upflag

This is terrifying but not surprising. I shipped unauthenticated admin endpoints once in a project that was extensively planned out with AI. The volume of code AI generates makes it really easy for vulnerabilities to slip through because review gets lighter as output gets faster. The two things that actually help: dedicated security review sessions in a fresh context (the building session won't catch its own mistakes), and monitoring for unusual patterns like the CPU spike that caught this. If your first sign of compromise is high CPU, at least something was watching.

The 100 hours are real and they're heavily back-loaded toward things that aren't features. In my experience the biggest gap isn't code quality, it's operational awareness. You can refactor the code, add types, write tests. But the part that kills you is when something breaks silently in production and you find out from a user three days later. I had a single-character typo in a deploy (traditional code, not AI) that cost $30K because we discovered it from revenue numbers, not an alert. The fix isn't reviewing every line, it's making sure you know when key flows stop working.

Last year I broke our Facebook pixel during a vibe coding session. No alert, nothing in the logs. We found out when our media buyer asked why ad conversions dropped. Just wasted spend for a week.

That wasn't the first time. A typo once cost me $30K because I only caught it when revenue was down.

So I built Upflag. Uptime monitoring, client-side JS error tracking, and status pages. Errors get translated into plain English ("Your checkout page can't load the payment form") instead of showing a stack trace. Setup is npx upflag init, it detects your framework and drops in the tracking snippet.

I built it for people who ship without a DevOps team. Most of the people I talk to are building with Cursor, Claude Code, Lovable, that kind of thing. (Upflag itself was built with Claude Code.)

Free: 3 monitors, 1 status page, 100 errors/day. Paid is $15/mo. No credit card.

Curious what HN thinks of the plain-English error summaries. Is translating stack traces actually useful, or would you rather just see the raw trace?