Co-founder of SMSBump (acquired by Yotpo) Co-founder of NitroPack (acquired by WP Engine) Co-founder of Consentmo & https://teapawt.net/t.co/CpxTuGozo3
On the fast side of internet
Joined February 2010
- Tweets2.3K
- Following344
- Followers478
- Likes2K
Shopify "moves in silence" and then delivers.
Today we unpublished hundreds of apps from the App Store. They came from a small group of high-volume submitters and had no merchant installs.
The App Store exists to solve real problems for merchants. Mass submissions distract from the partners who are doing that work.
Weโll soon be announcing new restrictions that limit the number of apps that can be submitted at once and weโll keep raising the bar.
I joined the Shopify ecosystem in 2017, and I couldn't be prouder of that decision. In recent weeks, a wave of targeted attacks has hit app partners across. @consentmo was one of them, and like others, we were delisted from the App Store.
Prosperity and security are a shared responsibility for all of us, so we want to be open about what happened and what we did.
WHAT HAPPENED
On the morning of October 19, Consentmo was hit by a large-scale automated attack. The attack ran for 90 minutes before we shut it down. The attacker abused one of our endpoints at around 1,300 requests per minute, rotating IP addresses to dodge blocks.
The intent was to alter cookie banners with a script that reads cart contents and, when a shopper clicks checkout, redirects them to a fraudulent page.
The altered banner only appeared to visitors who had not yet made a consent choice; shoppers who had already made a choice never saw it.
Our investigation found no evidence that merchant data, Shopify access tokens, Consentmo accounts or consent records stored by Consentmo were accessed, and the attacker had no access to any merchant's real checkout.
Because the window was short and outside peak hours for most stores, the impact was limited.
WHAT WE DID
We restored every affected banner the same morning, secured the endpoint with full authentication, a WAF, monitoring and blocking, and all access tokens have been rotated and replaced with expiring ones.
New guards make sure banner content can only be updated by the merchant.
We reported the incident to Shopify's security and partner teamsโ shortly afterwards, knowing it might lead to a delisting. Every affected merchant has been emailed.
We hired an independent, CREST-accredited security firm to complete a full incident review and a full penetration test. All findings have been fixed and retested.
On our side, weโve audited every route in the app, added automated security tests to our release pipeline, and hardened access controls and infrastructure.
We have applied to Anthropicโs Cyber Verification Program.
WHERE WE GO FROM HERE
Consentmo works as normal for existing merchants: you can keep your app installed and the embed enabled. We're working with Shopify toward relisting.
Weโll keep sharing what we learn from this. In the meantime we recommend every Shopify app partner review to review Shopifyโs โSecuring your app, togetherโ checklist and apply to Anthropicโs Cyber Verification Program.
If you have questions you can DM me. Happy to share notes.
Mihail Stoychev ๐ retweeted
One plan now covers Cursor, Grok, Grok Bot, and X.
This is the biggest change to how Cursor is priced.
If you've been with us since the early days, this will feel like a lot, so I'll walk you through it.
First, every change is opt-in. If you do nothing, nothing happens.
You can keep your current plan with the same benefits, behavior, and pricing, and still move between the current plans. New sign-ups and anyone upgrading from free Cursor go to the new plans.
Here's what's different:
1. First-party usage
For most users, Grok and Composer coding limits are at least double what the matching Cursor plan gives you today.
We worked hard to make usage grow faster than price at each tier:
Plus ($8/mo): our base plan
Premium ($30/mo): 4x Plus usage
Super ($100/mo): 15x Plus usage
Ultra ($200/mo): 50x Plus usage
That's on top of every other product included in the plan.
On the new plans, Cursor usage limits move from monthly to weekly. Grok, Cursor, and X share one weekly pool.
All Grok Bot usage is treated as first-party. So on Premium and up, you get at least double the Grok Bot usage.
We know AI can get expensive. If you're trusting us, you should get as much as we can deliver. That's what we're aiming for with these new plans.
2. Products
Every paid plan includes X Premium features. Grok @Bot comes with Premium and up.
If you're reading this on X, you can now get those features as part of Cursor and @Grok. Your plan also covers Grok chat, Voice, and Imagine images and video.
Grok Bot access has been one of the biggest pain points we've heard since it launched, and it's a big part of why we're excited.
3. Third-party models
You can keep using every model you rely on in Cursor.
What's changing is how those models are billed on the new plans: they come out of your usage credits at the provider's API list price, the same as paying the provider directly.
Current Cursor plans subsidize third-party models, so you can get inference below API price.
At @SpaceXSI, we want to give you as much value as we can on our own models. That's why Grok usage limits are increasing and why we're treating Grok Bot usage as first-party.
