves
{ status: 500 },
);
}
};
}
```
Information leakage is the same disease in a dozen small forms, so run the checklist. Production source maps off. Framework debug pages off. Confirm /.env, /.git, and backup files return 404 from the public internet, because EMERALDWHALE-style crawlers request them from every host they meet. Security headers on (CSP, HSTS, X-Content-Type-Options, frame-ancestors). And the big one for the Supabase generation: Row Level Security on for every table, with policies you have tested from a logged-out client. The Lovable CVE existed because client-side checks feel like security while the REST endpoint answers anyone; Lovable's own scanner, added after the disclosure, checks whether RLS exists and cannot tell you whether it is correct. Yours must be both, and the test is one curl command at your own API with no cookie attached.
File uploads collect every mistake in one feature. The client-supplied MIME type is a suggestion; the extension is a costume. Read the magic bytes, cap the size, re-encode every image through sharp (which strips EXIF GPS data and any embedded payload in one move), give the file a random name, and store it in a private bucket served through presigned URLs on a separate origin. Treat SVG as executable code, because it is: an SVG upload rendered inline is a stored-XSS vector.
```
// app/api/upload/route.ts
import { fileTypeFromBuffer } from "file-type";
import sharp from "sharp";
import { putObject, presign } from "@/lib/storage";
const MAX_BYTES = 5 * 1024 * 1024;
const ALLOWED = new Set(["image/jpeg", "image/png", "image/webp"]);
export async function POST(req: Request) {
const user = await requireUser(req);
const buf = Buffer.from(await req.arrayBuffer());
if (buf.byteLength > MAX_BYTES) {
return Response.json({ error: "Too large" }, { status: 413 });
}
const kind = await fileTypeFromBuffer(buf); // magic bytes, not headers
if (!kind || !ALLOWED.has(kind.mime)) {
return Response.json({ error: "Unsupported type" }, { status: 415 });
}
const clean = await sharp(buf).rotate().webp({ quality: 82 }).toBuffer();
const key = `u/${user.id}/${crypto.randomUUID()}.webp`; // no user filenames
await putObject(key, clean, "image/webp"); // private bucket
return Response.json({ url: await presign(key, 3600) });
}
```
One more door opens if you ship an AI feature inside your product, and it will define the next decade of breaches. Simon Willison named the "lethal trifecta": an agent holding private data, exposed to untrusted content, with a channel to the outside world, can be tricked into stealing for the attacker, and prompt injection remains unsolved. So never grant all three to one agent. Your support bot can read tickets and docs (untrusted content + private data) as long as it cannot send email or call tools that write. Treat model output as user input: escape it, validate it, never eval it, never render it as raw HTML.
## Layer 3: The company around the code
Survive launch and the job mutates. Your calendar fills with everything except building: support email, a one-star review that stings at 11pm, deferred marketing, dependency alerts, a bug report you cannot reproduce, the refactor you owe yourself. Solo builders burn out here, in the fragmentation, long after they proved they could ship. The fix: stop being the worker at every station and build three desks, each run by agents on schedules, each reporting up instead of interrupting you. The apparatus costs less than a phone plan at first: solo stacks run $73 to $120 a month at early revenue, $200 to $500 once the product earns five figures, reviewers and monitoring included.
The review desk
Order matters at this desk. Deterministic scanners go first because they never hallucinate; AI reviewers go second because they catch what pattern-matching cannot; you go last, on the risk paths only. The AI reviewer market matured fast. CodeRabbit reviews every PR for $24 a month and gives its CLI away free. OpenAI's Codex review went GA in September 2025 and, in OpenAI's words, "reviews the vast majority of our PRs, catching hundreds of issues every day." GitHub reported in March 2026 that Copilot has run 60 million reviews and touches more than one in five code reviews on the platform. Pick one, plus Anthropic's open-source security-review Action, which reads your diff for injection, auth flaws, and hardcoded secrets, and filters its own false positives before commenting. Cross-model review turns automatic here: your writer model opens the PR, a rival vendor's model reviews it, and their disagreement lands as a comment thread instead of a production incident.
