Podbit · Syntax - Tasty Web Development Treats
Every major JS package manager now supports a minimum release age setting. Set it and your toolchain will refuse to install packages published too recently — before the community has had a chance to catch malicious updates. It's a simple config change that could prevent the next supply chain attack.
Where this was said
At 1:03:38 · chapter starts 56:36
Scott Tolinski had long been on record as an opponent of coding through Slack. Junior changed that in a week. The Sentry Labs tool (junior.sentry.dev) connects to a wide plugin ecosystem: GitHub, Vercel, Cloudflare, Datadog, Linear, Notion, Sentry, Hex, and more — plus Scott added YouTube Analytics and podcast analytics plugins himself. The Syntax team's instance is named Tasty. First trick: Scott asked Tasty to remind the team every Monday of upcoming holidays in the Netherlands, Canada, and the US. Tasty scheduled a recurring cron job without leaving Slack [1] — Scott Tolinski "Scott Tolinski once swore he'd never code from Slack. Now he does it daily using Junior, Sentry Labs' developer Slack agent. It integrates …" 56:40 . Second trick: Tasty created a PR on the Syntax repo, provided a preview URL, and passed review on the first attempt. CJ's security instinct kicks in — he immediately starts thinking about prompt injection vectors. If Junior had write access to YouTube and someone left a malicious comment on a video, it could inject commands. The principle of least privilege (currently only read access to YouTube) is what protects them. CJ connects this to the earlier code review discussion: Junior doing a Vercel build fix is exactly the workflow developers were promised when AI hype began — a small, trusted, bounded task that saves a human a round-trip interruption.
Scott Tolinski once swore he'd never code from Slack. Now he does it daily using Junior, Sentry Labs' developer Slack agent. It integrates with Vercel, GitHub, Linear, Notion, YouTube Analytics, and more — letting the whole team trigger workflows without leaving chat.
Junior from Sentry Labs integrates with 10+ developer services and lets teams trigger actions like PR creation, build debugging, and scheduled reminders directly from Slack channels.
All major JS package managers now support a minimum release age config option to prevent auto-installing compromised packages before they're detected by the community.
npm now locks high-impact package accounts into a 72-hour read-only state after suspicious authentication events, blocking attackers from publishing malicious packages.
The fastest path to Twitter growth isn't volume — it's forming sharp opinions about how the platform works and sharing them immediately. People cluster around those who understand the rules and say so out loud.
Sam had no coding knowledge, so he used ChatGPT voice mode to generate his entire codebase and copy-pasted it into Notepad. A friend later introduced him to Cursor, and he never looked back.
Copy days of Discord chat history, paste it into ChatGPT, and ask it to list recurring pain points. The ones that come up most often are your best product bets.
Sam's top advice: when prompting Cursor, tell it to architect code for 100,000 users from day one. The AI changes its approach, building scalable frameworks instead of brittle one-user code.
With AI coding tools like Cursor, Bhanu replicates an existing free tool for a new keyword in under 5 minutes. What used to be a multi-day build is now a lunch-break task.
Ahrefs, SiteGPT, Cal.com, PostHog, Datafast, Sibyl AI, Bento, Feather, Featurepace, Mintlify, Cloud Code, ChartMogul — Bhanu runs his entire business solo with these 12 tools.
PropGPT runs on React Native with TypeScript and Python for ML, Neon for the database, RevenueCat and Superwall for monetization. LLM costs are $20/month, data APIs $100/month, and after $10K in monthly marketing spend, margins sit at roughly 50%.
Game apps keep users engaged long enough for ads to pay off. Tool apps don't — so if you're building a utility, ads are almost always the wrong call and subscriptions are your only real lever.
Inside SEO Bot, a single button labelled 'Boost My Domain Rating' routes users directly to Listing Bot. That one interaction converts a user of one tool into a user of two — without any marketing cost.
We use essential and analytics cookies to run Vuci. To understand how the site is used: Privacy Policy.
Install Vuci on your phone
Add it to your home screen for a faster, app-like experience.
Install Vuci on your phone
Tap the Share button, then “Add to Home Screen”.
A new version is available
Reload to get the latest Vuci.