Pinned Tweet
I’m 39 and starting over for almost 1y now
For 10y I devoted myself to Pluto TV’s founding team, steering product engineering from zero to its acquisition by Paramount Pictures in 2019 for $340M, and beyond $2B as one of its brands.
I built apps before it was cool, by hand, like a caveman
I quit last year to start over in the app space, which changed substantially compared to when I started.
Like many tech founders, marketing and sales is a real challenge for me and I’ve been focused in getting better at it every day
Software engineer for 23 years, from 🇧🇷 Brazil but traveling the world (🇹🇭 Bangkok now, 🇮🇩 Bali next)
Looking to connect with other founders and if you’re in Bangkok or Bali, let’s link up!
Thiago 🥭 retweeted
Playwright and browser security reminder.
We saw a post suggesting that you delete Playwright because it bundles browsers with CVEs. That is a misconception. Do not delete Playwright🙃. Here is how it works and what you should do.
No Playwright package bundles a browser. Agents on Playwright MCP or CLI run your stable Chrome, which gets Chrome's security updates, with the sandbox on.
🤖 If you use Playwright MCP or the Playwright CLI
They use the stable Chrome / Edge on your machine, so it gets its normal updates. No config edit is needed.
🧪 If you use the test runner
When you run npx playwright install, Playwright downloads Chrome for Testing, pinned to the build we tested that release against. The pin is on purpose. Your tests run on the same browser on every laptop and CI machine, and a browser
update cannot suddenly break your suite. You choose when to move by upgrading Playwright. New releases usually pin a build ahead of stable Chrome, so you see breakage before your users do.
We recommend this for full e2e test suites on your own trusted app. This build can miss Chrome security fixes until the next Playwright release, and by default it runs with the sandbox off. Do not use it on the hostile web.
📚 If you use the library API
chromium.launch() has the same defaults: the pinned build with the sandbox off. If your code visits pages you don't control (scrapers, agent scripts), max out protection:
chromium.launch({ channel: 'chrome', chromiumSandbox: true })
🔒 Always keep Chrome / Edge updated. Some bugs can escape a sandbox.
Happy testing!
Thiago 🥭 retweeted
‼️ Apps built with the AI app-maker Lovable left passport numbers, payment information and 200,000 chat messages open to anyone, no login needed.
German security firm Crissy Field scanned 159,041 Lovable projects and found databases with email addresses readable on 7,403 sites.
Lovable promises no coding skills are needed. Its terms make customers responsible for their apps and data.
Lovable told German business daily Handelsblatt the problem is industry-wide.
PSA for those of u vibecoding naked on your laptop with no containers: tell your agents to DELETE Playwright NOW. Even the latest (1.64.1) bundles early Chromium.156 with
CVE-2026-118306
CVE-2026-118331
CVE-2026-118348
CVE-2026-118344
And the Playwright SANDBOX IS OFF BY DEFAULT
I was telling my friends yesterday that I believe everyone will be working on entertainment in the future, because knowledge work is solved
But I don’t think it’s a zero sum game: humans apetite for entertainment is
- insatiable
- perishable
- illogical
- and they love variety
We like people like us so we will have a roster of people we watch because they are like us
This is so true that even Meta’s Andromeda filters ads based on this
Not a extreme zero sum game
there will be 100x more ppl trying to be creators & get a large following than there are now very soon on every platform. the macro reasons are quite obvious.
& everyone will be heavily competing in a extreme zero sum game which is attention because ai is driving all of the value up the stack.
this also unfortunately means ppl will do even more wild things, make up things, copy others etc just to gain market share if you will.
e.g. if you search on youtube for virtually anything you’ll already feel the saturation like crazy.
buckle up.
Hard to overstate how big of a deal this is.
tl;dr — ANY unpatched Linux server with even a single TCP port exposed to the internet (say for HTTP or SSH) and MPTCP active (default for many Go web servers) is vulnerable to complete takeover.
What a disaster atlasum.net/blog/cve-2026-98…
Thiago 🥭 retweeted
The chances of being killed by a landmine delivered by a bear are low, but they are never zero.
I’ve been watching a lot of ads while browsing YouTube and Google’s ad inventory is awful
The ad experience in Meta’s properties is 100x better
Thiago 🥭 retweeted
Since no one wants to say it, I’m going to...
Organic acquisition has changed forever, here's why:
1. Traffic is falling almost everywhere. Across many software companies I've looked at, traffic estimates peaked around April 2025 and then fell, some by around 50%. If yours dropped, it might not be just you.
2. Falling traffic ≠ falling revenue. At VEED, clicks from search have dropped, but revenue from the channel has stayed stable. Find out which visits disappeared before you panic.
3. Brand demand is the moat. VEED was in previous a16z consumer AI rankings but not this year. My impression is that companies relying on generic search are losing ground, and companies with brand and direct traffic are holding up. That's a hypothesis I'm still testing, not a conclusion.