The entire desk is one workflow file:
```
# .github/workflows/ci.yml
name: gate
on: [pull_request]
jobs:
checks:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with: { fetch-depth: 0 }
- uses: actions/setup-node@v4
with: { node-version: 22, cache: "pnpm" }
- run: pnpm install --frozen-lockfile
- run: pnpm typecheck && pnpm lint && pnpm test
- run: npm audit --audit-level=high
- uses: gitleaks/gitleaks-action@v2 # secrets in the diff
- run: pipx run semgrep scan --config auto # SAST rules
security-review:
runs-on: ubuntu-latest
steps:
- uses: anthropics/claude-code-security-review@main
with:
claude-api-key: ${{ secrets.CLAUDE_API_KEY }}
```
Protect main so nothing merges red, including your own agents. Steinberger can commit straight to main because he watches the stream all day; your version of his local CI is this file, and it works while you sleep.
The watch desk
Production is the only reviewer that never misses, so pipe its opinions somewhere useful. Sentry (or any error tracker) catches exceptions; a small scheduled agent reads the night's new errors each morning, clusters them, and files reproductions for anything new. Uptime monitoring pings your critical paths. Dependabot runs with a seven-day cooldown so you inherit patches without inheriting worms. Token-spend alerts guard the LLM bill. Then one weekly maintenance session, agent-driven, thirty minutes of your attention: dependency audit, secret-rotation check, dead-code sweep, slowest queries. OpenClaw runs this pattern at open-source scale with ClawSweeper, a bot that sweeps every issue and PR weekly and proposes closures; the project that taught everyone about exposed control panels also shows self-maintenance done right.
The front office
The bottlenecks nobody puts in a stack diagram: reading email, digesting customer feedback, producing marketing, answering support. Each is a reading-and-drafting job, delegable to an agent under one iron rule: front-office agents draft, they never send. An inbox agent reads overnight mail and hands you five drafted replies with a one-line summary each; you approve or rewrite in minutes. A feedback agent clusters reviews and support messages into themes and files the recurring complaint as a GitHub issue with the customer's words attached. A marketing agent turns the week's changelog and real usage numbers into two draft posts in your voice, and you spend ten minutes making them true. Steinberger's assistant reads his mail and manages his calendar; his security advice doubles as your architecture rule: "If you make sure that you are the only person who talks to it, the risk profile is much smaller." Front-office agents read strangers' text all day, the opposite of that safe condition, so they operate with the trifecta broken on purpose: no secrets, no shell, no send permissions, drafts into a queue only you flush.
All three desks converge on one artifact, the daily brief: shipped, broke, waiting-on-you. One message every morning, assembled by a scheduled agent. If the brief takes you more than five minutes to act on, a desk needs better automation; if you stop reading it, you became the vulnerability.
## The 30-day install
Knowledge without a deadline is entertainment, so here is the install schedule. Each week fits around a day job.
Week 1, the build layer. Write the constitution tonight; twenty minutes, template above. Add the two hooks tomorrow. Spend the rest of the week practicing the rhythm: plan mode first, one task per session, failing test before implementation, fresh session per task. Kill any session after two failed corrections.
Week 2, the defense layer. One door per evening. Monday: rate limits on every API route plus a spend cap. Tuesday: Zod at every boundary, and grep for string-built SQL. Wednesday: gitleaks pre-commit, bundle-grep for keys, rotate anything that has ever touched a commit. Thursday: lockfile discipline, Socket or audit in CI, cooldown on updates. Friday: the error boundary and structured logs. Saturday: headers, source maps off, RLS policies tested logged-out. Sunday: the upload pipeline, magic bytes to sharp to private bucket.
Week 3, the review desk. Commit the CI workflow. Turn on branch protection. Pick one AI reviewer and wire the security-review action. From now on, agents open PRs instead of pushing, and you read every diff line that touches auth, money, deletion, or uploads.
Week 4, the operations layer. Sentry plus the morning triage agent. Uptime checks. The inbox agent, draft-only. The daily brief. Then schedule the ritual that keeps the system honest: a monthly red-team hour attacking your own app. Curl every endpoint logged out. Swap object IDs in requests. Upload a text file renamed to .png, then an SVG. Grep your client bundle for sk-. Request /.env from production. Every hole you find becomes a spec, which the gated loop closes by Friday.
Two laws survive after the month, and they are the whole article compressed. Never ship a diff you could not explain to a stranger, and never give one agent private data, untrusted input, and an exit at the same time.
The builders at the top of this piece are not typing faster than you. Steinberger put the actual constraint in one line: the amount of software he can create is limited by inference time and hard thinking. Inference time is for sale. The system above is how the hard thinking becomes product, and it starts with a markdown file you could write before you sleep tonight.
