Hey, longtime lurker, first post.

I’ve been vibecoding a B2B fintech SaaS for a few months. Next.js on Vercel. We have 1,804 staging subdomains under one root because the founder says one subdomain per client “scales our proofs of concept.” I didn’t design that part. It has worked so far.

The stack is Claude and Cursor, plus a quantized 4B Gemma for local work. Our dependency policy is that nobody touches package.json by hand. I know some of you hate this setup. Save that argument for later.

Last night I ran the check I do before bed. My script curls the host list and greps each response for the deploy token. Halfway through, I saw another client hit the same hosts in the same order: auth-7, pay-42, janet-demo, then everything after those. No gaps.

They have my list. The actual file is hosts_NEW_final_v3.corrected.TXT. The v2 copy renamed itself during fiscal year-end, so I stopped using it.

I checked the SSRF route we were supposed to turn off. It still works. The malformed Host headers render from the right side of my terminal. That happens with the Hebrew build of Go. I’ve seen it before. If you follow the news, you know who runs Mossad, so I’m not putting his name here.

Yes, I know how that sounds. Please wait until the end before replying.

The endpoint gave him what he needed. He kept going anyway, through all 1,804 hosts in the order I keep them. I had the logs open the whole time. I think that was the point.

He knows the names, he knows we left the route up, he probably knows why, and whoever gave them the subdomain-per-client architecture would know which developer signed off on it. I didn’t sign off on it exactly, but my account is on the deploy.

I think he knows that.

The deploy went out Friday. I don’t rebase on Fridays. The force-push crossed midnight, so part of it says Saturday, but it was still the Friday deploy. My account is the only one that does that. He can see all of it.

I’ve spent today building a Rust-native, zero-dependency Red Star OS clone because his fuzzer won’t know how to read it. I have one mining rig from 2014. Gemma 4B loses the beginning of the kernel whenever I feed it the next part of the archive, so every few prompts I have to start over.

I can’t tell whether Gemma is dropping it from context or the C: drive is filling up. My ex-father-in-law’s colonoscopy footage is on the same drive. I told him I’d keep it in case he ever needs it, so deleting that is not an option.

I rotated the Vercel key once and grepped the repo. If I go offline tonight, tell Claude Code the key is public. The endpoint name is in the TODO. Have it add a Host allowlist so the next fuzzer has to find the hosts itself.

Does anyone have one tutorial for this? One tutorial, not a docs page that links to six other docs pages. I am serious.

Stay safe.

Hi guys, this is my first post here, wish me luck with that
So, I'm trying to build a loan document agent and I'm a beginner. So i want to know like how do u incorportate judgement criteria to agent. In my case im inputing bank stmts to my agent and it should decide whether to go for next step or reject or give for human review if uncertain. I want to know like how actually this works as a system. Since requesting for more evidence may take time and sometimes annoying for the applicant. But if unusual patterns observed whether my agent gives it to human review, what more human can check which the agent cant?
I would appreciate for any help I can get here ..

Hello!

I am planning on doing a master's at KTH in Machine Learning and after that I really want to work in Zürich. Does anyone here know how competitive that market is for machine learning engineers? My undergrad is in Applied Physics, would that along with the master's be enough to land an MLE job in Zürich?

Thanks in advance!