The Hayaiti shipping log
Engineering notes, security write-ups, iOS deep dives, and the occasional rant about how agencies should work. Honest cadence, no recycled medium posts. Bylined as the founding team until individual authors opt in to their own profile.
19 posts
Built on tools you trust
← swipe · 12 tools →
Featured
The bounded SKU model: why we don't sell time
Most engineering vendors sell hours. We sell deliverables on a calendar. The unit of accountability is different — and it changes both the vendor incentives and the buying experience.
Most agency homepages claim to be the right fit for everyone. We're not. Here's a concrete list of when to pick someone else — written by us, for our own site.
Every B2B SaaS pentest scope says 'web app + API'. Almost none of them say 'cross-tenant data access via IDOR, RLS bypass, JWT scope leaks, shared S3 paths, leaky webhook payloads'. That's the gap.
The same e-commerce business can fall into two different PCI scopes depending on a single architectural choice. The cost difference is roughly 10x. Most teams don't realize it until the QSA quotes them.
What the 2026 build-with-AI workflow actually looks like when an agency uses it on itself. Stack, what helped, what hurt, what the cohort program teaches.
Most agencies hide their prices. We publish every SKU. Here's why we made that bet, what we lose, and what we gain.
Discovery calls are a tax on both sides. Here's how we replaced them with a spec, a price, and a 24-hour audit.
How we shipped hayaiti.com in 14 calendar days, while preparing the productized SKU catalogue. The schedule, the tools, what broke.
Default to RAG. Reach for fine-tuning when retrieval can't close the gap. The six-axis decision matrix we run on every client LLM build.
$34,995. 45 calendar days. Spec to App Store. The day-by-day schedule we run, the risks at each phase, and where we cut corners (and where we never do).
The rate limiter we run in our internal tooling. ~120 lines of Rust, lock-free, observable, and the failure modes we hit before it stabilised.
We checked the top 10K domains for dangling DNS records pointing to deprovisioned cloud resources. The numbers are bad.
We tried both for two years. Linear wins on speed, keyboard nav, and not making the PM job a full-time role.
A page-by-page tour of the audit PDF. What we check, what we explicitly don't, and why.
Three OAuth state-handling bugs we reported on bug-bounty programs last quarter. All three were exploitable. Here's the pattern, the fix, and why CSRF tokens alone aren't enough.
We're a new productized engineering studio. Web, software, iOS, security. Pricing on the page. Here's what we believe.
Some agencies hold source code as leverage. We push to your repo from day one. Here's what that costs us, what it gains you, and why it matters at exit.
Industry data on agency CAC, sales-cycle length, and discovery-call burn rate. The numbers are worse than you think.
Not a pitch. A teardown of what makes Linear feel different, and what we'd steal if we shipped a competitor tomorrow.
One email a week. What we shipped, what we learned, what we tried and abandoned. No spam. Unsubscribe anytime.
19 posts published · weekly cadence · Prefer RSS?
We take requests. If you’d find a write-up of a specific pattern, technique, or tool useful — tell us. We’ll probably write it.