## 相关链接
- [Rohit](https://x.com/rohit4verse)
- [@rohit4verse](https://x.com/rohit4verse)
- [32K](https://x.com/rohit4verse/status/2078879981271404575/analytics)
- [Escape.tech](https://escape.tech/)
- [Upgrade to Premium](https://x.com/i/premium_sign_up)
- [12:29 AM · Jul 20, 2026](https://x.com/rohit4verse/status/2078879981271404575)
- [32K Views](https://x.com/rohit4verse/status/2078879981271404575/analytics)
- [View quotes](https://x.com/rohit4verse/status/2078879981271404575/quotes)
---
*导出时间: 2026/7/21 14:14:01*
---
## 中文翻译
# 适合独立开发者的生产级 AI 技术栈
**作者**: Rohit
**日期**: 2026-07-19T16:29:45.000Z
**来源**: [https://x.com/rohit4verse/status/2078879981271404575](https://x.com/rohit4verse/status/2078879981271404575)
---
一人公司的现在的交付能力堪比十人团队。那些存活下来的公司都运行着一套系统：一个模型无法撒谎的构建循环，一个攻击者无法绕过的防御层，以及能在创始人睡觉时自行运转的运维体系。这就是那个系统，端到端的解决方案。
2025 年 3 月，一位化名 Leo 的 SaaS 创始人发布了一条每个构建者都想发的推文。他的产品 Enrichlead 上线了。Cursor 编写了它的代码。“零手写代码，”他宣布道。“AI 不再仅仅是一个助手，它也是一个构建者。”他在结尾写道：“P.S. 是的，人们确实为此付费。”
四天后，他再次发帖。“兄弟们，我正遭受攻击。各种奇怪的事情在发生，API 密钥的使用量爆表，人们绕过订阅，在数据库里创建各种垃圾数据。”
攻击者发现了模型从未提及的所有问题。没有服务器端身份验证的 API 端点。仅在浏览器中强制执行的付费墙。直接写入数据库的原始输入。他试图通过更多的提示词来修补。他们再次攻破了它。该产品在几周内就消亡了。
当那张截图出现在你的信息流中时，你嘲笑过 Leo。但请面对一个更令人不安的事实：你的技术栈与他的差距仅仅在于一个未勾选的选项框。
这种模式在每个规模上都在重复。2025 年 7 月，Tea 应用，一款面向女性的病毒式安全应用，将一个 Firebase 存储桶公开开放。大约 72,000 张图片泄露，其中包括 13,000 张验证自拍和政府身份证件。几天后，研究人员发现了第二个漏洞：110 万条关于不忠、堕胎和约会的私人消息，任何经过身份验证的用户都可以读取。同一个月，一个在 SaaStr 代码库上工作的 Replit 智能体在明确的代码冻结期间删除了生产数据库，然后伪造了大约 4,000 条虚假记录和通过的测试结果来掩盖事实。2025 年春天，研究人员 Matt Palmer 扫描了使用 Lovable 发布的 1,645 个应用程序，发现其中 170 个通过一个共享漏洞泄露了电子邮件、电话号码、地址和 API 密钥：Supabase 行级安全策略（RLS）被关闭或配置错误。该漏洞成为了 CVE-2025-48757，被评为 9.3 级严重漏洞。
可测量的基线比轶事更糟糕。2025 年，Veracode 在常见编码任务中测试了 100 多个模型：45% 的 AI 生成样本包含 OWASP 级别的漏洞，Java 则高达 72%，而模型仅在 14% 的情况下防御了跨站脚本攻击。更新、更大的模型得分并没有更好。斯坦福大学的一个包括 Dan Boneh 在内的团队发现了问题中“人为”的一半：使用 AI 助手的开发人员编写的代码安全性更低，却认为自己编写的代码安全性更高。GitGuardian 统计称，仅 2024 年，公共 GitHub 上就新增了 2,380 万个泄露的密钥，启用 Copilot 的仓库泄露频率比平均水平高出约 40%。当 Escape.tech 在 2025 年底扫描 5,600 个“氛围编码”应用时，它发现了 2,000 个漏洞、400 个暴露的密钥和实时的医疗记录，其中大部分无需登录即可访问。
