This is part 2 of my free cybersecurity series. The first was how the internet works under the hood. This one goes straight for the front door of your whole digital life: authentication.
It kicks off with the MGM hack - a casino empire shut down for days, ~$100M gone, and it didn't take some genius exploit. It took one phone call to the help desk. That's the whole shift right there: attackers don't break in anymore. They just log in.
From there I take you through everything, from zero, no experience needed:
- how passwords are really stored and cracked
- why the password rules you were taught are actually wrong now
- MFA, and why some of it is way weaker than you think
- where your fingerprint actually goes
- passkeys - the thing finally killing the password
- how "Sign in with Google", sessions, cookies and SSO work
- and how today's attackers (deepfakes included) walk right past all of it
My take hasn't changed: in the AI era anyone can get a model to write code. The part that stays valuable is actually understanding how this stuff breaks and how it's defended. That's what I'm trying to give you here.
https://nikandr.com/cybersecurity
NIKANDR'S APPS | YOUTUBE
Please open Telegram to view this post
VIEW IN TELEGRAM
YouTube
Authentication Explained: How Login Actually Works (Full Course 2026)
In September 2023, the MGM casino empire was brought to its knees โ slot machines dark, hotel keys dead, ~$100M gone. The attackers didn't break any encryption. They made one phone call to the help desk and asked for a login reset. They didn't break in. Theyโฆ
14โคโ๐ฅ4๐ฅ1๐ณ1
And I just published a full review showing everything it can do now.
https://youtu.be/IKCrSrZIKjE
What's inside the code ๐
๐ฎ A real, playable in-app game
๐ฐ Telegram Stars payments
๐ TON crypto payments + transaction history
๐ฅ Referral system + leaderboard
๐ Daily rewards & levels
๐ Wallet collection (airdrops / Web3)
โญ๏ธ NEW: Tasks & quests system
โญ๏ธ NEW: Admin panel โ manage everything without touching code
It's a complete, production-ready system for launching a Telegram mini app for your game, crypto project, community, meme coin, or NFT project โ and it saves you weeks of development.
NIKANDR'S APPS | YOUTUBE
Please open Telegram to view this post
VIEW IN TELEGRAM
21โคโ๐ฅ3๐ฅ2๐ณ1
I just open-sourced a COMPLETE AI SaaS:
- Auth: email, Google, GitHub, magic links (Better Auth)
- Stripe subscriptions + customer portal, live-tested
- A real credits system: append-only ledger that survives double-spends, webhook replays, race conditions - proven by tests, not promises
- AI image generation (gpt-image-2 - swap any model with one env string)
- 105+ tests, CI, Lighthouse 100s
- Neo-brutalist design that looks like an actual product, not another dark-purple AI template
MIT license. Nothing crippled, nothing paywalled. Clone it and build YOUR product on top.
Try the live demo - sign up, generate images, subscribe with test card 4242 4242 4242 4242, watch the credits ledger do its thing:
โ https://ai-saas-starter-six.vercel.app
Get the code:
โ github.com/nikandr-surkov/ai-saas-starter
If it saves you weeks of work - and it will - star the repo. That's the whole price.
NIKANDR'S APPS | YOUTUBE
Please open Telegram to view this post
VIEW IN TELEGRAM
24โคโ๐ฅ3๐ฅ1๐ณ1
I just published a full walkthrough of my open-source AI SaaS boilerplate - the complete, working product, live on screen. If you're planning to build a SaaS this year, watch this first.
Watch it here:
โ https://www.youtube.com/watch?v=2c0UhiK8ZTo
What you'll see in 5 minutes:
- The live product: Next.js 16 SaaS with auth, Stripe subscriptions, credits system, and AI image generation
- The money layer most templates fake: an append-only credits ledger - every transaction recorded, double-spends impossible, proven by tests against real Postgres
- The moment a generation FAILS - the system refunds the credit automatically. No support ticket, no manual fix. That's what a real billing system does
- Real Stripe checkout and one-time top-ups, wired end to end
- The AI-native part nobody else ships: AGENTS. md, Claude Code skills, hooks, a code-reviewer agent that caught 4 real money bugs during the build. Open the repo with Claude Code or Cursor - it briefs your AI by itself
- Neo-brutalist design with custom illustrations - looks like a product, not a template
- 105+ tests, CI, Lighthouse 100s, full production deploy guide
Everything is MIT licensed - the full code, no strings. Clone it, add your Stripe and AI keys, and you have a product that takes real payments - in hours, not months.
