Deep Dive
Two Outages In One Week
Supabase, Chris's backend provider, went down for 5 hours. The problem wasn't just that the service died, but that Amy's authentication broke completely, leaving users staring at a blank white screen with no way to contact support. Users had to dig up his email and Twitter to complain. Chris got dozens of messages across multiple platforms, but everyone was surprisingly patient. The real kicker: his in-app support button was also inaccessible when the app was down. Two days later, right as he thought he'd solved everything, Perplexity Sonar (his AI calorie-calculation provider) went down for 15 minutes. More frustrated users. More emails.
How He Fixed The Outage Problem
Chris implemented a status indicator that shows when Perplexity Sonar or his own backend is down. He added a custom message field he can update remotely to tell users what's happening. But here's where he almost made the same mistake big companies make: he was pulling that custom message from Supabase, the same system that had just gone offline. He caught himself and moved it elsewhere. Now when Supabase dies, Amy shows a local status page and rechecks every 30 seconds so users don't need to restart the app obsessively. For AI providers, he built a manual fallback: if Sonar fails, the app switches to Gemini 2.5 Flash Light with Exa, which costs more but keeps the service alive.
The Security Vulnerability That Could Have Bankrupted Him
Chris was storing user subscription status and rate limits directly in the user table with row-level security that let users modify their own rows. A user could just change their rate limit from say 100 requests to a million and spam Chris's AI endpoints, racking up thousands in API costs. Someone actually found this vulnerability and disclosed it responsibly. Chris wasn't even upset about the premium status hack—he was 15 when he jailbroke phones—but the rate limit exploit was dangerous. The fix was simple: move those fields to read-only at the database level or use a separate admin table. He also added IP-based rate limiting and a kill switch so he can cut off any user instantly. Most importantly, he set a hard budget cap at Open Router at 1000 a month when his actual usage is 300 to 400. If that gets hit, all AI services shut down.
The Numbers (And Why They Matter Less This Week)
Amy hit 1,700 in monthly recurring revenue and 2,200 total revenue in the last 30 days, up 200 from two weeks ago. Week 1 retention climbed from 10% to 12.9%, meaning roughly 13 of every 100 new users come back after seven days. The trend is right, but Chris isn't reading too much into it yet. What mattered more this week was what went wrong and how he responded. He's at 166 paying users, which he admits is lucky. If he had a thousand, this week would have been genuinely catastrophic.
Dark Mode And A Breather
After the brutal week, Chris shipped dark mode to Amy. It was straightforward color work, but redoing all the app's illustrations for dark took time. His fiancée Cecilia redesigned them. It was the fun break he needed before diving back into the infrastructure and security work.