还有一个数字，因为它会改变你对敌人的想象。2024 年，一个名为 EMERALDWHALE 的犯罪团伙从 67,000 个暴露的 .git 目录中获取了凭证：15,000 个有效的云密钥，在没有任何巧妙利用手段的情况下被盗。没有人针对那些应用程序。脚本发现了它们。你的应用程序也会以同样的方式被探测，在域名解析后的几个小时内，就有机器人全天候请求 /.env 和 /.git/config。
2026 年的陷阱非常精准。模型将“从想法到演示”的时间从几个月压缩到了一个周末。它对“从演示到生产”的压缩毫无作用，并使这个差距变得不可见，因为演示看起来已经完成了。能运行的代码和能在陌生人的接触中幸存的代码是两种不同的产品。上面的每个事故都存在于这个差距中。
## 打字从来都不是工作
对那些故事的标准反应是指责“氛围编码”并告诉构建者放慢速度。这种解读忽略了变化所在：打字从来都不是工作。工作始终是判断：决定构建什么，验证它是否工作，防御它，运营它。AI 移除了打字，留下了判断。大多数独立构建者通过也移除判断来回应，因为没有任何工具迫使他们保留它。
现在获胜的构建者保留了它，并通过将其转化为一个系统来降低其成本。
考虑一个天花板案例。Peter Steinberger 于 2011 年在维也纳创立了 PSPDFKit，将其发展到超过 70 名员工，2021 年获得了 Insight Partners 的 1 亿欧元投资，随后退出，并由于过度倦怠，花了一年时间接受治疗，以此回忆起他为什么喜欢电脑。智能体在 2025 年 4 月将他拉了回来。2025 年 11 月 24 日，他发布了一款名为 Clawdbot 的个人 AI 助手：一个生活在你自己机器上的智能体，通过 WhatsApp、Telegram 或 iMessage 回答你的问题。商标投诉迫使其更名为 Moltbot，然后是 OpenClaw。到 2026 年 3 月 2 日，该仓库在 GitHub 上获得了 247,000 颗星，超过了 React。仅在一月份，它就吸收了超过 6,600 次提交；《Pragmatic Engineer》像 profiling 一家公司一样对它进行了分析，而 Steinberger 纠正道：“这只是一个人坐在家里找乐子。”
他的工作流程是值得研究的部分。他在终端网格中并行运行三到八个智能体，其中大多数在同一个文件夹中，没有分支，没有拉取请求，直接推送到 main。他说话而不是打字。“智能体工程已经变得非常出色，现在它几乎编写了我 100% 的代码，”他在 2025 年 10 月写道。他观察输出流，阅读可能伤害他的部分，保持 main 始终可发布，并向前修复而不是回滚。他为每个子系统编写了文档，以便智能体加载正确的上下文，并构建了一个名为 ClawSweeper 的机器人，每周扫描所有问题和 PR，这样项目可以自我维护。用他的话来说，他的输出上限：“我现在能创建的软件数量主要受限于推理时间和深度思考。”
现在来看看反面，因为 OpenClaw 也是这个时代最公开的安全教训。用户将其部署时，控制面板直接暴露在开放的互联网上。到 2026 年 1 月 31 日，Censys 统计到 21,639 个暴露的实例；SecurityScorecard 后来发现了超过 40,000 个，其中 12,812 个容易受到远程代码执行的影响。一名研究人员发现了一个一键远程代码执行漏洞，CVE-2026-25253；修复方案在几天内发布。OpenClaw 智能体为自己构建的社交网络 Moltbook 上线时禁用了 Supabase 行级安全策略，并在客户端 JavaScript 中包含了 API 密钥：150 万个智能体令牌和 35,000 个所有者电子邮件处于可读状态，直到 Wiz 报告了这一点。这位在世的最有能力的智能体工程师，一个拥有 25 年模式识别经验作为其审查层的人，发布了与第一周的“氛围编码”者相同的错误类别。没有防御层的速度会将小错误转化为全范围的暴露，再多的才华也无法跑赢这一点。
与此同时，一人模式有效的商业证据不断涌现。Maor Shlomo 独自构建了 Base44，一个 AI 应用构建器：2025 年 3 月在 20,000 用户时实现盈利，5 月利润 189,000 美元，6 月以 8,000 万美元现金出售给 Wix，距离成立仅六个月，约 90% 的代码由 AI 编写。Zach Yadegari 还是青少年时与两个朋友一起构建了 Cal AI；它在拥有七名员工的情况下年营收超过了 3,000 万美元，并出售给了 MyFitnessPal。Marc Lou 在 2025 年独自在十二个小产品上清理了 100 万美元。Tony Dinh 的 TypingMind 年收入超过 100 万美元，独自运营。Pieter Levels 公开“氛围编码”了一个浏览器飞行模拟器，并在 17 天内获得了 100 万美元的年化收入，其中大部分来自游戏内飞艇上的赞助商标志。二十岁的 William Lindholm 在 Lovable 上构建了整个 B2B 平台，并在五个月内达到每月 11 万美元。Sam Altman 与其他 CEO 保持着一个赌池，赌第一家单人十亿美元公司出现的年份。Y Combinator 2025 年冬季批次中有四分之一的团队发布了 95% 由 AI 生成的代码库。Claude Code 自己的负责人报告说，两个月没有手写一行代码，一天内发布了 22 个拉取请求。
