I’m looking into using Base44 to build an internal dashboard for my agency, but I’m a bit confused by their credit system. They list Message Credits and Integration Credits on their pricing page.
Before I upgrade to a paid tier, can someone who actually builds on the platform explain how quickly you burn through these credits?
trying to avoid buying things i don't actually need.
there are premium templates, plugins, design services, marketing tools, stock photos... the list keeps growing.
what ended up being a complete waste for you?
Ran an internal audit last quarter after a near miss, a CVE with a public exploit sat in our backlog for 11 days because it scored a 5.5 and got buried under a stack of 9+ CVSS findings that turned out to be unreachable. What stung was our red team had flagged that same CVE as a viable attack path two months earlier and the finding never made it back into our prioritization model. Fixed the process gap first, not the scoring gap: red team output now feeds into the same queue as scanner findings instead of living in a separate report nobody cross-references. Merging exploit maturity and reachability data helped too, but the unlock was making sure two teams looking at the same infrastructure were not working off two different risk pictures. Took about two sprints to wire up.
Anyone else run into red team and vuln management operating as separate systems until something forced them together?
We’re currently evaluating different last-mile delivery partners as our e-commerce volume continues to grow, and I’m realizing there are a lot more factors to consider than just shipping rates. Beyond pricing, what should businesses actually prioritize when choosing a delivery partner? Things like delivery speed options, tracking visibility, customer experience, scalability during peak seasons, and how much extra work it creates for the warehouse team all seem important. For those who have switched providers or added a new last-mile partner, what made the biggest difference?
Staring at our data lately trying to figure out what actually counts as a real buying signal from devs. Not talking about the obvious stuff like someone filling out a demo form. I mean that quiet phase where a couple of engineers are poking around, and you're left guessing if it’s a serious evaluation or just some guy playing around on a weekend project.
Right now we try to track stuff like multiple engineers from the same company suddenly hitting our docs, or when someone starts looking at the security SSO pages. The hardest part is knowing when to actually say something. I don’t want to annoy a developer who just wants to be left alone, but I also don't want to miss the window if they're quietly running a pilot. Right now I usually just wait until I see a spike in activity and send a "hey, need help?" email, but it feels like total guesswork. How are you guys mapping this out, are you just looking at internal product metrics or tracking external intent tech stacks too
Twenty eight days ago my cto pinged me on slack with a one liner that basically changed my job we are going all in on mcp for internal tools just imagine what this means for sales and marketing
I run go to market ops at a bootstrapped saas small team decent revenue nothing crazy. Up until this point my world was all quotas forecasts reports for the board plugging in yet another tool sales swore they needed and then abandoned
When we started playing with mcp internally it felt easy at first. We wired up our crm, support tool and product database so an internal agent could answer questions like show me all accounts where product usage spiked this month but nobody has talked to them yet
We already have a sort of gtm intelligence light setup cobbled together from call recordings plus basic ai summaries website intent data product usage pings crm fields nobody fills in
It works in the sense that everyone complains about it equally.
I am stuck now in this weird in between state. mcp is clearly going to be our internal wiring for anything new we build. At the same time, every vendor in the gtm intelligence space is pitching me a full replacement for what we already hacked together.
We’re basically 100 percent dependent on one last mile delivery company right now and it keeps failing us at the worst possible times. It looked fine because the rates were decent and the setup was simple, but over time the misses have started adding up. Late pickups, random delays, inconsistent scans, and then the usual support runaround when something gets stuck. It’s gotten to the point where I’m not sure if the issue is the last mile delivery company itself or just that we’ve put too much volume through one lane and never built a backup plan. We’ve been slow to change because everything was already wired around this one option. Now it feels risky to keep doing the same thing, but I also don’t want to blow everything up and make the process worse just because I’m frustrated. Do you guys split by region, order type, volume, or just keep a second last mile delivery company ready for exceptions?
