Hey, Pawel here. Welcome to the Product Compass Newsletter. It’s #1 most hands-on AI PM newsletter. I strategize, prototype, experiment, and build with AI every day.
And every week I share actionable tips, templates, and step-by-step guides for PMs.
Here’s what you might have missed:
What Is Product Discovery? The Ultimate Guide for PMs (2026 Edition)
How to Create an AI Product Strategy: The AI Strategic Lens Framework
Plus, 20+ recordings available for our premium members here: https://go.productcompass.pm/events
Consider subscribing and updating your account for the full experience.
Why You Should Care as a PM
This is the third and the last part of Product Engineering for PMs. You don’t have to code, but as a PM you should understand how to build with AI.
A question you could ask me: Paweł, how do you know, if job offers don’t ask for it yet?
Fair point. What you need according to most LinkedIn job offers is still prototyping and a general understanding of AI.
But if you’ve been following this newsletter, we have a solid track record of analyzing trends in AI, before they become obvious to everyone:
We’ve been discussing “orchestration over autonomy” since July 2025. In 2026, people noticed this and started using the term “harness.” We didn’t coin the term, our principles survived.
We’ve been discussing “vibe engineering” since September 2025. In March 2026, Karpathy called it “agentic engineering.” I keep publishing the same infographic with a new term.
We’ve been discussing how pointless code reviews become and what to do instead since June 1, 2026. On July 3, Gergely Orosz (Pragmatic Engineer) claimed on X that “AI reviews the code (…) doesn’t work as reliably.” He started changing his opinion 3 weeks later: “Cannot help but see the concept of code reviews fading away.”
The situation right now:
Coding is solved. It can be fully delegated to agents.
Engineers stop reviewing AI-generated code. Rightly so. Review artifacts.
The adoption dramatically lags behind what’s possible. But it’s inevitable.
What’s left is deciding what to build and managing the agents who are better at coding, reviewing code, and, soon, designing architectures than any human.
Soon, you’ll be competing not only with PMs who learned agentic engineering, but also with engineers who embraced product thinking.
You can see similar conclusions in this post by Andrew Ng, shared in April 2026:
He wrote:
“I’ve seen engineers successfully expand their roles to including making product decisions, and PMs expand their roles to building software. [...] If you are an engineer, you’ll find it useful to learn some product management skills, and if you’re a PM, please learn to build!”
Product Engineering for PMs, Part 3
A quick recap:
In Part 1, we started building AskOne, an alternative to Slido (Q&A and polling platform). We implemented rooms, anonymous questions, Google authentication, Supabase storage, subscription plans, and a test payment gateway.
In Part 2, we discussed a lightweight AI software lifecycle, enabled Google auth in production, introduced organization subscriptions, added a custom domain (https://askone.org), and configured production GitHub and Supabase branches.
In today’s article:
GitHub Branching
Enable Stripe Payments (for real)
🔒 Cloudflare Web Application Firewall
🔒 Netlify Web Application Firewall
Agentic Product Reviews in Depth: Logic, Security, Performance
🔒 Claude Solution Template for Non-Coders
🔒 Live Session Recording
Conclusion
Let’s dive in.
1. GitHub Branching
GitHub is central to how we move changes (source code and database migration scripts) between our environments (e.g., development > testing > production).
Rather than describing it as prose, I created an interactive diagram that allows you to track the process step by step. The exact configuration I presented during the live session.
It’s available as a Claude artifact: https://claude.ai/code/artifact/419dbc93-a3da-4e81-bd2a-52785e7ea151
High level steps:
In sync: All environments contain the same logic and database, v1.
Edit: The agent introduces changes: modifies code and creates a Supabase migration script
Migrate dev: The agent modifies Supabase (dev environment) by executing the migration script
Commit: The agent commits changes to a local repository (on your laptop)
Push: The agent sends changes to GitHub (“origin”), development branch
Promote: The agent moves changes from development to production GitHub branch
Deploy: Netlify and Supabase react to a modified GitHub branch and deploy changes automatically
Live: The process completed. v2 is live.
2. Enable Stripe Payments (for real)
In Part 1, we enabled the “Clerk payment gateway” on dev. It’s fake. You click “Use test card,” and nothing is processed. In development, that’s what you want. With real Stripe, every test transaction costs a fee, even if you refund it.
But when we cloned the development instance to production (Part 2, Section 7), the plans and features were cloned. The payment gateway was not. In production, we need real payments, and that gateway must be Stripe.
Step 2.1: Connect Stripe
Go to Clerk Dashboard > your production instance > Configure > Billing. You can create a new Stripe account or use an existing one.
I’m not presenting creating a Stripe account. It’s straightforward, but Stripe will ask you for your name, address, and tax details. I used an existing account:
One Stripe account can serve one Clerk application. My first pick failed: “already being used by another Clerk application.” Pick a different one, or create a new one.
📌 Stripe processes the payments. Taxes (Stripe Tax) and invoices are additional steps you configure in Stripe, not in Clerk. Clerk takes 0.7% per transaction on top of Stripe’s fees.
Step 2.2: Enable organization billing
Once Stripe is connected, on the same page, enable billing for organizations. Our plans (Free, Premium) and their features are already there. They were cloned in Part 2:
Step 2.3: Test it
The app is already integrated with Clerk (Part 1, Step 5). Every change in Clerk is visible in the app without extra prompts.
