惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

爱范儿
爱范儿
Know Your Adversary
Know Your Adversary
Google DeepMind News
Google DeepMind News
A
Arctic Wolf
P
Privacy & Cybersecurity Law Blog
云风的 BLOG
云风的 BLOG
Stack Overflow Blog
Stack Overflow Blog
V
Visual Studio Blog
Project Zero
Project Zero
L
LangChain Blog
N
News and Events Feed by Topic
博客园 - Franky
Last Week in AI
Last Week in AI
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
T
The Blog of Author Tim Ferriss
宝玉的分享
宝玉的分享
Scott Helme
Scott Helme
T
The Exploit Database - CXSecurity.com
P
Proofpoint News Feed
Blog — PlanetScale
Blog — PlanetScale
www.infosecurity-magazine.com
www.infosecurity-magazine.com
W
WeLiveSecurity
月光博客
月光博客
博客园_首页
美团技术团队
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
腾讯CDC
Latest news
Latest news
WordPress大学
WordPress大学
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
Spread Privacy
Spread Privacy
Attack and Defense Labs
Attack and Defense Labs
量子位
L
LINUX DO - 热门话题
C
CERT Recently Published Vulnerability Notes
Webroot Blog
Webroot Blog
L
Lohrmann on Cybersecurity
aimingoo的专栏
aimingoo的专栏
T
Troy Hunt's Blog
Security Latest
Security Latest
小众软件
小众软件
Cloudbric
Cloudbric
Hacker News: Ask HN
Hacker News: Ask HN
S
Secure Thoughts
雷峰网
雷峰网
T
Threat Research - Cisco Blogs
H
Hacker News: Front Page
IT之家
IT之家
Simon Willison's Weblog
Simon Willison's Weblog

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
SaaS Hacking with an AI Director: Build a Sample, Hand It Off to Specialists
J.S_Falcon · 2026-05-15 · via DEV Community

TL;DR

  • A renewal notice arrived for our attendance SaaS: 300 people, ¥200/person/month, ¥720,000 annually.
  • The number was acceptable. The problem was fit, not cost — two requirements (actual travel-cost reconciliation; network-based in-office determination) fell outside the standard SaaS spec.
  • I rebuilt the system in Google Apps Script (GAS) in a few hours, with AI as the coding resource. I call this human role an "AI Director."
  • Beyond cost: agility (same-day requirement-to-system), data ownership (lock-in avoidance), and a new development flow — build a working sample, then hand it off to a SIer for production lift.
  • Bonus thoughts on where programmer knowledge stays valuable (specialist domains, post-AI quality review). A gold-rush analogy.

Chapter 1: Requirements — Why the SaaS Stopped Fitting

A generic SaaS is designed around business processes shared by many companies. That's a sound design philosophy. But for an organization carrying company-specific logic, the company's business doesn't fit what the SaaS provides.

Two requirements fell outside the standard spec in our case:

  • Travel-expense reconciliation against actuals: Specific rules on commuter-pass routes and per-day route determination. The SaaS's default aggregation couldn't handle it.
  • Attendance determination by network: We wanted to decide "remote vs. in-office" by whether the punch came through the corporate network. Location-based determination wasn't precise enough.

Two ways to do this with a generic SaaS: pay for a custom development option, or use a CSV export + post-processing workaround. The former inflates cost. The latter produces a kind of inverse vendor lock-in — your operations get locked into manual workflows that only you understand.

The decision was simple. Hire AI as an external coding resource and rebuild the system in GAS to fit our requirements.

From implementation start to operational verification, it took a few hours. The AI wrote the code. Humans handled requirements and specification adjustment. In this article, I'll call this human role an "AI Director." I use the term in the sense of an individual practitioner directing AI as a coding resource — not the executive "Director of AI" role established in larger organizations. This role overlaps significantly with what's framed as a "Citizen Developer using AI" in adjacent discussions; I emphasize the directing relationship with the AI rather than the citizen vs. professional dichotomy.

Chapter 2: Breaking Through Physical Constraints (Ver.1 to Ver.4)

During development, the location-acquisition approach switched four times. Each switch was a discovered constraint and a design decision to work around it.

Ver.1: HTML5 Geolocation

GPS on smartphones gives reasonable precision. But punches mostly come from PCs, where Geolocation falls back to Wi-Fi triangulation or IP-based estimation. The errors landed in the kilometer range.

Not enough precision for in-office determination. Rejected.

Ver.2: IP-Based Estimation

I mimicked the fallback approach used by many SaaS products. Call an external API to estimate geographic location from client IP, then convert to an address string.

The errors here were also large. Carrier routing causes "home" to surface as "near Tokyo Station" in many cases. Not viable.

Ver.3: Google Maps Reverse Geocoding (Built into GAS)

GAS includes a Maps service. Maps.newGeocoder().reverseGeocode(lat, lng) performs reverse geocoding at no cost. This removed the need for an external API key for lat/lng-to-address conversion.

Precision issues remained, but on cost, this had a clear edge over the SaaS.

Ver.4: Master Matching as Proof of Attendance

The final solution wasn't to improve location precision. It was to change the determination axis itself.