budget cycle is coming up and i need to make the case for keeping our security program funded, ideally growing it. last cycle the cfo looked at my slide and asked "if we cut this in half, what breaks?" and i didn't have a clean answer that would land in that room. i still don't have one.
the stuff that's easy to measure isn't the stuff that matters. i can show vulns closed, MTTR trending down, phishing sim click rates dropping, all of it goes in the right direction on a slide. but none of it answers the question a cfo actually asks, which is: what would have happened if we hadn't spent this money and how much worse would it be.
that counterfactual problem is what gets me every time. you can't point to breaches that didn't happen. you can't quantify an incident that never occurred. so you end up arguing from activity metrics and hoping the room connects the dots between "we patched more crits faster" and "we are less likely to get hit" and that leap doesn't always land.
the closest i've come to something that holds up is showing attack surface shrinking over time, fewer known-exploitable vulns sitting on internet-facing assets, tracked over quarters not sprints. patching velocity and MTTR never survived the "so what" question in that room. exposure reduction at least maps to something real: this is what could have hurt us, and it's smaller than it was six months ago
for security leaders who've gotten budget approved on the strength of a risk reduction story: how did you frame it and what did you measure that survived the "what would have happened anyway" question?
Im running a small ecommerce brand out of the US and shipping is starting to feel like the thing that breaks us, not product or marketing. We sell mid ticket items, average order is around 60 70 dollars, and on a lot of orders we are eating 9 to 14 dollars in ecommerce delivery if we want it to arrive in a timeframe customers are actually okay with. If we pass that full cost on, conversion tanks. If we keep offering cheap or free shipping, our margins get wrecked.
We use Shopify, mainly UPS and USPS, and I have played with everything I can think of. Different zones, weight based pricing, raising product prices a bit and advertising free shipping, mixing in slower methods. I keep ending up in the same place where either customers complain about speed or I look at the P and L and want to crawl under a rock.
i am starting to see more regional and last mile delivery options in my own tracking pages and it makes me wonder if I am missing a whole part of the shipping world that small brands actually use to stay alive. For people in a similar size range, what are you doing to keep ecommerce delivery costs from killing your margins right now?
Your input will be highly appreciated!!
We run multiple AI tools: Claude Code, Cursor, Copilot, Gemini. Each one sees a slice of the repo and maybe some docs. None of them remember why we made specific decisions, what constraints are nonnegotiable, or which incidents changed how a service is allowed to behave. Same feature, different day, different tool, fresh context rebuild each time.
We're experimenting with one shared project memory layer per repo: a single structured, append-only log under version control, capturing decisions, constraints, rationale, and evidence links where they exist. Tools ask it for relevant context; humans maintain it via PRs.
Integration is simple by design. A small local CLI queries and appends entries from dev machines and CI, plus a handful of operations, load current state, record a new entry, list open items. A pre-commit hook on a few critical directories (auth, payments, infra) nudges people to add or update an entry when they touch shared services.
We're aware of the compliance-theatre risk. A blocking hook is easy to game with one-line junk entries. The guardrails we've put around it: scope is narrow (only shared-critical dirs), entries are reviewed like any other file in the PR, and we watch entry quality, if it slides toward junk, we tighten review or remove the hook instead of pretending it's enforcement.
Agents never write straight prose into the file. They propose structured entries, and we decide in the PR whether they land. That keeps the ledger from becoming another log dump.
When I say local-first here, I mean the primary copy lives in Git, under our own control, in an open format usable without any external service, no server, no account, no telemetry required to get value from it.
If you've tried a shared project-memory layer for multiple AI tools, what actually stayed useful and what decayed?
We are running a small operation that ships temperature sensitive goods and apparently also my sanity 😡 Because of what we ship, we cannot afford a single missed delivery window, which is hilarious because last mile delivery companies treat delivery windows like optional side quests. Every last mile delivery service account rep nods very seriously while I explain that if this package sits in a random van for extra 6 hours, it stops being product and becomes expensive garbage. They all smile, say words like priority and white glove and then my box takes a 48 hour sightseeing tour of a hub in a state I do not even sell to.
