The Changelog: Software Development, Open Source

This week I’m joined by Peer Richelsen, co-founder of Cal.com. What if the majority of open source repositories are already compromised and we just don’t know it yet? That’s the theory Peer brings to the table this week. We dig into how AI has flattened the knowledge graph to the point that a 16-year-old can vibe hack a power station just as easily as their mom can vibe code an iOS app, why the reporting culture that has kept open source safe all these years is collapsing under AI generated noise, Cal.com’s move to fork its own codebase and take the sensitive parts private, and the eye opening reality that shipping “$1 of AI tokens for pennies on the dollar” is now a common startup business model. Join the discussion Changelog++ members save 10 minutes on this episode because they made the ads disappear. Join today! Sponsors: Coder.com – Secure environments where devs and agents work in parallel. Open by design. Secure by default. Buildkite – You deserve better CI. Buildkite is engineered for frontier scale and trusted by the teams setting the pace. WorkOS – Auth for CLI with AuthKit from WorkOS — Bring secure browser-based login to your terminal apps using the OAuth Device Flow, with the same polished AuthKit experience plus SSO, MFA, and passkeys. Learn more at WorkOS.com and AuthKit.com Fly.io – The home of Changelog.com — Deploy your apps close to your users — global Anycast load-balancing, zero-configuration private networking, hardware isolation, and instant WireGuard VPN connections. Push-button deployments that scale to thousands of instances. Check out the speedrun to get started in minutes. Featuring: Peer Richelsen – Website, GitHub, LinkedIn, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: Editorial disclosure: Adam states in the episode that he is a small seed investor in Cal.com. Cal.com and Cal.diy Cal.com is going closed source — here’s why Moving to closed-source: the technical changes Cal.diy on GitHub Cal.diy contributing guide Cal.com Open source, agents, and contribution workflows Swamp Club OpenClaw Mitchell Hashimoto: Vibing a Non-Trivial Ghostty Feature GitHub Agentic Workflows GitHub issue-intent, rationale, confidence, and approvals AI-assisted security Mozilla: Hardening Firefox with Anthropic’s Red Team Mozilla: The zero-days are numbered Anthropic and Mozilla’s Firefox security collaboration Next.js security advisories LiteLLM issue: malicious package and credential stealer Something missing or broken? PRs welcome!

Sam Lambert is back after 4 years and he does not hold back! We cover $5 PlanetScale Postgres, the Neki “do-over” of Vitess, agents shipping schema changes through deploy requests, rolling back a 500TB table in seconds, and the very real question of whether to open source any of it. Plus: why he thinks the sleeping, lazy giants should be broken up. Join the discussion Changelog++ members save 9 minutes on this episode because they made the ads disappear. Join today! Sponsors: Buildkite – You deserve better CI. Buildkite is engineered for frontier scale and trusted by the teams setting the pace. WorkOS – Auth for CLI with AuthKit from WorkOS — Bring secure browser-based login to your terminal apps using the OAuth Device Flow, with the same polished AuthKit experience plus SSO, MFA, and passkeys. Learn more at WorkOS.com and AuthKit.com Coder.com – Secure environments where devs and agents work in parallel. Open by design. Secure by default. Fly.io – The home of Changelog.com — Deploy your apps close to your users — global Anycast load-balancing, zero-configuration private networking, hardware isolation, and instant WireGuard VPN connections. Push-button deployments that scale to thousands of instances. Check out the speedrun to get started in minutes. Featuring: Sam Lambert – Website, GitHub, LinkedIn, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: PlanetScale products and features PlanetScale Postgres PlanetScale Metal Neki Vitess Database branching Non-blocking schema changes Deploy requests Schema reverts Database Traffic Control Query Insights PlanetScale MCP server PlanetScale Skills Benchmarking Postgres Databases and infrastructure PostgreSQL MySQL NVM Express (NVMe) Amazon Aurora PostgreSQL Limitless Database Amazon Web Services Google Cloud Companies and tools Cursor Y Combinator Kick Square Cash App GitHub Pierre Salesforce Supabase Multigres Talks and prior episodes Sam Lambert: Agents and Infrastructure — Cursor Compile 2026 Making the last database you’ll ever need — Founders Talk #85 Bringing Vitess to Postgres — Changelog Interviews #651 Something missing or broken? PRs welcome!

Haroon Meer is back! Haroon is the Founder of Thinkst, the ~50-person bootstrapped company behind Canary and Canarytokens — honeypots and tripwires you sprinkle inside your network and forget about until an attacker touches one. We talk about the AWS API key token attackers just can’t resist trying, the real credit card token backed by an actual bank partnership, Breadcrumbs (their brand-new feature that leads intruders straight to your canaries), a live demo where a hardware Canary becomes a Synology NAS in one click, and how a company with zero outbound sales and no price increase in ten years quietly passed $22.5 million in ARR. Join the discussion Changelog++ members get a bonus 4 minutes at the end of this episode and zero ads. Join today! Sponsors: Buildkite – You deserve better CI. Buildkite is engineered for frontier scale and trusted by the teams setting the pace. WorkOS – Auth for CLI with AuthKit from WorkOS — Bring secure browser-based login to your terminal apps using the OAuth Device Flow, with the same polished AuthKit experience plus SSO, MFA, and passkeys. Learn more at WorkOS.com and AuthKit.com Featuring: Haroon Meer – Website, LinkedIn, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: Thinkst Thinkst Canary Thinkst Canary Security Canary Tokens Canary Tokens Docs Canary Tokens on GitHub OpenCanary on GitHub OpenCanary Docs TechCrunch: A decade in, bootstrapped Thinkst Canary reaches $20M in ARR without VC funding Grafana Labs: Canary Tokens, the unsung heroes of security Canary Love Something missing or broken? PRs welcome!