When a punch comes through the corporate network, the global IP is the company router's fixed IP. Match this IP against a master of corporate-site addresses. If it matches, "in-office" is confirmed. Location precision becomes irrelevant to the question.

This reduces to deterministic IP-master lookup, so error doesn't structurally arise. For the purpose of attendance determination alone, IP matching is more accurate to the requirement than Geolocation.

Chapter 3: What the System Does

The final form has:

  • One-tap punch: Browser, one button, clock-in/out recorded.
  • Dynamic location recording: IP master confirms "in-office"; otherwise Reverse Geocoding records the address string.
  • Automated monthly aggregation: Per-person attendance-day counts, computed from corporate-site master matching.
  • Data ownership: Punch data accumulates in our own Google Spreadsheet. No export operation. Even after cancelling the SaaS, the data remains.

The last point matters for vendor lock-in avoidance. With a SaaS, cancellation typically means losing access to historical data, or being constrained to CSV dumps. Internal development places the data structure itself under our control.

Chapter 4: AI's Asymmetric Leverage

Most AI-coding-support articles frame productivity as "the programmer becomes N× faster."

That's a vertical-axis story. Within the same role, throughput rises. Faster typing, faster code review, faster refactoring.

What happened here was a different direction of leverage.

When a person with domain knowledge uses AI, a business system that previously went through "business side → engineer outsourcing → implementation → review" can be built directly, skipping the intermediate steps.

User How AI is used Effect
Programmer Throughput improvement in the same role N× productivity along the vertical axis
Domain expert Skipping intermediate steps, reaching implementation directly "Couldn't implement" becomes "can implement"; non-linear arrival

The second form of leverage is asymmetric in market terms. Programmer productivity gains accelerate competition among programmers. The domain expert's AI use crosses the boundary of professional categories entirely.

Acceleration along the vertical axis, versus crossing the boundary. These are leverages of different types. The AI Director embodies the latter.

Chapter 5: Using the Sample as a Deliverable — The Specialist Handoff Option

Pack all the attendance requirements into a sample system that runs for at least one person. From there, you could spend time building login management, change-request approval flow, database management, and other production-grade elements yourself.

But at this point, handing the work off to a SIer (system integrator) is a viable option.

You have everything the business wants captured, a working sample, and the GAS code. This amounts to having completed requirements definition, part of the basic design, functional design, and detailed design.

If you simply ask the SIer to turn this into a system that all employees can use, the cost should be significantly lower than traditional outsourcing.

Further, if a proper SIer delivers a production-quality system along with specifications and system-design documents as deliverables, the only remaining changes are scale adjustments (employee-count changes) and rare-case incorporation. By feeding the specifications and system design back into AI as the current environment, you may be able to handle those changes yourself.

Build the logic yourself, let specialists raise it to production quality, and own the deliverables.

The current AI isn't a magical do-anything tool — it's an extension of your own thinking. Recognize that your own limit is AI's limit. When a problem doesn't yield in 30 minutes, list it as an open issue. Then have others solve it. Or have them review and suggest a path forward.

The usual system development, with AI in the middle reducing the issue count. This is what I see future system development trending toward.

Chapter 6: Conclusion

Saving ¥720,000 annually isn't the primary outcome here.

The primary outcome is the ability to rewrite the system the moment business requirements shift. Instead of waiting for the SaaS vendor to add features, the system follows on the day you write the requirements. This agility isn't fully captured by cost calculations.

In the AI coding era, the market value of "being able to write code" is in relative decline. What rises is the ability to define what should be built, instruct the AI correctly, and verify the output.

It's less a new profession than the arrival of an era in which people who already hold business knowledge can — by having AI as an implementation layer — restructure their own business domain as a system.

The ability to operate as an AI Director — defining requirements, having AI build, and integrating into operations — fits as one of the basic survival strategies in today's business environment.

Bonus: Where Programmer Knowledge Stays Valuable

This article leans toward the AI Director perspective. Let me also organize patterns where programmer knowledge stays valuable.

Specialization in Areas Where AI Falls Short

Real-time control, embedded systems, security, formal verification, mission-critical domains. Running AI-written code without verification isn't socially acceptable in these areas. Fields requiring depth of specialist knowledge and robustness remain programmer territory.

This isn't a domain an AI Director can cross into. It's a direction in which programmers become purely stronger.

Monetizing Specialist Knowledge

Separately, I had AI draft a contract and asked a lawyer for the final review. With 2-3 comments, it was done for ¥5,000.

This is one illustration of how specialists sit in the AI era. Even when AI does the drafting, specialist review retains its value — legal responsibility, hallucination mitigation, expert judgment.

The same structure applies to programmers. The sample that an AI Director builds needs SIer/programmer review at the stage of lifting it to production quality. The role shifts from "time spent writing code from scratch" to "time spent evaluating code and raising it to production quality."

In an era where production has become easy, you don't have to stay on the production side. You can move to the side that raises quality, or builds the systems. A gold-rush analogy fits: rather than swinging a pickaxe to dig for gold, you can be the one selling pickaxes, or refining the gold.

AI now covers the areas that have historically consumed programmers' time. The opened-up time can be redirected toward deepening knowledge of methodology and algorithms. Let AI handle production. Move to the side that critiques as a specialist. This may be the model pattern for programmers and, by extension, all specialists.