7 years in the Army. 10 years selling HVAC. Then I used my GI Bill on a cybersecurity degree while riding a motorcycle around South America. Planned to keep going. Met my wife in Colombia instead. Now I sell cybersecurity, run a coffee farm, have 2 kids, and vibe code for therapy. The plan was overrated.

Most small businesses don't need another security tool. They need MFA on email, a named owner for every admin account, and one person who actually reads the alerts. Boring and cheap, and it stops most of what I worry about.

Builders running one or more AI agents: what's the one permission you will never give them? Mine is delete anything I can't restore.

Sunday security homework. 30 minutes, nothing to buy. Bookmark it and do it again next Sunday. Put a passkey on your email first. Email resets everything else, so it's the account that matters most. Remove the OAuth apps you stopped using in your Google, Microsoft, and GitHub settings. Each one is a standing key to your stuff. Set a spend cap or budget alert on every AI and cloud API account. A leaked key with no limit isn't just a breach. It's a bill. Open your password manager's breach or weak password report, if it has one, and fix the top 3. Not all of them. The top 3. Next Sunday, 3 more.

Sunday 7am coffee before anyone's awake. Growing coffee teaches you that you can't rush a harvest. Software keeps trying to teach me the opposite. Coffee is winning.

Saturday night. Kids down, house quiet, and I'm deciding between fixing a bug and going to bed. Experience says bed first. The bug will still be there tomorrow. It always is.

Spending the weekend moving every account I can to passkeys and security keys. If you only take one thing from it: register 2 keys, not 1. One on your keyring, one in a drawer. A single key is just a fancier way to lock yourself out.

Before anyone gets on the Virdo CRM beta I deleted a test workspace on purpose and restored it from backup. You don't have backups until you've restored one. Everything else is a hopeful screenshot.

Unpopular in security circles: most breaches I worry about aren't clever. They're a key in a repo, an admin account nobody owns, and a log nobody reads. Even the AI agents that breached Hugging Face leaned on publicly exposed credentials and a sandbox that could reach the internet. Boring fixes beat fancy tools.

My 3-year-old daughter has figured out that "five more minutes" is an opening offer, not a deal. I respect the hustle.

Live long and prosper 🖖. What’s your daily stack?

1Password just shipped a way for AI agents to log into sites without ever seeing the password. Approve, fill, access ends after the task. That is the right shape. Agents should borrow access, not own it.

Kids asleep, laptop still open. Pre-beta testing Virdo with Muse, Grok Bot, Claude Duet, and Hermes all running full steam ahead. Four agents hammering the same CRM at once. The morning shift is where I find out what broke.

20 minutes into @Claude Duet, I've hit 3 limitations. It's too restrictive for me, too many guardrails and needs too much permission.

I got access to @Claude Duet....hmm what should I test out.

My daughter is 3 and already negotiates like she bills by the hour.

Builders, what are you running your database on, and why that one? Virdo is on DigitalOcean Managed Postgres. Boring reasons: it's where my app already lives, $15 a month, backups and restores handled. I tested the restore before I trusted it. Supabase, Neon, self-hosted, something else? What made the call for you?

6am coffee, house still asleep. The only part of the day where nobody needs anything from me. I guard it like it pays rent.

My Royal Enfield has been parked since my daughter was born. Three years now. I keep saying I'll get it running again one of these weekends. The bike is patient. Mostly, so am I.

100 launch in January. 60 are quiet by spring. 30 are on a different project by summer. 10 are still posting in December. 1 is still on the original idea. The filter is the calendar. My moat is to be the last 1 standing.

Deleted the whole test workspace this week, on purpose. Then restored it. 20 contacts came back, the deals came back, the consent rules came back. Boring test. It's also the only kind I fully trust.