Nobody asks about the tabs you have open, the ideas you're stress-testing, the version you scrapped last Tuesday. They don't see any of it. And honestly? They're not looking.

What people see is outcomes. The watch. The title. The post that blew up. The moment you finally have something to point at. That's when the congratulations come in. That's when suddenly, everyone gets it.

But right now, in the middle — before the proof, before the product, before anything is real enough to show — you're mostly invisible.

And that invisibility is brutal.

Not because people are cruel. But because the grind doesn't translate. Try explaining what you're building to someone who isn't inside it and watch their eyes. They're kind about it. They nod. And then they change the subject. It's not their fault. There's just nothing to hold onto yet.

That's the chicken and egg nobody warns you about. You need belief to keep going. But belief usually comes after results. So in the meantime, you carry it mostly alone.

Even the people closest to you — family, a partner, a sibling — can't always give you the one thing you actually need. Not money, not advice. Just: I see you. I got you. Keep going.

That gap is real. I'm in it right now.

And if you're in it too — figuring out what value you want to bring, what your next chapter looks like, what you're even supposed to be building in this strange new world — I just want to say: I see you.

Not the finished version of you. The current one. Grinding without receipts. That version deserves more acknowledgement than it gets.

So here it is. Grind on.

Are you in the grind right now? What's the hardest part — the doubt, the isolation, or the not-yet-knowing?

I've been building fast. Web apps, data dashboards. Using AI tools to accelerate everything. And somewhere in the middle of all that momentum, I stopped reading the code as carefully as I used to. Not because I stopped caring. Because the output looked fine. It ran. It shipped.

That's exactly the problem.

What's Actually Happening Right Now

This isn't a theoretical risk. The data from Q1 2026 is genuinely alarming.

Researchers at Georgia Tech have been tracking CVEs directly caused by AI-generated code. In January 2026 there were 6. By February, 15. By March, 35. That's not a blip. That's a curve.

Between 40 and 62% of AI-generated code contains security vulnerabilities, depending on the study. In Q1 2026, 91.5% of vibe-coded apps had at least one AI hallucination-related flaw. And the Lovable platform — valued at $6.6 billion with eight million users — spent the past two months dealing with incidents that collectively exposed source code, database credentials, AI chat histories, and personal data of thousands of users.

The supply chain situation is just as bad. In March 2026, the LiteLLM package on PyPI was compromised, potentially exposing 500,000 credentials including API keys for Meta, OpenAI, and Anthropic. In April, a Bitwarden CLI package on npm was hijacked with a payload specifically designed to harvest credentials from AI coding tools including Claude Code, Cursor, Codex CLI, and Aider.

And here's the part that got my attention: stolen data was uploaded to private Hugging Face datasets, meaning malicious traffic blended seamlessly with everyday AI research activity and easily evaded scrutiny.

The tools we trust are becoming the attack surface.

A Quick Audit You Can Run Today

If you've been building with AI tools and haven't checked your projects, here's where to start. This is not exhaustive. It's the minimum.

Step 1 — Scan for secrets accidentally committed to git

brew install gitleaks
gitleaks detect --source=. -v

If you've ever pasted an API key into a file and committed it, even briefly, this will find it.

Step 2 — Audit your Python dependencies

pip install pip-audit --break-system-packages
pip-audit

Step 3 — Audit your Node dependencies

npm audit --audit-level=moderate

Step 4 — Check for dangerous patterns in your own code

grep -rn "exec\|eval\|base64.decode\|os.system" . \
  --include="*.py" --include="*.js" \
  --exclude-dir=node_modules

Step 5 — Verify no .env files are tracked in git

git ls-files | grep -E "\.env|\.key|\.pem|secret|credential"

That's it for a first pass. It takes less than ten minutes and most people have never done it.

Habits That Actually Help

These aren't one-time fixes. They're the baseline I'm now holding myself to.

1. Read the code AI generates before running it. Not every line. But every file that touches auth, credentials, or external APIs. AI hallucinates permissions. It adds network calls you didn't ask for. It misconfigures database access. The output looks clean because it's well-formatted, not because it's safe.

2. Never commit a secret. Ever. Use .env files. Add them to .gitignore before you write a single line. Use a secrets manager like Doppler or AWS Secrets Manager for anything production-facing. GitHub's secret scanning can catch it after the fact, but once a key has been committed and pushed, assume it's compromised.

