#104

Cursor's git.exe 0day ran unpatched 197 versions, and a $15k ARR app charged from day one

An indie app charged from day one and hit $15k ARR in 4 months. Cursor runs a git.exe planted in any repo root, and it stayed unpatched for 197 versions.

Listen to this edition

An indie dev shipped Tote with a paywall on day one and cleared $15k ARR in about 4 months. Every free app they built before it got abandoned. Their verdict: free was the trap, not the gift.

RevenueCat just gave that hunch a spine. Across more than 115,000 apps, hard paywalls convert about 5x better than freemium by day 35. Then the edge fades, and one-year retention lands nearly identical.

In today’s indie hacker news:

  • 💰 Paid from day one, $15k ARR in 4 months
  • 🔓 Cursor runs a git.exe planted in any repo
  • 🧠 Heavy AI users showed the weakest brain connectivity
  • 🏗️ Your codebase outgrows your grasp of it
  • 🏛️ Your no-revenue project is already a business

TOP STORIES

💰 FREE IS THE MOST EXPENSIVE TIER

An indie dev's paid-from-day-one app clears $15k ARR

The story: A builder makes the case that no indie app should stay free forever. They point to their own app Tote as proof. In a viral r/SideProject post, they explain the gate. It gave 5 free saves, then a 3-day trial before the subscription starts. The playbook is an ad-funded loop. Sell a yearly plan, buy each user for less than that plan costs, then recycle the revenue into more ads. A top commenter pushed back: the real lever is a paid acquisition loop, not paywalling everything. A hard gate can hide whether people even understand the product.

The details:

  • 8 to 9x the revenue per install: hard-paywall apps earned $2.32 each against $0.27 for freemium (per RevenueCat).
  • A brutal market: only 4.6% of newly launched apps clear $10,000 in monthly revenue within two years.
  • The trial decides fast: 55% of all 3-day trial cancellations happen on day 0.
  • The honest counter: one freemium builder reported 1,000 free users, 200 paying, and called the thesis wrong.

Why builders care: Charging on day one buys two things. First, a faster and honest signal on which ideas to kill. Second, cash to fund ads without raising money. It does not automatically buy more lifetime revenue, since retention evens out after a year. Free users still file the bugs and leave the reviews. As Henry Godnick puts it, “Free users are the most expensive users you’ll ever have.”

🔓 OPEN A REPO, RUN A STRANGER’S CODE

Cursor runs a git.exe planted in a repository root

The story: Security firm Mindgard disclosed a zero-day in Cursor on Windows. Drop a file named git.exe in a project’s root, and Cursor runs it the moment you open the folder. It happens silently, with no dialog to approve. They proved it by renaming Windows Calculator to git.exe and watching it launch. Cursor searches the workspace itself for git binaries, so the planted file runs during that lookup. As Mindgard put it, “There are no clicks, prompts, approval dialogs, or warnings. The result is arbitrary code execution.”

The details:

  • Reported in December, ignored for months: Mindgard filed it on December 15, 2025. Then 197 versions shipped with the bug intact (per its writeup).
  • A HackerOne trail: 70 more versions shipped after the report was confirmed on January 20, 2026. Status requests went unanswered.
  • The blast radius: Mindgard cites a reported $60 billion valuation and more than 7 million users to question the priorities.
  • The fix for now: open untrusted repos in a disposable VM or Windows Sandbox, and block workspace binaries with AppLocker.

Why builders care: A trivially exploitable hole sat open for months at a company worth billions. Treat a big valuation as no proof of security maturity. If you run agents with terminal access, sandbox anything you did not write yourself.

🧠 THE MOAT YOU’RE OUTSOURCING

Heavy AI users showed the weakest brain connectivity in an EEG study

The story: AI researcher Yennie Jun wrote about cognitive offloading. She opens with a San Francisco founder who records every conversation and says AI does all his thinking. Her worry is the line between an assistant that helps and handing over the decisions that matter. She closes on a sharper question: are we automating human work, or human agency?

The details:

  • The EEG signal: across 54 people, heavy LLM users showed the weakest brain connectivity, brain-only writers the strongest.
  • A survey backs it: in 666 UK participants, AI use scored against critical thinking at r = -0.68. Offloading mediated the link.
  • The public senses it: in Pew’s poll, 53% expect AI to worsen creative thinking, against 16% who expect a lift.

Why builders care: Your judgment is the one moat agents cannot copy yet. The move Jun models is to form your own hypotheses first, then use AI to test and stretch them. Offload the drudgery, keep the thinking that is the actual product. Speaking of what agents quietly erase, the next story puts a name on it.

🏗️ THE TOWER KEEPS RISING

Agents let a codebase grow after the shared understanding of it collapses

The story: Armin Ronacher reframes the tower of Babel. The old story stops construction when the shared language breaks. With agents, the build keeps going after the team’s shared understanding has already collapsed. Nothing fails right away, so the loss goes unnoticed. Simon Willison quoted the essay the next day, and it hit the Hacker News front page. As Ronacher writes, “The tower does not fall, and so we do not notice what was lost.”

The details:

  • Most code is not hand-written now: Ronacher polled about 5,000 developers. 44% write under 10% of their code by hand.
  • Some ship almost none: Claude Code creator Boris Cherny says Claude wrote all his code. He shipped 22 pull requests in one day.
  • Review is the new bottleneck: high-AI teams merged 98% more pull requests. Review times rose up to 91% (DORA and Faros data).

Why builders care: The thing you trade away is not code quality, which keeps improving. It is your grasp of your own system. Treat understanding as a real output. Budget time to reread what the agent shipped, write specs, and keep fresh-context review as deliberate friction.

🏛️ YOU’RE ALREADY A BUSINESS

A no-revenue community project is a sole proprietorship by default

The story: A builder on r/startups worried their community project needed a nonprofit board or a registered company. One commenter set them straight. By default it is already a sole proprietorship you can run under your own SSN. There is nothing to file with the federal government to start.

The details:

  • Sole prop is the default: no filing makes you one. You can run the finances under your own SSN.
  • An LLC stays cheap: state formation runs $40 to $500, depending on where you file.
  • Federal reporting went away: since March 26, 2025, US-created entities and their owners no longer file beneficial ownership reports.

Why builders care: The fear of incorporation is mostly imaginary. Formalizing a small venture now costs a state fee, not a stack of federal forms. Start first, then register only when a partner or a bank asks you to.

  • 🤖 Bonsai 27B - a 27B-class model that runs on a phone. It topped Hacker News at 486 points, and on-device means no per-user token bill.
  • 📉 How to stop Claude from saying “load-bearing” - a dev’s crusade against AI-tell filler words. It drew 516 comments on 458 points, and prompt hygiene is now real craft.
  • 🚪 Vancouver PD’s Quick Escape button - a panic button that wipes itself from browser history. It hit 172 points, and it is a safety pattern worth stealing.

STACK OF THE DAY

📦 Dependabot package cooldown

Dependabot now waits a set cooldown before opening PRs for brand-new package versions, by default. That delay is a cheap guard against a freshly published malicious release landing in your dependencies before anyone flags it.

Not sponsored. We just feature tools builders would actually use.

BOOKMARKED TODAY

Keep shipping. See you tomorrow.

Forward this to a builder who’d dig it.

Curated by AI, built by a human.