Delali

If your AI agent has to search documents that your customers write in several languages, which of these will you embed those documents with? → OpenAI embeddings → Voyage AI → Narsil's local embeddings → Something else

Any token in your coding agent's settings is readable by anyone who pulls your Docker image, if your Dockerfile copies every file. Truffle Security found a working GitLab token in .claude/settings.local.json inside one image, so list **/.claude and **/.cursor in .dockerignore.

Selling your app to teams can make you the person who adds and removes every one of their members by hand. For example, when a customer emails you to remove a colleague who has left their company, that colleague can still open the team's data until you read the email and remove them. Let each team look after its members: → Give each team one or more owners, who can invite members by email and remove them on the team's settings page. → Make the server check on every request that the person who sends it is still a member of the team, and an owner for any invitation or removal. → Before you release, check that the server refuses an ordinary member who tries to remove someone, and refuses a removed member's next request.

Which of these will you use for phone calls, if customers ask to phone the AI agent in your app? → Vapi → Retell AI → ElevenLabs → Something else

When you tell customers about a breach without saying what the attacker took, each of them will have to guess what to change. On 3 November, for example, mSeven told the customers of its mSecure password manager about 'suspicious activity', and wrote that protecting themselves 'may include changing passwords, resetting or re-enrolling two-factor authentication methods'. So one customer who keeps more than 800 passwords in mSecure asked whether they had to change all of them. To spare your customers that guess, put these in your breach email: → Say how the attacker got in and which data they took. → Say what you've changed, such as the keys that you revoked. → Tell customers what to do about each kind of stolen data.

If your AI agent keeps what it learns only inside the conversation, a customer will have to tell it again in every new session what they told it in the last one. Ask your coding agent which table stores what your AI agent learns about each customer, and whether a new session loads those rows before your AI agent replies. In the guide that I've linked in the first comment, I divide an agent's memory into three parts: the plan for its current task, a record of every message and tool call, and what it learns about each person.

Which of these will you build your app's search on, once customers misspell a word and find nothing? → Meilisearch → Typesense → Narsil → Something else

In an app that a team shares, the second person to save a record can wipe out the first person's changes without either of them seeing an error. For example, one of them changes a client's phone number while the other fixes the address. If the app saves the whole form each time, it will write the old phone number back along with the new address. Before you release: → Ask your coding agent to give each record a version number, so that the server can refuse any save made from an older version of the record. → Open one record in two browsers, save a change in each, then check that the second save fails with a message that asks the user to reload.