3. Run npm audit and pip-audit regularly. Attackers are now publishing malicious versions of legitimate packages in coordinated campaigns, affecting well-known projects across both npm and PyPI in the same wave. Weekly is not paranoid. It's appropriate.

4. Pin your dependencies. Loose version ranges like ^1.2.0 mean you can get a different package next week than you tested with. A malicious @bitwarden/cli version was published that impersonated the legitimate CLI, executed a credential-stealing payload, and self-propagated by backdooring every npm package the victim could publish. Pinning doesn't fully prevent this, but it reduces your exposure window.

5. Check what's actually installed before you install it. For Homebrew: brew cat <package> shows you the formula. For PyPI and npm, look at the maintainer account — how old is it? How many other packages? A 3-day-old account with one package that does something useful is a red flag.

6. Rotate credentials on a schedule. GCP service accounts, AWS keys, API tokens. If you can't remember when you last rotated them, rotate them now. This is boring work. It's also the work that matters most.

7. Be careful with third-party Homebrew taps and AI model sources. Attackers are actively abusing AI platforms like Hugging Face for malware delivery, exploiting trust in AI ecosystems to embed malicious functionality that can trigger further actions through AI-driven workflows. The trust we extend to these platforms is the attack vector.

The Honest Caveat

I'm not a security professional. I'm a builder who got serious about this after looking at the 2026 numbers and recognising my own habits in the risk profile.

The vibe coding reckoning isn't coming. It's here. And it's targeting exactly the kind of developer who builds fast, ships often, and trusts the AI output because it works.

Working and safe are not the same thing.

I'm still tightening my own setup. I'm running these audits across my active projects this week. If you've been building with AI tools and haven't done a security pass yet, this is a reasonable place to start.

What's the security check you've been meaning to do but keep putting off? I'm genuinely curious what the gap is for most builders.

My first reaction, honestly? Mild panic. “Workers”, “External Agents API”, “hosted runtime”. I've been using Notion since 2020 and suddenly the release notes felt like they were written for someone else.

Then I realised that this is actually the most important Notion update for non-technical business owners.

What actually changed?

Notion has always been great at storing and organising your information. What it couldn't do was act on that information automatically – at least not without expensive integrations or a developer on call.

That changes now.

1. Your Notion workspace can now run code (using Workers). Not you. Notion. You describe what you want to happen – a client submits a form, an entry gets created, a Slack message gets sent, a follow-up task appears – and Notion executes it, on its own infrastructure, without you needing to maintain anything.

2. You can bring external AI agents into Notion. Claude, Codex, or agents you build yourself. Notion becomes the single place where your team and your AI tools work together, on the same data. You know by who I'm going to bring along ... :)

3. The boundary between “tool” and “team member” just got blurrier. In a good way.

Most small business owners I talk to aren't drowning in a lack of tools. They're drowning in tools that don't talk to each other, and admin work that never ends.

A client inquiry comes in. Someone has to move it to the CRM. Someone has to create the follow-up task. Someone has to send the acknowledgement. Someone has to update the status when it moves.

That someone is usually you (and my past self!)

What Notion just built is the infrastructure to make that loop automatic. Not “automatic if you have a developer”. Actually automatic, for people who run businesses, not code them.

I'm still learning this. I don't have a finished build to show you yet.

But I'm building one – a simple yet powerful business operating system for solopreneurs and small teams.

Notion used to be a place you organised your thinking. It's becoming a place that acts on your thinking.

That's a meaningful shift. And for anyone running a business where time is the real bottleneck, it's worth paying attention to.

If you've been on the fence about building your operations in Notion – this is probably the moment to look again.

I'm curious – what's the one repetitive task in your business you'd automate first if you could?

#NotionAI #Notion #NotionDeveloper

I've decided to make it my north star to join in the climate fight by focusing on the magical process of photosynthesis, back to the beginning of it all, without it, we would all perish. I will join the search to figure out how we can upcycle carbon dioxide and be able to decode photosynthesis so that we can learn from nature to help our world and maybe eventually explore other worlds, with our plants.

As of today I do not have the capability nor the financial resources to do much, but I will make use of any current research, claude, and some basic prototyping to understand more as a citizen scientist so that I can contribute meaningfully in the future.

My first step is documented in my github repo. If you are also in this quest, please contact me. I have much to learn. GitHub: Decoding Photosynthesis

Read “A decade of quantum in the cloud” on the IBM blog.