4. Brand search starts somewhere else. Creators, influencers, Meta ads. Gamma's micro-influencers and Higgsfield's sheer volume of content stand out. Paid creator programs work like a portfolio: one outlier video can pay for lots of flops. But volume alone won't hold up once people get sceptical.
5. The best demand is still earned. Someone uses a product, gets a great result and tells a friend. That is still one of the most powerful acquisition mechanisms available. Linear and Notion are the kinds of companies I associate with this. Templates, workflows and communities give that enthusiasm a way to spread.
6. Prosumer software needs cheap acquisition. Lots of prosumer SaaS only works because people arrive free through SEO and word of mouth. If that dries up, ads often can't replace it, because your margins won't allow it. "Just find another channel" can mean rethinking the whole business.
7. AI changes discovery, and it can replace the tool itself. Getting recommended by ChatGPT matters. But people increasingly just get the work done there, like uploading bank statements and asking for a spreadsheet instead of searching for a tool. The takeaway for founders is simple: make your product easy for agents to use. That's the future.
8. AI overviews. Google answers before anyone clicks. AI Overviews put the answer on the results page. Being mentioned is great, but a mention isn't a visit, and a visit isn't a customer. Measure what visibility actually gets you.
9. Ranking #1 can feel like ranking #8. When we went big on SEO in 2020, ads were a small, obvious part of the page. Now ads and AI Overviews fill the first screen. Stop asking where you rank. Ask what sits above you.
10. Google is stuck between two incentives. It has to protect a huge ads business while reinventing search with Gemini. Those goals don't always line up with businesses that rely on organic clicks. Plan around that.
BTW, this isn't a doomer post.
New entrants are still winning with SEO.
I've seen exact-match domains rank for competitive terms with tiny backlink profiles. The opportunity hasn't gone. It's moving.
Our job as founders is to figure out where, and build for that.
As someone who has personally spent $500k / mo+ on Google Ads for years, I can tell you with certainty:
This revenue growth in Search is artificial & extremely unhealthy for Google’s business long term
Search volumes are declining as legacy search is being increasingly cannibalized by non-monetized LLM queries
Google’s response?
Manufacture revenue growth via short-sighted, highly extractive, customer-hostile tactics. I.e. charge advertisers more for lower quality clicks, including clicks they do not want and explicitly did not approve Google to charge them for
A few examples to illustrate:
For all of its history until recently, Google operated on a 2nd price auction model
I.e. if you bid $5 CPC and the next highest bidder bids $1 CPC, Google charged you $1.01 for the click (one penny more than the 2nd highest bidder) rather than the $5 you bid
This was a genius move by Google early on as it incentivizes advertisers to input their true maximum willingness to pay rather than trying to play the game of bidding low and constantly adjusting to try to stay just ahead of the next highest bidder while still not paying too much
However recently, Google silently deprecated the 2nd price auction and began charging advertisers as much as their bid and budget caps allow, regardless of what anyone else is bidding
It’s a short-sighted cash grab at the expense of the long term health of the advertiser ecosystem
Making thing worse, Google also recently nerfed keyword targeting precision
Google previously had precise keyword targeting settings that allowed advertisers pick individual search phrases to bid on, defined down to the character w/ exact match or phrase match targeting
This was one of the core features that made search advertising magic, enabling advertisers to run extremely precise campaigns based on exactly what their target customer typed
But now, even if you bid on a specific term or phrase using the strictest exact
-match targeting settings, Google will show your ad across 1000’s of unrelated keywords, labeling them as as “exact match (close variant)”
The definition of “close variant” means whatever they want it to and changes constantly. The result is advertisers get billed for clicks that are totally irrelevant to their business and that their targeting settings explicitly forbid Google from targeting. Google does it anyway and there’s no ability to turn this off
So now exact match is broad match, and broad match is just meaningless spam
This is all very bad for advertisers, but for Google, it allows them to show your ad and bill you for clicks across 1000x more searches that were previously going unmonetized (mainly because they’re garbage queries no one wants)
This is how you grow revenue atop declining search volumes
Lastly, and perhaps most egregiously, Google quietly stopped respecting budget caps by a factor of 2x. For example campaigns we’ve been running for years with $1000 daily budget caps suddenly began spending $2000+ per day
And the extra spend is entirely on the garbage keywords Google arbitrarily throws in as “exact match (close variants)” which have no value to our business, but can’t be turned off
Google offers no refunds nor any recourse for overspend or spend on keywords you explicitly did not target
These are not the actions of a healthy business. These are the actions of company whose core business is in decline but desperately needs to pump quarterly earnings so Wall Street will continue to fund insane capex while hopefully looking through their rapidly deteriorating negative free cash flow
Google operated a benevolent monopoly for the better part of 25 yrs
Meaning the value Google captured from Search was but a small fraction of the value it created, and that spread produced a potential energy that justified expectations of high earnings growth far, far into the future
This is now no longer the case
At the alter of AI capex, Google is sacrificing the golden goose
Thiago 🥭 retweeted
Let me tell you an interesting story.
