Updates

After watching someone work through a live bug-bounty session, I realized the process felt tedious and did not seem to create much of a compounding asset. It appeared closer to trading time and energy for uncertain rewards, and I suspect parts of the work may become increasingly automated by AI. For now, I’ve decided not to continue in this direction.

Instead, I’m shifting my focus toward iOS apps, using Android as a reference. Existing app stores offer a more natural way to observe demand and reach users, so I’ve started using MobileAction—a tool similar to Semrush for researching app keywords, search volume, and competition. The current goal is to choose a small idea and ship something within the next week.

The Shopify project is currently paused because of shipping costs rather than a technical problem. A single test package from China to the US cost around USD 28. My friend is considering using a 3PL service—renting local storage and shipping products in batches—to reduce the cost per order. I raised the risk of additional storage and operating expenses, so for now I’m waiting for his decision before we continue.

Meanwhile, learning web security and bug bounty has been rewarding. After completing more CTF challenges and revisiting the fundamentals, I’m moving from theoretical warm-up into real-world practice. I have selected a bug-bounty platform, started attempting real authorized targets, submitted my first vulnerability report, and found useful Reddit communities where I can learn from other researchers’ experiences.

The Shopify store has moved from planning into development, with the basic account, payment, product, shipping, and checkout setup now complete. There has been a lot of back-and-forth communication and configuration work along the way.

Meanwhile, I’ve enjoyed learning more about SQL injection and practising Hacker101 CTF challenges—my practice score has now reached 18/26. Next, I plan to keep learning and gradually move toward authorized penetration testing and real-world bug hunting.

After a lot of back and forth, my friend and I finalized the agreement for the e-commerce website. The project is now formal and prioritized, with an estimated one more week of work at a friend rate of RMB 100 per hour, plus a share of future profits. Deciding on the price was surprisingly difficult, but I hope the process is also the beginning of long-term trust.

In my spare time, I continued analysing web-attack techniques, mainly XSS (cross-site scripting) and SQL injection. The field feels deep enough to take months—or years—to master, so for now, I’ll simply keep learning.

Agreed to start building the website for my friend and used Semrush to analyse a list of competitor sites. I also attempted several more Hacker101 CTF challenges and became more familiar with Burp Suite, a tool for inspecting and testing web traffic.

Published a follow-up on my search for a second project. I have narrowed the current experiments to web security, developer communities, and small products built around proven demand.

The current goal is to practise validation before building. I tested the website idea with my friend, but the project lacked urgency and a clear traffic path, so I stepped aside. I also explored Etsy with eRank, but the account setup felt too unstable to continue confidently. I’m now switching to a few ideas that I will validate and announce soon.

Published a longer comparison of six possible second projects, including the evidence, risks, and learning value behind each option. The main conclusion is to use the friend’s e-commerce business as the primary project while keeping digital materials as a focused independent experiment.

Added a comment feature, UI/UX improvements, and dark mode to the personal website. The comment feature brought some unexpected backend complexity, including database configuration and deployment work.

I’m also exploring new directions, including building small games across different websites. The game site even attracted a real human user—an unexpectedly encouraging milestone.

Published my first long-form post on this site: 25 Hours, $30, and My First 0–1 Website Experiment. I also refreshed the home page and added this updates feed for smaller notes between essays.