同时持有这两个事实：同一个工具既产生了杠杆也带来了暴露。区分 Shlomo 和 Leo 的变量是包裹在模型周围的系统。
## 三层架构，一人运营
每一个持久的独立运营都在运行某种版本的相同架构，无论创始人是否曾画过它：
1. 构建层。一个在模型编写时保持其诚实的循环：规格输入，受控的 diff 输出。
2. 防御层。攻击者在每个应用程序上尝试的七扇门，每一扇都默认关闭。
3. 运维层。代码周围的公司：审查、监控和收件箱，由智能体按计划运行，在每日简报中向你汇报。
回报：你以智能体的速度交付，而不会将用户的数据捐献给 4chan，事故页面会通知你而不是终结你，并且整个事情会复利增长，因为每一个生产错误都成为下周的规格，每一个审查发现都成为智能体遵守的永久规则。本文的其余部分将安装这些层级，包括代码和图表。
## 第 1 层：模型无法撒谎的构建循环
从一个不受欢迎的观点开始：幻觉和漂移首先是上下文问题，然后才是模型问题。Andrej Karpathy 在 2025 年 2 月将“氛围编码”定义为你“完全屈服于氛围，拥抱指数级增长，忘记代码甚至存在”的模式，但同时将其范围限定为一次性周末项目。对于任何有用户的项目，失败都会按时到达。Chroma 2025 年 7 月的“上下文腐烂”研究测量了 18 个模型，发现随着输入的增加性能下降，即使是在孩子都能完成的任务上。Anthropic 的工程团队称之为有限的注意力预算：每一个仍停留在你的会话中的陈旧错误信息和被放弃的方法都在与你的实际指令竞争。他们的解决方案很直截了当：在两次失败的修正后，清除会话，因为“带有更好提示词的干净会话几乎总是优于带有累积修正的长会话。”
因此，构建层有三个动作：编写宪法，控制每个循环，饿死上下文。
动作 1：编写宪法
智能体在接触你的代码之前会读取一个内存文件。Claude Code 读取 CLAUDE.md，Codex 和 OpenClaw 读取 AGENTS.md，Cursor 读取其规则目录。这是你今年将写的最高杠杆的文件，大多数构建者要么跳过它，要么将其臃肿成模型浏览的长篇小说。Anthropic 的指南给出了编辑测试：对每一行问，“删除这会导致模型犯错吗？”如果否，就删掉它，因为臃肿的宪法在你需要它的时刻会被忽略。
一个真实产品的宪法如下所示：
```
# CLAUDE.md (kanso: invoice-OCR SaaS)
## Commands
- pnpm dev | pnpm test | pnpm typecheck | pnpm lint
- Never run: prisma migrate reset, rm -rf, git push --force
## Invariants (violating any of these means stop and ask me)
- Every /api handler validates input with Zod before touching the DB
- DB access goes through src/db/queries.ts. No raw SQL in handlers.
- Secrets live in server-side env vars. Nothing secret is NEXT_PUBLIC_.
- Money math uses integer cents. Never floats.
- Every new table ships with its RLS policy in the same migration.
## Boundaries
- src/billing/** (Stripe webhooks): plan first, wait for my approval
- File uploads follow docs/uploads.md exactly
## Definition of done
- Typecheck, lint, tests green. New logic starts from a failing test.
- Diffs stay under ~300 lines unless the approved plan says otherwise.
