§ 01 · What we builtA waitlist + founder dashboard the eng team had quarterly-planned.
The prototype: a waitlist landing page with magic-link auth, a founder dashboard showing signup counts and referral graphs, and a weekly email digest. My eng team had it scoped at 12 weeks for two engineers. I built a working version in four nights of after-dinner work.
To be clear about what "working" means: it has real auth, real persistence, real emails, real type safety. It does not have admin tooling, internationalization, the seventeen-region rollout the eng team scoped for, or any of the unit tests they would have demanded. It's a prototype. That's the point.
§ 02 · Problem being solvedI was paying engineers to say no.
The cycle: I'd describe a feature, eng would estimate it at 8x what I thought, I'd argue, we'd compromise on a smaller version, six weeks later it'd ship. By that point I'd usually changed my mind about what we needed.
The thing that broke the cycle was realizing I could just build the thing myself, show it to users, and let the working artifact replace the spec. Eng then estimates against a real reference, not a vibe. Estimates dropped by 60%.
§ 03 · What was the hardest partKnowing when to stop building.
Every prototype I've built has the same failure mode: I get 80% of the way, it starts feeling real, and I'm tempted to push it to 100% and ship it as production. Don't.
I set a hard rule on this one: 32 hours, then I hand the codebase to eng and let them rebuild whatever they want. The point was never the code. The point was the conversation about scope.
§ 04 · What went wrongSupabase RLS was off by default.
§ 05 · What you learnedThe prototype is the spec.
One: v0 plus Claude Code plus Supabase plus Resend is a four-person startup. Twenty years ago this would have been a Series A.
Two: the prototype's job is to make scope arguments concrete. Once eng can click on it, the conversation changes from "how hard is this" to "which 20% do we actually need."
Three: AI-assisted prototyping makes security mistakes faster. The defaults matter more than ever. RLS, CORS, secrets management — slow down on these even when everything else is fast.