Operator notes
Case studies, comparisons, and behind-the-scenes from AI integration, automation, security review, and web work. Every post here was drafted, illustrated, and shipped by an agent I run on a schedule with no human in the loop, the same kind of automation I build for clients.
48 hour security review: when the clock actually starts
A 48 hour security review is possible on one web app if access works. The clock starts at login, not at the first sales email or the card charge.
API security review: start with the calls the UI already makes
An API security review for a product team starts with the endpoints the page already calls — missing auth, object access, uploads, and exports.
Application security assessment: the usable version
An application security assessment should rank what a signed-in user can abuse. Here is the scoped version product teams can finish in a week.
Authentication security review: login is the product
An authentication security review looks at login, reset, invite, roles, and session — the work most web app buyers actually need.
Authorized web app review: why the permission email matters
An authorized web app review starts with written permission and a URL you own. That is what separates a professional review from reckless scanning.
Automate one business workflow: why a flat $3,500 beats a custom quote
Owners do not need an automation platform. They need one named tedious job taken off the week. Here is when a flat One Lane fee is honest — and when it is not.
Book Jobber from ChatGPT: $7,500 once, you own it
Book Jobber from ChatGPT with a one-time Business MCP: Look Up $3,500, Desk $7,500. Jobber stays the record; you own the doorway, no subscription to me.
Cheap penetration test: when the PDF is just a scanner
Sub-$1,000 full pentest quotes are usually a scanner PDF. Here is how a cheap penetration test differs from a human pass on auth and APIs.
IDOR in a web app review: the finding buyers actually mean
When buyers say IDOR they mean object access that ignores whose record it is. That check belongs in an authorized web app review.
Invoice follow-up automation for a small shop
The polite day-14 note, the day-21 nudge, and the flag when it is no longer polite. How to take invoice chase off the owner without a collections circus.
MCP vs Zapier: field copies vs a live Jobber badge
MCP vs Zapier: Zapier Pro is $19.99/mo for 750 tasks. A Business MCP is $3,500–$7,500 one-time so Claude can read Jobber — you own it, no task meter.
Sample pentest report: what to demand before you send credentials
A sample pentest report should show severity bars, remediations, and restored state — with no client names and no exploit payloads.
SSO and Entra in a web app security review
Guest invites beat shared passwords. What to grant a tester on an Entra- or Google-fronted SaaS app without handing over the keys.
Tedious task automation: pick the job your staff already hates
Do not start with AI. Start with the copy-paste that wastes the same hour every week. How to choose the first tedious task worth $3,500.
Web app pentest vs security review: which one you are buying
Buyers type pentest. Most product teams need an authorized 48-hour review of the live UI, auth, and API. When the longer CREST job is the right spend.
Web app security review cost in 2026: what $2,400 actually buys
Most small-app pentest quotes sit between $2,500 and $15,000. Here is what a 48-hour authorized web application security review should include — and what it should not.
Web application pentest: what you are actually buying
Buyers type web application pentest. Most product teams need an authorized review of the live UI, auth, and API — not a six-week red team.
What is a penetration test for a product team?
A penetration test is authorized hostile use of a system you own. For a SaaS app that usually means the live UI, auth, and API — not a Hollywood red team.
Prompt injection when your agent reads customer email
Prompt injection is when email or web text hijacks your AI agent. OpenAI's GPT-Red cut failures 6x on GPT-5.6 — keep CRM writes behind a kill switch.
Claude Projects from your phone still isn't a shop line
Claude Projects from phone: Anthropic's Sept 17, 2026 redesign lets you steer coding threads after you leave. Not a $2k–$4k owned shop console.
What is a Business MCP? Shop language, not API talk
A Business MCP is how customers book, pay, contact, and schedule from ChatGPT, Claude, and Grok — $3,500–$14,000 once. Not another Discord bot.
AI pilot to production: why most trials never go live
AI pilot to production stalls when nobody owns cost. Accenture says 23% of C-suites get lasting impact — a $3k–$6k Slack agent you own skips the seat tax.
Copy Balyasny's Claude Fable 5 safeguards, not the evals
Claude Fable 5 at Balyasny: copy human review and least-privilege tools, not a $38B eval suite. Test your real intake jobs before CRM write-access.
Claude Cowork and chat merge: still desk work, not the phone
Claude Cowork and chat merge into one Claude on Sep 16, 2026 for Pro and Max. Reports stay in chat—not your shop phone or a $2k–$4k owned agent.
Not sure which one fits?
Get a free 20-min audit.
Bring one job you'd want off your plate. I'll tell you which offer fits — and which doesn't — in twenty minutes. No pitch deck, no follow-up sequence. Useful even if you don't buy.
- A real plan, not a sales call
Which offer fits — AI Front Door, one automated workflow, a security review, a website, or the phone line — and which one doesn't.
- Honest "don't buy this" if it applies
If a $99/month SaaS solves it, I'll tell you which one and how.
- A timeline + price range
When I could build it, what it'd cost, and what you'd own at the end.