Try the live demo (test card 4242 4242 4242 4242):
โ https://ai-saas-starter-six.vercel.app
Get the code:
โ https://github.com/nikandr-surkov/ai-saas-starter
Watch the video, clone the repo, and star it if it saves you weeks - because it will.
NIKANDR'S APPS | YOUTUBE
Please open Telegram to view this post
VIEW IN TELEGRAM
YouTube
The Best FREE SaaS Boilerplate in 2026 - Full Overview
The best FREE SaaS boilerplate in 2026 - a complete, open-source AI SaaS starter kit built with Next.js 16, Better Auth, Stripe subscriptions, a credits system, and AI image generation. Clone it, add your keys, and launch a product that takes real paymentsโฆ
27โคโ๐ฅ1๐ฅ1๐ณ1
Your favorite Telegram Mini App clicker game template just got a serious security & maintainability upgrade. If you're building a tap-to-earn game (Hamster Kombat / Notcoin style) on TON, this is a big one. ๐
โ Closed a point-inflation exploit in the tap-sync endpoint โ the server now strictly caps what a client can claim
โ Telegram Stars payments are now fail-closed โ forged payment webhooks can no longer hand out free points
โ On-chain (SBT) tasks: a database-level unique index kills the double-claim race for good
โ Fixed the daily energy-refill counter across the UTC day boundary
Every future update now ships as a clean, dated changelog in an _updates/ folder โ written so an AI coding agent (Claude Code, Cursor) can merge it into YOUR customized copy without overwriting your work. No more manually diffing releases. Point your agent at the update file, and it applies the changes for you.
Tapping + passive mining, referrals, standard tasks, TON on-chain SBT tasks, Telegram Stars payments, leaderboard, and a built-in admin panel โ production-ready on Next.js 16 + React 19 + Prisma + MongoDB.
Already own it? Pull the update from _updates/2026.07.25. md
New here? Grab the full source and launch your own TON clicker game this week. ๐
NIKANDR'S APPS | YOUTUBE
Please open Telegram to view this post
VIEW IN TELEGRAM
15๐ฅ3๐ณ2โคโ๐ฅ1๐1
The complete Full Clicker Game for Telegram 2.0 source code is 30% off โ but only for the next 30 hours. When the timer's up, the price goes back. No extensions.
If you've been waiting to launch your own tap-to-earn game on TON, this is the moment. ๐
โ Tapping + passive mining, referrals, leagues & leaderboard
โ TON on-chain SBT tasks + native Telegram Stars payments
โ Built-in admin panel to manage tasks & rewards
โ Built on Next.js 16 + React 19 + Prisma + MongoDB โ deploy to Vercel in an afternoon
Skip months of development. Ship your clicker game this week. ๐
NIKANDR'S APPS | YOUTUBE
Please open Telegram to view this post
VIEW IN TELEGRAM
15๐ณ4โคโ๐ฅ2โค1๐1๐ฅฐ1
AI can write a huge part of your code now.
Hosting is cheap. Payments, auth, databases, analytics - most of the infrastructure can be added in hours instead of weeks. According to Supabaseโs 2026 State of Startups report, 61% of startup builders said more than half of their codebase is AI-generated.
But!
Only 11% said technical complexity is their biggest challenge.
Customer acquisition is now #1.
And I think this changes what developers should be learning. A few years ago, being able to build the product was the hard part. Now you can build an MVP with just one prompt.
- How do you get the first 100 users?
- How do you get people to trust you?
- How do you turn attention into customers?
- How do you build distribution that you can reuse for your next product?
In other words:
Code is becoming cheaper. Distribution is becoming HARD AF
This is something I want to experiment with much more myself - not only building apps, but actually learning how to grow, market and monetize them.
Iโll share the numbers and what works here as I test things.
NIKANDR'S APPS | YOUTUBE
Please open Telegram to view this post
VIEW IN TELEGRAM
19๐6๐ฅ2โค1๐1
Media is too big
VIEW IN TELEGRAM
AI is getting surprisingly good at reverse-engineering software and games.
- Claude Code was used to decompile more than half of a Game Boy Advance game back into matching C code.
- Developers are using AI-assisted reverse engineering to do crazy things like putting Minecraft inside GTA V.
- An unofficial AI-assisted version of GTA V was even made playable in a browser before being taken down.
We used to think:
source code -> compiler -> binary
was basically a one-way street.
Now AI is getting better at going:
binary -> AI -> readable code
Give this another few generations and "closed source" might simply mean:
the source isn't public, but AI can reconstruct it anyway.
That's CRAZY SCARY:
Software -> AI reverse-engineers it -> generated code improves AI -> harder software gets reverse-engineered.
So yeah...
ALL SOFTWARE IS BECOMING OPEN SOURCE.
