Snapshot · This Week in Tech (Audio)
TWiT's network was breached in January and went undetected for 121 days — more than 4 months — because the Thinkst Canary honeypot had been disconnected.
Where this was said
At 1:23:40 · chapter starts 1:08:10
The Thinkst Canary ad read turns into a genuine confession: TWiT's Google Workspace was breached in January, and Google only flagged the intrusion months later. The attackers were apparently overwhelmed by the volume of Workspaces they'd compromised and hadn't gotten to exploiting TWiT's data yet. The reason the breach went undetected internally for 121 days? Leo had disconnected the Thinkst Canary while holding it up for an ad read and forgot to plug it back in. Canary tokens — fake payroll spreadsheets, fake credentials — are the real-time tripwires that would have caught the intruder the moment they touched anything. Leo walks through the product: five Canaries, a hosted console, support, and maintenance for $7,500 a year with 10% off using code TWIT, refundable within 60 days — a refund guarantee that has apparently never been claimed [1] — Leo Laporte "Thinkst Canary breach detection gap: 121 days: TWiT's network was breached in January and went undetected for 121 days — more than 4 months…" 1:23:40 .
Even with Anthropic paying $1.25 billion/month and Google paying $900 million/month for xAI compute, xAI is still estimated to be losing at least $100–500 million per month.
TWiT's network was breached in January 2026, and the intruder stayed undetected for 121 days — more than 4 months — because Leo had disconnected the Thinkst Canary for an ad read. The breach was only discovered when Google flagged unusual activity in TWiT's Workspace account.
Ad-based monetization works well for game apps where users spend extended time in-session, as seen with Grid and Wordle.
Tool-focused apps like PuffCount are poor candidates for ad monetization because users don't stay in-session long enough.
A hard paywall is a screen that blocks all app features unless the user pays or starts a free trial — it cannot be dismissed.
Mobile apps are primarily monetized through either ads (best for games) or in-app purchases/subscriptions (best for tools).
According to the episode, YouTube outperforms every other social platform for building trust and driving SaaS conversions.
Vasco stated that the majority of his app's user base came directly from his YouTube channel.
SEO Bot features a 'Boost My Domain Rating' button that routes users directly to Listing Bot, an example of in-product cross-selling.
The founder's entire product portfolio is AI-related, making it easier to package products attractively for directories.
The founder attached their SaaS demo to the trending debate about whether AI coding is actually good enough to build a full SaaS product.
We use essential and analytics cookies to run Vuci. To understand how the site is used: Privacy Policy.
Install Vuci on your phone
Add it to your home screen for a faster, app-like experience.
Install Vuci on your phone
Tap the Share button, then “Add to Home Screen”.
A new version is available
Reload to get the latest Vuci.