This week I’m talking with Max Stoiber, currently working on ChatGPT’s plugin directory and app platform at OpenAI. We discuss the hundreds of open source projects nobody remembers alongside the big ones like react-boilerplate and styled-components, how Spectrum became part of GitHub and eventually helped shape GitHub Discussions, the founder growth that came from building Stellate, the GraphQL cache that turned into a dual acquisition by Shopify and The Guild, and why ChatGPT apps feel like a new surface for software. Join the discussion Changelog++ members save 9 minutes on this episode because they made the ads disappear. Join today! Sponsors: Coder.com – Secure environments where devs and agents work in parallel. Open by design. Secure by default. WorkOS – Auth for CLI with AuthKit from WorkOS — Bring secure browser-based login to your terminal apps using the OAuth Device Flow, with the same polished AuthKit experience plus SSO, MFA, and passkeys. Learn more at WorkOS.com and AuthKit.com Notion – Custom Agents that automate the busywork so your team can focus on real work. Try them free at notion.com/changelog Fly.io – The home of Changelog.com — Deploy your apps close to your users — global Anycast load-balancing, zero-configuration private networking, hardware isolation, and instant WireGuard VPN connections. Push-button deployments that scale to thousands of instances. Check out the speedrun to get started in minutes. Featuring: Max Stoiber – Website, GitHub, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: Featured Max Stoiber Max Stoiber on GitHub OpenAI ChatGPT Developers can now submit apps to ChatGPT ChatGPT Developer mode OpenAI Apps SDK examples OpenAI Apps SDK UI Model Context Protocol Max’s open source and community path styled-components styled-components on GitHub react-boilerplate Max’s open source projects Spec.fm GitHub acquires Spectrum GitHub Discussions Slack Circle GraphQL and Stellate Stellate Announcing Stellate, the CDN for GraphQL APIs GraphCDN is now Stellate and we’ve raised $30M The Guild acquires Stellate GraphQL GraphQL Hive GraphQL Yoga GraphiQL Firebase Vercel RethinkDB Apollo Client urql DataLoader Shopify and storefronts Shopify Shopify Liquid reference Shopify themes Horizon: 10 new free themes by Shopify Horizon documentation Shopify Agentic Storefronts ChatGPT apps and MCP Building MCP servers for ChatGPT and API integrations Build with the Apps SDK Apps in ChatGPT MCP Apps overview Zillow Expedia Leadership and founder references COIN feedback framework Gatsby GitHub The Guild Shopify Engineering Tools, platforms, and companies mentioned Node.js TypeScript Bun Zed Ghostty Fly.io DX Incident.io Clerk Raycast Something missing or broken? PRs welcome!

This week I’m talking with Matt Carey about Code Mode and how most of us have been thinking about MCP all wrong. Matt works on the Agents SDK and MCP at Cloudflare — we discuss how server-side Code Mode lets one MCP server expose all ~2,500 Cloudflare API endpoints in about 1,000 tokens of context, the dynamic Worker loader that runs model-written code safely in a V8 isolate, Matt’s own workflow with Claude, where memory fits into the future of agents, and his Zaggy git wrapper that keeps agents from force-pushing his repos. Join the discussion Changelog++ members save 9 minutes on this episode because they made the ads disappear. Join today! Sponsors: Coder.com – Secure environments where devs and agents work in parallel. Open by design. Secure by default. Tailscale – Adam loves Tailscale! Easy, secure, identity-based access to anything. Tailscale deploys quickly and enables Zero Trust access to any resource on your network. From CI/CD runners across multi-cloud environments, to SaaS tools and infrastructure, Tailscale connects it all, seamlessly. RWX – CI/CD platform for high velocity teams. When agents help developers write code in minutes, validation becomes your bottleneck. RWX gives agents programmatic control, sub-second cached builds, and semantic outputs they can act on. No commit required. Just iterate until CI passes, then push. Fly.io – The home of Changelog.com — Deploy your apps close to your users — global Anycast load-balancing, zero-configuration private networking, hardware isolation, and instant WireGuard VPN connections. Push-button deployments that scale to thousands of instances. Check out the speedrun to get started in minutes. Featuring: Matt Carey – Website, GitHub, LinkedIn, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: Featured Matt Carey on the Cloudflare blog You’ve Been a Bad Agent Cloudflare Code Mode: give agents an entire API in 1,000 tokens Code Mode: the better way to use MCP Cloudflare MCP Server Cloudflare Agents SDK Cloudflare Agents SDK on GitHub Cloudflare platform Dynamic Workers Cloudflare Workers Durable Objects AI Gateway Vectorize MCP and code-mode references Model Context Protocol Introducing the Model Context Protocol Code execution with MCP CodeAct paper GitHub MCP Server Datadog MCP Server Pydantic Monty Coding agents and tools Claude Code Claude Code voice dictation OpenCode Cursor OpenAI Codex CLI Changesets Handy Agent memory and personal AI Granola Letta Mastra Supermemory Poke Pi coding agent Homelab and infrastructure Swamp Club Proxmox VE Tailscale 1Password K3s Pi-hole DuckDB Apache Parquet ClickHouse Something missing or broken? PRs welcome!