You're still running sprints, managing stakeholders, and writing PRDs. But now you're also expected to build with AI. This newsletter is for PMs navigating both. Practical frameworks, real build logs, and no fluff.
Live Last read · last published · next check
Here is the zombie RLS policy that exposed DraftKit creator emails, Stripe IDs, and credit balances to every authenticated user while I thought row-level security was doing its job.
One of my products has AI in exactly one place. The other has none. Both decisions came from the same five questions most PMs never ask.
How I caught a presence data leak in DraftKit before it exposed workspace activity to every logged-in user, and the SQL policy and client flag that locked it down.
Substack shipped one scanner for every genre on the platform. My own scan results show why technical writers are the ones paying for it.
How I built a three-tier publication ID resolution chain for DraftKit's Network feature, and why a silent API failure costs more than a loud one.
When everyone can generate everything, the only edge left is intent. Here is how to protect yours.
I read both pricing pages line by line and did the math neither company publishes. The gates are not where you think they are.
Most user stories describe the button. This prompt forces you to describe the transformation.
How writing logic gate specs instead of feature descriptions stopped hallucination debt from accumulating in my builds.
What a revenue expert taught me about the conversation builders never have (and what I did differently with DraftKit).