A developer contacted me after Apple terminated his developer account for repeated IP violations.
The pattern was always the same: he’d receive a complaint, fix the issue and then bring it back some time later.
Eventually, Apple terminated his account. Over $100K in payouts frozen.
He decided to go public. Here’s what he did.
He created a fake profile on X. Didn’t even reveal his real name. Didn’t disclose which app was involved or explain what had actually happened.
Sure, the story got impressions. But the result? Zero.
On the second day, X suspended his account too.
He never contacted me again…
If you want to raise awareness about a problem, you need to be willing to share the facts.
You can’t expect people to take your side when you hide the very details they need to understand what happened.
Thiago 🥭 retweeted
Oh, and here's the app :)
$114K in revenue. Apple is deleting my account for "fraud".
Over a tiny update I tried to ship 6+ months ago.
8+ rejections. 1 call with App Review. 1 full app rename.
Still rejected. Now my app is off the store, and my whole account is next.
Here's the full story:
The update added one new library. That's it.
Rejected: change keywords that had been there for over a year. mm okay.
Rejected: change a subtitle in some random localization. if it helps..
Rejected: screenshots.
Rejected: the same stuff, all over again.
Rejected: rename the entire app.
That one hurt. Most of my traffic comes from people searching that exact name.
So I asked for a call. Surely we could clear this up live.
The reviewer was genuinely great. He said the name was the last thing, everything else looked good.
So I renamed the whole app, submitted, went to sleep.
3 days later. Woke up to a generic rejection. Subtitle, screenshots, the full combo. Again.
So I asked myself: do I REALLY need this update?
I didn't. I dropped it and moved on.
Today, in that same old thread: "Pending Termination Notice. Evidence of Dishonest or Fraudulent Activity."
My appeal is with the App Review Board.
If it fails, this is what termination means:
Every app I've built, gone.
Every user, gone.
And I can never open a new developer account. Ever.
All over one library update I never shipped.
How do we solve a miscommunication like this?
I’ve been reading about app founders on X having their Apple Developer accounts terminated
And while they love to complain about being the victims, none of them seem willing to disclose which apps they were publishing. Strange…
I can’t feel sorry if you’ll be stealth. Tell the full story or shut up
I’ve been publishing apps on Apple’s platforms for 23 years. They’re definitely nitpicky, and their patience for BS has clearly run out
If you’re not doing sketchy stuff, you probably don’t have much to worry about
Thiago 🥭 retweeted
TanStack DB 1.0 RC1 is out!
Backend data that feels local: typed collections, live queries, and edits that show up instantly, then sync.
Start with your REST API. Add persistence, offline writes, and real-time sync later. Your queries stay the same.
Thiago 🥭 retweeted
I would strongly consider uninstalling any third party js right now if I were you. Especially if it comes from a startup.
Analytics, monitoring, etc are all massive site takeover risks. If you use a tracking script from a third party SaaS, then if they get hacked the hackers have total control over your site too.
This is what took down Polymarket today. They used a tiny script from a SaaS that tracks page load speed. That company got hacked, and the hackers subsequently stole millions from Polymarket users.
If you want to use analytics safely, I would use a product that lets you pin the tracking script and control when it changes. Most of the mature products support this, e.g. Sentry, Amplitude, PostHog, Mixpanel, Heap. If not, you need to trust the company behind it a lot...
Railway got hacked last week. Railway! That's a very competent team, with particularly strong infra chops. The agent swarms are on another level.
A typical analytics company is nowhere near as sophisticated. You should ask yourself: do I trust this company's security more than Railway? I was an analytics CTO in a past life, and I will be the first to admit: we had some great people but we were not on this level.
We (Detail) just uninstalled our session replay, which was a product I loved but is not worth the risk right now.
I hate to write this because I spent a good chunk of my 20s benefitting from product teams taking a chance on a nothing startup and installing our js on their site. But in the past two weeks this risk vector has exploded. It's better for the ecosystem if we move away from third party js as fast as we can.
Thiago 🥭 retweeted
The ability to build anything has come with a critical lesson:
Engineers have really, really bad ideas.
I’m from Curitiba and I can confirm it’s pretty nice there.
It’s the coolest capital in Brazil (literally, it has the lowest temperatures)
I drove many many times to Santa Catarina to party with friends. Beautiful beaches.
Looking back and after traveling the world for the last 15 years, the South in the 2010s was underrated
Now our hidden gem is being discovered 😭
This is what I mean
South Brazil is great
Then read up on the "Southern Cone"
It's why @peterthiel it's moving there
You have to see them all as separate from Brazil imho

