Sign in to askone.org, go to Manage organization > Billing, switch to Premium, and click “Subscribe.” I picked monthly, $20. If you don’t see the Billing tab, refresh the page. It didn’t show up for me at first:
This time, you see the real Stripe checkout with real card fields:
I stopped there. Once you pay, Stripe processes the transaction, and your organization gets the Premium features.
📌 Your local development environment still uses the development Clerk instance. When you ask the agent to run the app on localhost, test payments still work.
3. Cloudflare Web Application Firewall
In Part 2, we defined plan features, for example, up to 10 active rooms. But can an organization open and close a room 1,000 times a second? What about a script that guesses join codes all night?
Plan features limit what an organization can do. Rate limits control how often anyone can call our app. Without them, one user can exhaust all our resources.
The tool for that is a web application firewall (WAF). It sits in front of your app and refuses bad traffic before it reaches your code.
Here’s how to configure it step-by-step with Cloudflare:
Step 3.1: See what you get for free
Normally, I use Cloudflare, for example, for afkpilot.com. It hosts your DNS, like Netlify DNS did in Part 2, and the protection comes with it, on a free account:
Monitoring bot traffic
Blocking web app exploits
Stopping denial of service attacks (DDoS)
Detecting API abuse and fraud
Telling AI crawlers whether they can use your content for training
I’m not presenting creating an account. It’s straightforward. You add your domain, and Cloudflare tells you which nameservers to set at your registrar, just like we did with Netlify DNS in Part 2.
Step 3.2: Add an app-specific limit
Those default rules stop common attacks. But nothing there knows what’s normal for our app.
🔒 This is a premium material available to premium members. Upgrade and it will appear right below.
4. Netlify Web Application Firewall
For AskOne, all we need is Netlify. It has its own firewall. On a free plan, it includes:
Protection against denial of service attacks (DDoS), on by default
Firewall traffic rules: geographic restrictions, IP exceptions
Basic rate limiting: two rules per project, defined in code
The full WAF (rules against the OWASP Top 10) needs an enterprise plan. For many apps, the free defaults are enough:
In a free version, you can’t configure rate limits from the UI. But you can activate those limits with your agent, without upgrading your Netlify account:
🔒 This is a premium material available to premium members. Upgrade and it will appear right below.
5. Agentic Product Reviews in Depth: Logic, Security, Performance
The Claude Solution Template shared in Part 1 includes best practices related to documenting the app, planning, and executing various types of tests.
Regardless, questions you can ask your agent:
Prompt 1: Help me understand the quality of our documentation:
- Explain where I can find product strategy, market segments, value proposition, roles and permissions, user flows, business rules, integrations, and so on.
- Verify whether this documentation is up to date by comparing it against the codebase and identify any missing areas.
- Suggest a concise list of the next recommended steps.Next, work with the agent to update the documentation and review it. The agent can inspect the solution and draw conclusions based on the context you shared, but it’s your role as a PM to ensure that’s really what you wanted in your product.
Prompt 2: Based on the documentation we just updated and the codebase, help me understand the quality of our tests (unit, integration, e2e, live, CI, and others):
- Are there any missing areas we should cover?
- Suggest a concise list of the next recommended steps.Next, work with the agent to implement and run the missing tests.
The last element is a single prompt that covers code, security, and performance review:
Prompt 3: Make sure the skills and commands from https://github.com/phuryn/pm-skills/tree/main/pm-ai-shipping are installed for the current project. Next:
- Perform a detailed code, security, and performance review.
- Present a concise report with findings grouped by priority (High, Medium, Low) and category (Security, Performance, Other bug, Question). Save it as an .md file.
- Suggest a concise list of the next recommended steps we should take before the release.Prompt 3 uses skills from my free GitHub repo, phuryn/pm-skills (26K stars).
It was updated today based on my experience with the Bug Hunt Benchmark that’s becoming a standard for measuring how good the models are at finding and fixing bugs. Here, reposted by the Chief AI Officer at Meta:
📌 Agents can automate a lot, but one thing still needs a human eye - UX/UI. I’ve learned that even agents taking screenshots miss dynamic elements and elements visible for a short time.
The bottom line: Don’t spend hours or days testing every possible combination, but click through the common user flows manually. Every time. For an app such as afkpilot, this takes me 15-20 minutes.
6. Claude Solution Template for Non-Coders
🔒 The template is available only to premium members. Upgrade, and it will appear right below.
7. Live Session Recording
The recording of Part 3 will be available here tomorrow, for premium members. I will also update our Claude Solution Template for Non-Coders and share the current source code of AskOne.
Right now, you can watch Part 1 and Part 2: https://go.productcompass.pm/events
8. Conclusion
I wrote this because product management is changing. The adoption dramatically lags behind what’s possible today.
“If you’re a PM, please learn to build.” - Andrew NG
BTW, if you’re looking for a structured cohort, I just joined Product Faculty as a trainer. Currently, we offer 8 AI PM cohorts (with trainers from Anthropic, Google, OpenAI) for the price of one + $1,500 off for my readers: https://productfaculty.com?code=PAWEL
Everyone who enrolls with the above code can attend our Claudathon for PMs for free: https://go.productcompass.pm/claudathon (send me an email with a purchase confirmation: pawel@productcompass.pm) - we start on Sep 19.
Thanks for Reading The Product Compass
It’s amazing to learn and grow together.
Have an amazing rest of the week,
Paweł