We're still committed to Cursor being the simplest way to use models from many providers in one place, and we'll have more news on this front in the coming weeks.
If most of your usage is on third-party models, the new plans might cost you more, so check your usage before switching. That's one of the main reasons these plans are opt-in.
Cursor Pro and Pro+ subscribers who switch get Premium at $20/mo or Super at $60/mo for 6 months (normally $30 and $100).
4. Credit unification
Cursor credits and xAI API credits are coming together - prepaid xAI API balances now move into Cursor.
If you've been running the xAI API and Cursor as separate accounts, this is the start of managing both in one place.
It also means tools like Grok Voice become more accessible to all builders, and our biggest Grok users can now take full advantage of Cursor.
That's a lot of stuff! In summary:
Cursor, Grok, and X are all part of SpaceXSI.
That gives us economies of scale, and this unification is one of the main ways we can pass that on to you as savings and more usage.
Whether you should switch depends on which products you use, and that's different for everyone. If you pay for X today or most of your usage is on Grok, the new plans are probably a better deal.
To get started, check out cursor.com/pricing
What hasn't changed is why we do this: we want to build the best tools we can for you, and we think one plan across all of these products gets us closer to that.
If something here doesn't make sense or feels unfair, please let me know. I'm here to help.
New in @consentmo: Terms & Conditions ๐
Your terms. Customers' agreement. Saved in your consent records.
Ever since @AnthropicAI joined Co-work and the regular chat I cannot adjust the model effort level for my older chats and you end up what you start with.
Change the model and your whole chat is recached or pay the bill even for the small iterations you want.
@ClaudeDevs @bcherny
TCF 2.4 is now available in @consentmo ๐
Weโre helping you stay up to date with IAB Europeโs latest consent standard ahead of the 23 October 2026 transition deadline.
For Shopify stores using TCF, this brings clearer explanations and practical examples of how shoppersโ data is used, right in the cookie banner
๐ค Made with AI
Starting today, Consentmo works with Muse for Small Business, a new AI product from Meta.
If you run a Shopify store and privacy is one more hat you wear, connect your Consentmo account and ask Muse where your store stands. It reads your compliance score, your trackers and your open privacy requests, then tells you what to fix first.
apps.shopify.com/gdpr-backpaโฆ
Shopify Sidekick just got two sidekicks. ๐
I love seeing how much our Shopify merchants use Sidekick with Consentmo.
So we're sending reinforcements. Starting today, Consentmo also works with ChatGPT and Claude.
Two new AI assistants to help you understand your storeโs privacy data.
Mihail Stoychev ๐ retweeted
Rolling out now: the new Dev Dashboard
App development, collaborator access, and store management, now in one home
Demo with Shankar Chandran
Mihail Stoychev ๐ retweeted
ChatGPT Ads for @Shopify is live. We are @OpenAI's first commerce partner.
OpenAI pulls straight from Shopify Catalog, so merchants' products are already there.
Merchants set their own campaigns, their own budget. Free to install, tracked right from the Shopify admin.
Consumers are asking ChatGPT what to buy. Shopify merchants are able to decide exactly how they show up.
apps.shopify.com/chatgptads
Mihail Stoychev ๐ retweeted
US long-term unemployment is at crisis levels:
The number of Americans unemployed for 27+ weeks surged +155,000 in August, to 1.93 million, the 4th-highest reading since December 2021.
As a % of total unemployment, this metric rose +1.5 percentage points last month, to 27.0%, the 3rd-highest since December 2021.
Long-term unemployment has now increased for more than 3 years.
This figure is now higher than in every recession except the 2008 Financial Crisis and the 2020 Pandemic.
By comparison, during the current economic cycle, this percentage bottomed at 17.8% in February 2023.
The labor market continues to appear weak beneath the surface.
New in @consentmo: Age Gate ๐
Set age rules by location, choose how visitors confirm their age, and match the check to your brand and your visitor's language.
Two display modes, three ways to confirm, every country covered.
Google-certified. Again. ๐ช
@consentmo has been recertified by Google for another year.
Proud of our team. Grateful to everyone who trusts us.
๐ค Made with AI
Team is cooking ๐ฉโ๐ณ๐จโ๐ณ๐งโ๐ณ
This is actually MAJOR ๐คฏ ๐๐ฐ๐ฐ๐ฒ๐๐๐ถ๐ฏ๐ถ๐น๐ถ๐๐ ๐ฆ๐ฐ๐ฎ๐ป๐ป๐ฒ๐ฟ now LIVE in Consentmo
I'm honestly so happy to announce this ๐คฉ
What you will get:
โ
Scans key storefront pages against WCAG 2.2 AA
๐ Instant Accessibility Score out of 100 + risk level
๐ฏ Flags your highest-impact issues first
๐ Groups repeat issues - one fix, many pages solved
๐ ๏ธ Clear technical guidance for every issue
โฐ On-demand & scheduled scans
โ ๏ธ A monitoring tool, not a full audit - fixes need theme changes
Compliance and Accessibility in one place called @consentmo
Enjoy!