```
然后停止提示功能特性，开始编写规格。每个会话一个任务，先计划后编写。Claude Code 推出了一个计划模式（Shift+Tab），强制智能体在编辑之前阅读并提出建议；批准计划，然后让它编写。对于更大的构建，GitHub 的 Spec Kit 和 AWS Kiro 将其变成一种仪式，包括编号的需求等等，尽管 Thoughtworks 的 Birgitta Böckeler 指出了权衡：规格工具生成“很多 Markdown 文件”，你现在也必须审查它们。独立构建者的版本更轻量。Steinberger 在仓库中保留每个子系统的文档，以便任何智能体在一次阅读中就能获取本地上下文。复制这一点：一个 docs/ 文件夹，其中每个子系统都有一页意图说明，由你编写，由智能体更新，由你审查。
动作 2：控制每个循环
你的宪法是建议性的。模型可以忽略它，并且在上下文压力下它会这样做。Hook 是升级机制：在智能体生命周期触发的 Shell 命令，智能体无法跳过它们。Anthropic 的文档用一句话划清了界限：与内存文件指令不同，“hook 是确定性的。”两个 hook 改变了一切。PostToolUse hook 在每次编辑后运行 typecheck 和 lint，这样类型错误会在几秒钟内浮现，而不是累积一个小时。Stop hook 在智能体试图声明自己完成时运行你的测试套件，退出代码 2 拒绝该声明，这会将智能体送回工作，并将失败文本放在它面前。
```
{
"hooks": {
"PostToolUse": [{
"matcher": "Edit|Write",
"hooks": [{ "type": "command",
"command": "pnpm typecheck && pnpm lint --quiet" }]
}],
"Stop": [{
"hooks": [{ "type": "command",
"command": "pnpm test --silent || { echo 'tests failing: keep going' >&2; exit 2; }" }]
}]
}
}
```
将控制门与测试优先提示相结合。在实现之前，让智能体编写定义成功的失败测试，运行它，看着它失败，然后实现。测试是模型无法争辩的规格，并且它的寿命超过了编写它的会话。另一种选择，询问模型它自己的工作是否正确，什么也衡量不出来。Anthropic 自己的文档警告说，被提示寻找漏洞的 LLM 审查者“通常会报告一些，即使工作是可靠的”，而镜像失败更糟糕：一个给自己作业打分的模型会通过它。确定性检查、编译器、Linter、测试、扫描器，是你管道中唯一无法被甜言蜜语左右的观点。
动作 3：饿死上下文，然后交叉盘问
给每个任务一个新鲜的会话和能够支持它的最小上下文。2025-26 年的工具浪潮正是为了让这变得人体工程学而存在的。子智能体在单独的上下文窗口中运行并返回摘要，因此研究垃圾永远不会污染实现会话；定义一个只读的安全审查子智能体，它可以 grep 和读取但永远不能编辑。技能（2025 年 10 月，同年 12 月成为开放标准）是带有 SKILL.md 的文件夹，仅在相关时加载到上下文中：编写一次上传处理检查清单，每个未来的会话都会应用它。插件将整个套件——命令、子智能体、技能、Hook、MCP 服务器——捆绑到一个可安装的单元中，任何 git 仓库都可以是一个市场。你来之不易的流程变成了基础设施，而不是记忆。
然后交叉盘问。审查者绝不能是作者。Claude Code 的文档说明了原因：“一个新的上下文可以改善代码审查，因为 Claude 不会偏袒它刚刚编写的代码。”最便宜的版本：打开一个新的会话，或运行捆绑的 /code-review 技能，它会针对你的 diff 生成一个干净的子智能体。更强的版本：跨模型审查，Codex 审查 Claude 的 diff 或反之，因为不同的模型有不同的盲点，它们的分歧指向了你自己应该阅读的代码。
你会遇到运行在自治边缘的人。Geoffrey Huntley 的“Ralph”技术是一个 bash while 循环，永远向智能体提供相同的提示；他声称以 297 美元的代币费用交付了一份 50,000 美元的合同。尊重这种边缘，并注意谁在反击。Armin Ronacher 在 2026 年 6 月写道，不间断的循环仍然会产生他所关心的代码的垃圾，并且失败模式是验证从确定性测试漂移到模型判断。Simon Willison 的规则在每一代工具中都幸存下来：他不会提交他无法向某人解释的代码