Rabnoor Singh's profile on Product Hunt

About

I hunt AI products here daily, underdogs and open source mostly. Here for the unglamorous threads, the ones that do not trend unless someone points at them first. Alongside that I am building Agentworks with two cofounders since late 2024. Gen-AI agency, then voice AI, then a procurement tool, before landing on the one thing that actually worked. The lesson that cost the most: our first paying customer had not used the product once. Signed, paid, never logged in. We were measuring the comfortable number instead of the true one. So I built blunlock. It asks the question a waitlist never does, which is what someone would actually pay, before you build the thing. Follow along if you want the finds before they trend.

Links

Blunlock

Wallos, today's hunt

Twitter

Badges

Buddy System

Bright Idea 💡

Tastemaker

Tastemaker 5

View all badges

Forums

•

7d ago

Three requests to my pricing page, three different session ids, and nothing on the page reads them

I sent the same page three requests this morning with no cookies attached, the way a monitor or a link checker would. Three responses, three different session ids, three different CSRF tokens, each one set to live for a day. The same response also says it must not be stored by any cache.

The pages either side of it, same site, same server, same deploy, hand out nothing at all and are served with five minutes of freshness and a day of stale while revalidate. The difference is not the page and not the traffic. It is which middleware group the route was declared in, which in my source is a word at the end of one line.

Then I went looking for what reads those two cookies on that page. Nothing does. The page carries no form and never prints the token into the markup, so neither cookie has a consumer until the visitor goes somewhere else. I watched the session store locally while sending five of those requests and it did not gain a single file. The id is minted, sent, and never asked for again.

Here is the check, and it is about two minutes. Take the pages you point ads or links at. Request each one without cookies. Look at exactly two response headers: whether anything is being set, and what the caching header says. If the first is present, that page is out of every shared cache in front of you no matter what the second one claims, and the clients collecting those identities are your uptime monitor, your link checker, every social preview fetcher and every crawler, none of which will ever send one back.