The tracking updates are my favorite part. Out for delivery at 7 am. Then delayed. Then out for delivery again. Then weather exception on a clear day because, I guess, someone sneezed near the truck. We tried UPS, FedEx, USPS (that one was my fault, I accept the shame), even flirted with smaller regional last mile delivery options. Someone mentioned Veho and a couple other ecommerce delivery options in a thread and now I am wondering if anyone here is pulling off reliable cold chain with these guys or if we are all just collectively cosplaying as logistics professionals while praying to the scan gun gods.
If you ship temperature sensitive stuff, who do you trust for tight ecommerce delivery windows?
At this point I feel like every ecommerce order I ship in North America is part logistics and part performance art. National last mile delivery services are either fast but randomly yeet packages into a bush, or slow but at least consistent about disappointing everyone. So I am starting to look harder at regional delivery networks for last mile and trying not to lose my mind. I keep seeing the same names pop up in tracking pages now. Stuff like OnTrac, LaserShip, LSO, some random Amazon branded van, and recently Veho showed up on a couple orders. One of them texted the customer before delivery which felt almost illegal in how competent it was, the other time it was the usual ‘your package is arriving today for three days straight’….’ INSANITY
Those of you that run e-commerce in the US or Canada, what regional last mile delivery networks are reliable for ecommerce delivery in North America, AS IN they pick up when they say they will and do not treat addresses as loose suggestions? I am totally fine with imperfect as long as it is predictably imperfect 😣
I am pretty new to outbound in general.I am trying to do real account research and targeting for a tiny b2b tool and i see lots using ai like that's a single thing it probably is that reliable since almost everyone is using it but i need to get informed more
Til now I dump a vague icp into one of these ai prospecting platforms, it spits out 200 accounts with fancy scores, and then when I look closer half of them are clearly wrong. It feels like the tool cares more about looking smart than being right can’t fully trust
Then there are the browser copilot things that sit in the sidebar while I stalk linkedin, crunchbase, job boards and more. Those feel closer to what I need, but I am still manually going between tabs, copy pasting notes, trying to remember who is who. By the end of a session I have a messy doc, three different scoring systems and no idea which accounts are actually worth chasing this week.
Then comes the annoying part which is I know there is signal in there. I can see patterns when I slow down and go account by account. Certain hiring pages basically let you know that they are a fit and other tech stacks line up perfectly with the problem I am trying to solve.
Anything relatable could help your man out
I’m selling an infrastructure dev tool, and I’m losing my mind with our pipeline right now.
On paper, everything looks great. Our tools are flagging “warm signals” everywhere. But the second I actually start doing outreach, nobody cares, nobody answers, and most people do not even remember interacting with our brand. It’s completely dead.
I’m so tired of these generic platform intent scores that just tell you “Company X is interested” based on some random page view.
I need actual data that tells me which technical teams are actively looking into our space or experimenting with related technologies right now, so I know who is genuinely worth reaching out to this week.
Is there anything out there that genuinely helps with real GTM intelligence and pipeline generation? I’d appreciate recommendations based on actual experience rather than vendor promotions.
we're running Tenable for infra scanning and Snyk for SCA. each tool is doing its job, the problem is what happens after.
the false positive rate is the part that's grinding us down. Tenable flags things that don't apply to our environment: wrong OS detection, services that aren't running, patches that are installed but the scanner missed because auth failed on that host. we close them manually. then a plugin update happens and suddenly old stuff is back again. feels like we keep re-opening findings we’ve already dispositioned.
on top of that, we've got maybe 30-40% of our open findings backlog that we're pretty sure is either stale, already patched, or environment-specific noise. but "pretty sure" isn't good enough to close them at scale, so they sit there making the real list harder to see.
we've talked about building a suppression layer on top of the scanners but that's building a product on top of products we already paid for.
how are other teams handling this. did you get exception and suppression decisions to actually stick across scan cycles?
