Zero Employees, 2,000 Customers, Millions a Year
Mike Perham has run Sidekiq alone since 2012: a free open source core, paid Pro and Enterprise tiers, and a no-discounts rule. Here is how the machine works.
Topic
Technology
Articles on the tools and platforms that change the economics of building software: AI tooling and its real costs, infrastructure choices for small teams, and what new technology actually means for a builder's bottom line.
Seven Thousand Hours at $0, Then $3 Million a Year in Ads
Ivan Kutskir worked 7,000 hours before Photopea earned a dollar. Now the free editor makes about $3 million a year, 90 percent from ads, on roughly $12,600 of annual costs.
Two Engineers, a Google Sheet and a $2 Million Run Rate
Levels.fyi served millions of monthly visitors from a Google Form and a spreadsheet while its two bootstrapped founders reached a $2 million run rate. The order of operations is the lesson.
One Person, 2.5 Million Sites: The Case for Charging $19 a Year
AJ built Carrd alone, priced Pro at $19 a year, and passed $1M ARR with zero paid advertising. The cheap price is the strategy, and it only works in one specific configuration.
Five Days to Ship, 20 Months to $1M: TypingMind's Numbers as Its Founder Posted Them
Tony Dinh launched a ChatGPT frontend five days after OpenAI opened its API and published the revenue at every stage. The second million is coming from companies, not from the customers who built the first.
Anthropic Found Three Agent Runs on the Live Internet. Two Commands Test Your Own Sandbox
A misconfiguration left evaluation machines with live internet access, and two organisations both believed they were isolated. Outbound isolation is testable in under a minute, and most teams have never run the test.
Stacked Pull Requests Landed on GitHub: The Command Sequence and the Five Things That Break a Stack
GitHub put stacked pull requests into public preview on 30 July. Here is the install and command sequence end to end, what merging a middle pull request actually does, and the cross-fork restriction that rules the feature out for most open source work.
Amazon Traced the chalk and axios Hijacks to One Group. Two npm Settings Answer It
Amazon Threat Intelligence linked four npm compromises to a single state-backed actor, all of them starting with a socially engineered maintainer. The defence is not a scanner: it is four documented npm config options, and each one has a cost worth naming.
36.2% Was the Best Score: What a 124-Page Policy File Does Not Do to an Agent
A benchmark put policy documents of 20 to 124 pages in front of thirty model configurations and graded 824 rules programmatically. The best configuration satisfied every rule in 36.2% of trials. Sort your own rules into advisory and binding, then move the binding ones out of the markdown.
Your Agent Run Takes 40 Minutes. Vercel Ends the Request at 300 Seconds
The documented ceilings: 300 seconds on Vercel Hobby, 900 on AWS Lambda, 30 seconds of CPU by default on a paid Cloudflare Worker. Here are all four side by side, the run length that picks your runtime, and the request shape that makes the ceiling stop mattering.
OpenJDK Will Not Take AI-Generated Code. Five Projects, Five Different Lines
OpenJDK's interim policy bans model-generated content in code, email, wiki pages and issues, while permitting private use for debugging. QEMU, Gentoo, NetBSD and Apache each drew the line somewhere else, and the reason is provenance rather than quality.
Google Indexed Shared Claude Chats: Four Operators That Find Your Own Team's Leaks
Shared conversations and Artifacts turned up in search results this week. On a domain you do not own you cannot set a noindex tag, which leaves exactly two levers. Here are the operators to run and the revoke path for each surface.
An AI Agent Broke Into Hugging Face. Pin Every Model Your Build Downloads
Hugging Face says the intrusion started in a dataset loader and that public models are clean. The useful response is not panic: it is pinning every download to a full commit hash, scoping tokens per app, and refusing pickled weights.
MCP Deleted the Handshake and the Session Header: A Migration Audit for Server Owners
The 2026-07-28 revision removes initialize, the Mcp-Session-Id header and stream resumability, and makes server/discover mandatory. What replaced each of them, and the order to work through your own server.
Texas Age Checks Went Live in June: What Your App Has to Read From Apple and Google
SB 2420 became enforceable on 4 June 2026 and both stores now hand developers an age category. The statute puts the duty on the developer: assign ratings, read the signal, and decide what counts as a significant change.
p=none Blocks Nothing: The Staged Route to DMARC Enforcement, Without the pct Ramp
A DMARC record set to p=none tells receiving servers to do nothing at all. RFC 9989 also deleted the pct tag that most rollout guides still teach. Four stages, an exit criterion for each, and the exact record to publish.
OpenAI's Security Scanner Went to the Top of Hacker News. You Probably Cannot Run It
The codex-security CLI is open source and gated to approved customers. Here is what a one-to-five person team can install this afternoon instead, with the free-tier limits and per-contributor costs that decide it.
A Professor Hid One Line in White Font and 32 Students Failed. Your Product Reads the Same Way
Text a human never sees is text a model still obeys. If your product summarises uploaded files, tickets or web pages, the exposure is not the hidden instruction, it is what the model is allowed to do after reading it.
748,000 Customer Records Sat Behind a URL With No Login. Run These Five Passes on Your Own API
A researcher typed a base path into a browser and got a directory listing of unguarded internal endpoints. The class of bug is OWASP API5, the most boring one there is, and the audit for it fits in an evening.
Google's Anti-Scraping Wall Failed the Copyright Test. Read the Element That Killed It
A federal judge dismissed both of Google's DMCA claims against SerpApi on 20 July 2026. The reason was not that scraping is legal: it was a clause in section 1201 that almost no site owner has read.
Open Weights Are Free. Serving Them Costs $35 an Hour: Run the Break-Even First
Kimi K3's open release landed on Hugging Face today. Published GPU rental and API prices put the crossover at roughly 4.2 billion tokens a month against Kimi's own API and 46 billion against DeepSeek V4 Pro. Here is the arithmetic, with the duty-cycle and caching adjustments most comparisons skip.
The Discount API Sellers Are Reselling Somebody's Compromised Account. Probably Not Yours, Yet
A report this week described the relay market that proxies frontier model access at a fraction of list price. The arithmetic says where the money comes from, and Anthropic's terms say who pays when a key leaks.
Profitable in Three Weeks, Independent for 18 Years: What Balsamiq's Published Numbers Show
Balsamiq launched in June 2008 and its founder reported profitability within three weeks. Eighteen years later it is still bootstrapped, and its 2024 revenue was $6.58 million, down 6%.
Cloudflare Split AI Bots Into Search, Agent and Training: Set Your Three Answers
One switch became three, free on every plan, with new-domain defaults changing on 15 September. The Googlebot trade-off that makes one of the three expensive, a setting matrix by site type, and the exact dashboard path.