Mihail Stoychev ๐ retweeted
One of the most eloquent explanations of immigration youโll ever hear.
Milton Friedman had an extraordinary ability to cut through the political bullshit and explain complicated issues with simple economic logic.
Still relevant today. ๐ฏ
Mihail Stoychev ๐ retweeted
If youโre in your 20s (and ambitious) do everything to move to those 4 cities
Yes people will mog you for paying extortionate rents for such little comfort but who cares, youโre not everyone, youโre on a mission, youโre here for greatness
London/NYC/Paris/SF are basically the golden 4. Theyโre not just big cities, theyโre global sorting machines. People move there from all over the world because they want sth badly enough to accept all the downsides. The guy born in London can be lazy. But the 26yo Frenchman, Indian, American, Italian, Nigerian, Lebanese etc who voluntarily accepts the tiny flat, shit commute and absurd rent to be there has already self-selected pretty hard
And that selection compounds. I felt it instantly moving from my hometown in France to London. Growing up I was always โthe ambitious oneโ in my friend group. Then you arrive in London and suddenly you feel extremely average. Everyone is trying to do sth. Completely changes your reference point for what a normal person can achieve
The other thing is just how many serious games are happening at once. If you know at 22 that youโre going to be a semiconductor engineer forever, maybe there are better specialised places. But most ambitious 24yos have absolutely no clue what game theyโll eventually want to play. In London/NYC/Paris you can accidentally become friends with people in PE, startups, politics, law, media, fashion, pharma, academia etc. Your finance friend dates someone in fashion, their roommate is building a startup, you meet someone in politics at dinner. Suddenly 5 completely different lives feel plausible
Thatโs insanely valuable when youโre young precisely because you donโt yet know which people / industries / opportunities will matter to your 34yo self
SF is the weird exception because itโs basically one giant concentrated bet on tech/AI. Much narrower than the other 3, but that game is so asymmetric rn that it deserves its spot. If you want to build at the frontier thereโs probably no other place where your reference class changes that aggressively
And yh everyone keeps saying the internet made geography irrelevant. Maybe for information. Definitely not for trust/friendship. Anyone can learn from the same people online now, send the same cold DM, follow the same accounts. Much harder to replicate being the guy someone has had 20 dinners with, worked with, travelled with, introduced to friends and randomly bumped into for 5 years
When youโre 24 and nobody knows who tf you are, geography can do a lot of the work for you. You get invited because your colleague knows someone. You end up at a dinner because your friend needs a +1. Someone you met 3 years ago leaves and starts a company. Another moves to NYC. Another becomes a partner somewhere. Most of the ROI is completely impossible to predict upfront
Basically before you have your own gravity, borrow the cityโs
At 45, if youโve built the company / reputation / money / audience / network, you can go live in Tuscany, Mallorca, South of France or wherever and people will come to you. At 24 no one is coming lol. You should probably be where everything is happening
And tbh if you have the ability to move I wouldnโt spend 3 years waiting for the perfect job / apartment / timing. Get the shitty room, accept being poorer for a while, figure it out once youโre there. Your 20s are probably the cheapest years of your life to tolerate inconvenience anyway
You can optimise sqm, weather and comfort later
At 24 Iโd rather maximise how many possible lives are available to me
Published doesnโt always mean visible.
Thatโs why weโve launched Automated Monitoring in @consentmo .
It checks your key compliance pages and integrations every day to make sure theyโre accessible and working as expected. If we spot an issue, weโll show you what needs attention and notify you.
Less manual checking. More peace of mind.
Well @Shopify wants all app developers to integrate with Sidekick but apparently Sidekick should be "blind on purpose" about basic information about your app pricing plans. Who ever thought this is a good decision.
Some examples of NOT ALLOWED stuff:
"what is my app plan"
"how much I am paying"
"what I am paying for"
"what features does my plan contain" -> examples attached
are all seemingly against "the app's stated functionality" whatever this means. ๐ค๐ค
Can someone actually explain how this actually makes sense?
@liam_at_shopify @ShopifyDevs
Shopify keeps printing! Best platform around!
Q2 is in, and it was a monster quarter.
โ $116B in merchant sales, up 32% YoY
โ $3.6B revenue, up 34% YoY
โ $654M free cash flow, 18% margin
Five quarters running, GMV has grown more than 30%.
The bigger story is underneath the numbers: every shift AI is creating happens to play to @Shopify's strengths.