Early on, it is common for one experienced engineer to carry both coding and cloud design. They move fast, know the provider well, and can make decisions quickly without ceremony. At that stage, formal architecture can feel like overhead the team can't afford.
Problems show up later, when the product grows and those early choices form the foundation of a much larger system. Patterns that were fine for a small user base start causing regular issues. Spending behaves in ways nobody expects. Security and compliance requirements tighten, and it becomes clear that some basic structure is missing.
At some point, people start feeling that they are patching around previous decisions rather than building forward. That is usually when discussions begin about making architecture an explicit responsibility, whether through a dedicated person, a small group, or a more formal review process.
If your team reached the point where ask the senior AWS dev stopped being enough, what happened around that time that made you push for proper cloud architecture work, and how did you manage the shift without freezing delivery?
I’m looking for a hobby that actually pulls me in.
Not something I do for 10 minutes and then immediately check my phone again. I mean the kind of hobby where you suddenly realize an hour passed and you weren’t thinking about notifications, work, or anything else.
I know different things work for different people, but I’m curious what puts people into that focused, peaceful state.
What hobby makes you completely lose track of time?
Staring at our data lately trying to figure out what actually counts as a real buying signal from devs. Not talking about the obvious stuff like someone filling out a demo form. I mean that quiet phase where a couple of engineers are poking around, and you're left guessing if it’s a serious evaluation or just some guy playing around on a weekend project.
Right now we try to track stuff like multiple engineers from the same company suddenly hitting our docs, or when someone starts looking at the security SSO pages. The hardest part is knowing when to actually say something. I don’t want to annoy a developer who just wants to be left alone, but I also don't want to miss the window if they're quietly running a pilot. Right now I usually just wait until I see a spike in activity and send a hey, need help? email, but it feels like total guesswork. How are you guys mapping this out, are you just looking at internal product metrics or tracking external intent tech stacks too
we've been running both qualys and rapid7 for a while now and i'm starting to question the whole vuln management program, not just the tools.
the qualys vs rapid7 thing usually comes down to coverage on paper.qualys, rapid7, and tenable all do asset discovery and vulnerability detection reasonably well. the differences start to show up more around asset inventory, integrations, reporting, and workflow than pure coverage. we looked at tenable too but that's not really the question when you already own both of these.
here's where i'm stuck. when you have both, coverage stops being the interesting problem. how do you tell whether the program itself is working?
stuff i keep circling back to:
prioritization. are we drowning in CVSS scores? those measure technical severity, not whether anything is getting exploited in the wild. i want to know if we're leaning on EPSS and business context to decide what gets patched first, or if we're sorting by base score and hoping.
process. KEV tells you what's being exploited. SSVC at least forces us to think beyond CVSS. Is it exposed? Is anyone exploiting it? Does it actually matter to the business? That kind of thing. useful, but it's still triage. the harder part is root cause. do we know why the same classes of vulns keep coming back, or are we scanning and patching on repeat with nothing written down?
remediation speed. do we have real SLAs (critical external stuff inside 14 days, say) and are we tracking MTTR against them, or do we just feel fast? half our criticals only surface on a credentialed scan and a chunk of our hosts fail auth, so even the number i report up is shaky.
validation. are we rescanning to confirm the patch took, or did the jira ticket auto-close and everyone moved on?
with two heavy hitters the gap isn't coverage, it's that the same host shows up twice with different asset IDs and now my counts are lies. i spend more time deduping assets across the two consoles than i do patching some weeks.
so for anyone running a multi-tool setup: what do you track to know the program is healthy? MTTR, or the share of exploited CVEs still sitting open? or did you give up on stitching the two together and move to something that unifies them
I used to think a hobby had to be something you were actually good at.
But lately I’ve been enjoying tiny low effort things. Making tea a different way. Taking random photos on walks. Looking at plants. Trying to keep one little routine alive.
Nothing impressive. Nothing worth posting as an achievement.
But it gives my day a small peaceful moment, and honestly that feels enough.
Do you have a hobby that looks boring from the outside but actually makes your life better?