Notes from the workshop.
Every note is attached to a product, a scan, or a real operational pattern we watched play out in the field. We publish when we have something specific to say — never on a content calendar.
Cluster · Verglos
Verglos.
Local scanning and evidence discipline for AI-assisted code. 16 notes.
See all Verglos notes
Verglos · Architecture
AI-authorship provenance, explained
Why probable AI authorship can be useful review context without becoming a vulnerability label, blame mechanism, or substitute for code evidence.
Verglos · Design note
The local sandbox verification concept behind Verglos
A design note for bounded local finding verification, including what exists in Verglos alpha and what still has to be built safely for review.
Verglos · Product proposal
Signed evidence artifacts are the proposed Studio wedge
A product-design note on portable, signed security summaries, with Verglos' unshipped status and trust requirements stated directly for agencies.
Verglos · research note
Slopsquatting in 2026: the numbers that matter
What the primary package-hallucination study measured, what it did not measure, and how JavaScript developers can reduce installation risk before install.
Verglos · Release note
Verglos 2.0 alpha: scanner today, evidence direction next
The honest boundary of Verglos 2.0.0-alpha.1: a functional local scanner, command shells for hunt and attest, and a roadmap that is not yet product truth.
Verglos · Product proposal
The proposed Verglos Free, Pro, Studio, and Enterprise model
A transparent Verglos product-model draft that separates the local alpha from unbuilt paid tiers and avoids invented prices or entitlements.
Verglos · Comparison
Verglos vs cloud SAST: the trust-model tradeoff
A comparison of Verglos local scanning and hosted application-security platforms based on workflow, context, governance, and evidence needs.
Verglos · Product principle
What Verglos 2.0 alpha refuses
Four product boundaries for Verglos: no autonomous attacks, no cloud requirement for scanning, no compliance theater, and no roadmap passed off as shipping.
Verglos · Positioning
Why Verglos refuses the XBOW lane
XBOW and Verglos address different security jobs: authorized autonomous offensive testing versus a narrow local scanning and evidence direction.
Verglos · field guide
Verglos on the CLI, with coding agents, and in CI
The supported Verglos local scan path and conservative ways to place it around agent and CI workflows without inventing integrations or claims.
Verglos · Product principle
Why Verglos will not ship an attacking agent
The authorization, reproducibility, and trust reasons Verglos separates local evidence work from autonomous offensive testing in the current alpha.
Verglos · Research
Eight patterns AI-assisted code keeps producing
Eight reviewable vulnerability shapes that recur in fast-built JavaScript and TypeScript, plus the control that should catch each one in review.
Verglos · Research
What our 300-repository TS/JS scan did and did not show
A corrected account of the Verglos scan campaign, its published artifacts, its 57.7% high-or-critical result, and the limits on interpreting scanner output.
Verglos · Comparison
Verglos alongside Snyk, GitHub, Semgrep, Socket, and Gitleaks
A capability-bound comparison showing where a narrow local alpha scanner may complement established code, dependency, and secret-security tools.
Verglos · thesis
The security evidence layer for AI-built software
Why AI-assisted software needs reviewable security records, and which parts of Verglos' evidence model exist for builders and teams in alpha today.
Verglos · Field note
Responsible disclosure when a scan finds a live credential
A conservative workflow for containment, private outreach, rotation, patch verification, and delayed publication after a scanner finds a possible live secret.
Cluster · Only Bundles
Only Bundles.
BYOB and build-a-box bundles for D2C brands on Shopify. 9 notes.
See all Only Bundles notes
Only Bundles · Decision
BYOB pricing: percent, fixed, and buy X get Y
How four common build-your-own-box pricing models change margin, customer explanation, discount configuration, and checkout testing on Shopify.
Only Bundles · Architecture
Shopify Cart Transform: what it does for bundle apps
A technical explanation of Shopify Cart Transform merge, expand, and update operations, including compatibility limits for bundle apps and storefront teams.
Only Bundles · Decision
Shopify discount stacking: what breaks for bundles
A margin-first guide to Shopify product, order, and shipping discount combinations when a bundle already includes an incentive or coupon at checkout.
Only Bundles · Architecture
The virtual-product antipattern in Shopify bundle apps
Why a clean storefront bundle can hide component variants from Shopify inventory, fulfillment, and reporting systems when orders are processed.
Only Bundles · Release note
Only Bundles July 2026: selling plans and eight templates
A corrected historical release note for the Only Bundles rebrand, eight storefront templates, and selling-plan selection with Shopify limits stated.
Only Bundles · Build note
Build your own box on Shopify: a practical BYOB guide
A decision-first guide to designing a Shopify build-your-own-box flow that stays clear on mobile and traceable through checkout, inventory, and fulfillment.
Only Bundles · Decision
How to choose a Shopify bundle app: a merchant checklist
A hands-on evaluation framework for bundle type, mobile UX, cart representation, discounts, operations, permissions, support, and total cost.
Only Bundles · Comparison
Native Shopify bundles vs bundle apps: when each one wins
A current decision guide for choosing Shopify Bundles, a third-party app, or a custom Bundles API implementation based on composition and operational needs.
Only Bundles · Market observation
The Shopify bundle-app market is past the discount-widget era
Why Shopify bundle apps are judged by guided composition, checkout representation, operations, and measurement beyond discount widgets for merchants.
Cluster · Studio
Studio.
Field notes from the workshop. 4 notes.
See all Studio notes
Studio · Field note
The associate-to-partner memory cliff in Indian firms
A field note on preserving reusable matter knowledge in Indian firms without confusing a shared drive, an AI assistant, and institutional memory.
Studio · Field note
The catalog-to-campaign gap in Indian D2C
A field guide to turning accurate product data into approved, channel-ready creative without inventing campaign coverage or performance benchmarks.
Studio · Field note
Regional-language content is a market, not translation
A field note on adapting Indian video content through first-language review, voice, timing, audio, and market-specific measurement for creators.
Studio · Field note
The sixty-second window in Indian residential real estate
A measurement-first field note on speed-to-lead, consent, handoffs, and testing a fast-response SLA without inventing Indian conversion benchmarks.