#DecodingPhotosynthesis

I was about to type “can you rename all these files by replacing the spaces with underscores” into Claude — and I caught myself. That's a terrible use of a frontier model. It's like calling a senior consultant to move boxes. The capability is there, but the cost-to-task ratio makes no sense.

So I did something different. I asked Claude to help me build a tool that I'd never have to ask Claude again.

The Problem With Asking Claude to Rename Files Every time you send a message to Claude, you're spending tokens. For simple, repetitive file operations — renaming, reorganising, cleaning up — that's wasteful. Claude's real value is in reasoning, writing, and building things. Not shuffling filenames.

What I wanted was a local tool I could run from anywhere, that understood plain English, and that didn't phone home to any cloud service every time I needed to clean up a folder.

What I Built The tool is called Ollama File Renamer. Here's how it works:

You type a plain English instruction — “replace all spaces and dashes with underscores” or “add today's date before the extension”

It sends that instruction plus your file list to a local LLM running on Ollama You get a preview table showing exactly what will change. You confirm, and it executes.

No cloud. No API costs. No data leaving your machine. And critically — no Claude involved at runtime.

I used Claude to write the code once. Now Ollama and a local model handle every rename job after that. That's the right division of labour.

The Key Idea: Build Once, Run Locally Forever This is something I'm thinking about more deliberately. Claude — or any frontier model — is genuinely useful for the building phase. Reasoning through architecture, writing clean code, debugging edge cases, drafting documentation. That's where the reasoning capability earns its cost. But for execution of repetitive tasks? Local models on Ollama are fast, private, and free to run as many times as you want. The right move is to use the expensive model to create the tool, then hand off the actual work to something local.

It's a small mindset shift, but it changes how you think about AI in your workflow. You stop treating Claude like a command line and start treating it like an architect.

It's Not Perfect Yet

The tool has a known quirk: if you ask it to add “today's date,” smaller models sometimes return a literal placeholder like _YYYY-MM-DD instead of the actual date. I'm working on a fix that injects the real date into the prompt before it reaches the model — so it gets a concrete instruction, not an ambiguous one.

The code and full setup instructions are on GitHub: Ollama File Renamer

You'll need Ollama installed and any model pulled locally. One line in the config to point it at whichever model you're running. That's it.

What Model Should You Use? I've been running it on gemma4:e2b. It's fast and handles straightforward rename instructions well. For more complex or ambiguous instructions, a larger model like gemma3:27b or qwen2.5:14b will give you more reliable structured output.

I'm curious — how are you currently deciding which tasks go to a frontier model versus a local one? I'm still building out my own mental model for where the line sits.

Tier 1: Claude for thinking This is where the real work happens. When I wanted to build a personal finance system, I didn't ask Claude to build it. I asked Claude to help me think through what I actually needed, the folder structure, the monthly operating skills, a sensible way to keep my balance sheet updated. Claude helped me design the blueprint. That blueprint becomes the instruction set for everything downstream. So this is where I invest time getting it right.

Tier 2: Gemini for research and comparison Once I have a direction, I don't need deep reasoning anymore. I need fast, reliable information. Gemini handles my desk research. Comparing tools. Pulling facts. Understanding what something actually does before I commit to it. Its context window is large, it's cheaper for this kind of work, and frankly it's better suited to it than Claude is. Right tool, right job.

Tier 3: Gemma running locally, for free This is the part I'm most excited about, and the part most people skip entirely. I run Gemma 4 (e2b) locally via Ollama. On its own, a small local model isn't impressive. But I've been building modelfiles from what I've worked out with Claude, distilling the reasoning, the structure, the decisions into a reusable skill that Gemma can execute. No API. No cloud. No ongoing cost. The effort is front-loaded. Once the logic is right, Gemma just runs it. Indefinitely. I'm still building this out, the library is small, the system isn't fully automated yet. But even half-built, it's already changed how I approach the question of where AI effort should actually go.

I'm not saying everyone needs three models. But if you're defaulting to one for everything, you're either overpaying, underusing what's available, or both.

I'm curious: if you're using more than one AI right now, what's your actual decision rule for which task goes where? Do you even have one?

#AIWorkflow #LocalLLM #Ollama #AILiteracy #BuildingInPublic

I spent my days just button mashing this thing and it was addictive as it was simple – you just have to match the numbers that are approaching and press another button to “shoot”. When you make a sum of 10, an “n” appears and when you shoot that it clears the field.