Not by license.
By AI
NIKANDR'S APPS | YOUTUBE
Please open Telegram to view this post
VIEW IN TELEGRAM
12๐5๐คฏ3๐พ2
This media is not supported in your browser
VIEW IN TELEGRAM
In just a few prompts I made this promo for Splitsy, a fictional Telegram Mini App. No After Effects and no manual animation: the whole video is code, including the sound.
And it does its job well. In 20 seconds it explains the core idea of the app without a wall of text, and that's the real reason to have a video like this.
Will it get millions of views on TikTok? Very unlikely
โข pitching collaborations and partners
โข onboarding and instructions
โข ads inside Telegram
โข landing pages and app previews
So it's the right tool, as long as you understand how to use what it gives you.
The prompt to make videos like this one is in the next message
NIKANDR'S APPS | YOUTUBE
Please open Telegram to view this post
VIEW IN TELEGRAM
14โคโ๐ฅ2๐ฅ2๐ณ2โค1
Make a 20-second motion-design promo for my product.
The whole video is code: one HTML file, one canvas, one draw(t) function.
First, ask me for:
โข product name + what it does in one line
โข 8โ12 UI states that tell its story
โข the real data in each state (names, prices, numbers, no placeholders)
โข brand colors, fonts, accent color
โข format: 16:9, 1:1 or 9:16
Rules
โข No CSS transitions, no timers, no state carried between frames
โข One shape, never cut: every state is the same card changing size, radius and color while the content swaps
โข A cursor drives the story with real clicks, typing and one drag
โข Solid background, no gradients
โข Moving from the very first frame; last frame = first frame, so it loops
Motion
โข 120 BPM grid: something happens on every beat
โข Closed-form springs with a tiny overshoot; if a target changes, add one spring per change
โข Content enters after its container starts morphing and leaves before the next morph
โข One accent element travels between states instead of fading in
โข Tab indicators stretch: each edge on its own spring
โข Zoom the camera so every state fills the frame
Sound
โข Synthesize everything in code: a music bed in one key with a build and a drop on the hero moment
โข One sound per on-screen event, tuned to the key, panned to where it happens, following the real motion
โข Duck the music under key moments; master to -14 LUFS
Export
โข First render a contact sheet, one frame per beat, and fix anything cramped or broken
โข Then render at 60fps with motion blur (average 6 subframes), H.264 + yuv420p, with the audio muxed in
NIKANDR'S APPS | YOUTUBE
Please open Telegram to view this post
VIEW IN TELEGRAM
17โค4๐2๐2๐ฅ1
This media is not supported in your browser
VIEW IN TELEGRAM
Jean Phil is a fully AI-generated Frenchman with a blond bob and a mustache who shadowboxes in the streets of Paris. He appeared in mid-September, and within two weeks his videos had more than 75M views on Instagram alone.
- He gained ~240K followers on Instagram and ~260K on TikTok in less than a month.
- His creator launched the $JEANPHIL memecoin, which reached a ~$12M market cap and then lost 70โ90% of its value.
- According to on-chain trackers, the creator started with about $43 and earned more than $100K in pump.fun fees.
So the money here didn't come from views or brand deals. It came from turning attention into a token.
Higgsfield launched an AI Influencer tool and then posted that "every viral AI influencer was made on Higgsfield", crediting JeanPhilMadame.
Some people think this was planned marketing:
seed the characters -> let people argue whether they're real -> show everyone how to make their own
Higgsfield hasn't confirmed that, but either way it worked as a showcase for the tool. The company says it's now at a $1B revenue run rate.
- Archibald Brown, an English "rival" who challenges Jean Phil to a fight, now has ~130K Instagram followers. His $ARCHIBROWN token went above $1M and fell to about $125K two days later.
- Derek Mercer, a long-haired gym character, grew from about 1K to ~60K Instagram followers in two weeks. One of his videos got 29.7M plays.
- X filled up with threads promising that the laziest person can make $10K/month with an AI character.
AI characters work more like a lottery ticket than a business plan. The ticket is cheap now: anyone can make a character in an evening with tools like Higgsfield. But for every Jean Phil there are many characters nobody watches, and even the winners can't repeat their hits on demand. In early October, Derek Mercer's newest post got about 120K plays, compared with 29.7M on his best one.
The people who earn reliably here are the ones selling the tickets: the tool makers and the course sellers. If you want to try, do it because it's fun and cheap to test, and don't build your plans around becoming the next Jean Phil.
NIKANDR'S APPS | YOUTUBE
Please open Telegram to view this post
VIEW IN TELEGRAM
14โค7๐3๐ฅ1๐1