Podbit · The a16z Show
A single leaked database credential found by Truffle Security granted access to a database holding the personally identifiable information of 3.6% of the entire world's population. The credential was found while scanning platforms like Hugging Face for exposed secrets.
Where this was said
At 21:29 · chapter starts 20:17
The final section of the main conversation is a Black Hat debrief. Feross observes that attackers seem to deliberately time their npm worm launches to coincide with RSA and Black Hat — the security community at its least attentive to production systems. But the bigger observation is cultural: in prior years, he had to explain from scratch why supply chain attacks were real risks. This year, mainstream business publications are covering them without prompting. That shift matters enormously for practitioners: executive attention and security budget follow press coverage, and coverage follows incidents. The painful attacks happening right now, he argues, will ultimately accelerate meaningful security improvements across the industry. [1] — Feross Aboukhadijeh "2026 declared 'year of software supply chain': Feross Aboukhadijeh declared 2026 the year of the software supply chain, noting supply chain…" 20:17
Feross Aboukhadijeh declared 2026 the year of the software supply chain, noting supply chain attacks have broken into mainstream business press coverage for the first time.
Truffle Security found a leaked database credential that granted access to a database containing the PII of 3.6% of the world's population.
Sam had no coding knowledge, so he used ChatGPT voice mode to generate his entire codebase and copy-pasted it into Notepad. A friend later introduced him to Cursor, and he never looked back.
Copy days of Discord chat history, paste it into ChatGPT, and ask it to list recurring pain points. The ones that come up most often are your best product bets.
Sam's top advice: when prompting Cursor, tell it to architect code for 100,000 users from day one. The AI changes its approach, building scalable frameworks instead of brittle one-user code.
With AI coding tools like Cursor, Bhanu replicates an existing free tool for a new keyword in under 5 minutes. What used to be a multi-day build is now a lunch-break task.
Ahrefs, SiteGPT, Cal.com, PostHog, Datafast, Sibyl AI, Bento, Feather, Featurepace, Mintlify, Cloud Code, ChartMogul — Bhanu runs his entire business solo with these 12 tools.
PropGPT runs on React Native with TypeScript and Python for ML, Neon for the database, RevenueCat and Superwall for monetization. LLM costs are $20/month, data APIs $100/month, and after $10K in monthly marketing spend, margins sit at roughly 50%.
Game apps keep users engaged long enough for ads to pay off. Tool apps don't — so if you're building a utility, ads are almost always the wrong call and subscriptions are your only real lever.
Inside SEO Bot, a single button labelled 'Boost My Domain Rating' routes users directly to Listing Bot. That one interaction converts a user of one tool into a user of two — without any marketing cost.
Directory listings are a powerful but underrated growth channel — but only if your product is genuinely interesting enough to earn the click. AI products have a natural advantage here because they're easy to package in a compelling, clickable way.
We use essential and analytics cookies to run Vuci. To understand how the site is used: Privacy Policy.
Install Vuci on your phone
Add it to your home screen for a faster, app-like experience.
Install Vuci on your phone
Tap the Share button, then “Add to Home Screen”.
A new version is available
Reload to get the latest Vuci.