So I entered a prompt into Google's AI Studio just as a way to test the process of building an app on this platform. I had some difficulties. It took less than an hour to get an MVP working, but guess what, it took more than a day to troubleshoot why the leaderboard doesn't work. And I don't think I need to use firestore to handle this. We'll see.

But, if you just want to try it out, I've shared it here – don't get too attached to the leaderboard yet, it is unpredictable. Give me some time to fix it in the next few days.

Try out Ticker Strike!

Have a great weekend.

That's how I'm feeling right now. Rejection sucks, it unleashes a giant cloud of “what went wrong?”, “I thought it was good”, “What did I miss?”, “Am I really that bad?”, “Was I too full of myself?” thoughts that impairs visions on day 1, but it eventually subsides as a the days go by.

It's been three days since I got rejected from AI Singapore for their Apprenticeship Programme. When I attended the briefing about two months back it felt like something achievable – they were looking to build AI talent in Singapore and you didn't need to be of computer science background nor of any particular age to get selected. I really thought that it was a way for me to build my portfolio and credibility in this competitive sector, and have always had a dream of helping Singapore build her AI competency in a global landscape. I was suddenly brought back to my twenties, when after graduating NUS with a degree in Real Estate, I dreamt about helping shape Singapore's urban landscape by joining the URA. I was rejected then.

Although life presented me with many nice surprises and opportunities after, now 20 plus years later, that “dream unfulfilled” still resides in the back of my mind. I thought that now this time I could try again, this time with AI instead of Real Estate. But maybe life keeps pointing me somewhere better.

Today is Wednesday, April 15, 2026, 11:35am. I'll just grieve over my self-doubt for a few more minutes, then start thinking about different options. I'm deathly focused on committing the next chapter of my life to figuring AI (machine learning, large language models) out, because I believe this is truly the next wave in tech, just like how the age of Internet and digital marketing transformed businesses in the 2000s.

My purpose is not to be housed in a datacentre (like I envisioned), but to get out there to help businesses understand this new transformation. This will be my new focus.

Let's continue building.

#Rejection #Apprenticeship #AISingapore #AIAP #CareerPivot

“I want to listen to all the BTS songs out there”.

So I went to Spotify to curate the albums. Then I thought:

“wouldn't it be great if I can download a full list of songs that BTS ever created”.

So I asked Claude to build me an app that could do just that, called “EverySong”. The code is simple, Claude will search the internet for a list of songs based on a particular music artist, and then create a CSV file. The code will create a filterable list where you can search by release date, album name, singer and read a little description about the song. It took me an afternoon. It was nice to switch from machine learning to music. I had fun.

The repo is on GitHub if you'd like to take a look at the tech stack. – https://github.com/berniepng/everysong

The website is here – https://demo.bernie.studio/everysong

What artist would you like to curate?

#bts #claude #petshopboys #music

First I uploaded screenshots of just the credit card transactions from 2025. At this point, it is important to note that you shouldn't upload any sensitive personal information to LLMs, so be sure to delete where necessary.

The first task at hand was to examine all my spends and tell me the hard truths. Turns out a large percentage of my overall spends went to shopping (queue the PSB song ...) and a chunk went to subscriptions. He kept asking me “are you sure you are watching Netflix?” lol.

He started drawing bar charts, pie charts, time series charts. Ok you get the picture. Now I understand where my drifts and creeps are.

I also asked him to set up a folder structure on Obsidian for me, which I found it very useful. I created folders like “Tax”, “Debt”, “Tracking”, etc which will give me a great starting point to document and track all my expenses and revenue.

If you are interested in the prompt I used, I'll share it here. Have you done something similar? Let me know.

"You are a seasoned personal financial planner and life coach. Please advise me on how I should start doing better financial planning for:

1. tax reporting
2. budgeting 
3. gig Scheduling, comparing the hourly rates and making wise decisions and commitments based on goals rather than monetary gains
4. analyse credit card spends to identify areas for optimisation and control
5. establish a savings and investment plan to grow money
6. debt management

Guide me through creating  a plan that form a foundation for the next 10 years.

I'm living in Singapore, so everything should be relevant to the country. 

Get the tax information from
https://www.iras.gov.sg/taxes/individual-income-tax/self-employed-and-partnerships"

#AI #Claude #PersonalFinance