How a Micro-SaaS Tech Stack Changed in a Single Year
Contents
PentaTrail rebuilt its entire tech stack over the past year.
There was no firm plan behind it. The question was how to fit years of security experience to a fast-moving AI landscape, and the method was to build, check, and switch every time something turned out not to fit.
Two changes of foundation in one year
It started on no-code, moved to a full codebase, and then moved the development work itself onto AI. The reason for each switch was the same: whether the foundation let us use AI.
Figure 1: Three chapters, and when each ran
Deep dive: a year ago, development meant copy and paste
It is hard to picture now, but a year ago we pasted source into the web versions of ChatGPT and Claude, pasted the results back into VS Code, and managed them with git. Both the instructions and the assembly were manual. The models were not what they are now, either: they would miss the intent and build against a specification they had assumed. The output looked right on its own and then failed to line up with what already existed. That rework was the daily routine.
Chapter 1: no-code assumes a person operating a screen
We built on Power Platform, Dataverse and Azure. It got off the ground quickly, but the more we used it, the clearer it became that it pointed the opposite way from automation and from handing work to an AI.
Figure 2: Four limits that surfaced with use
Deep dive: the decisive one was unreadable column names
Dataverse generates its internal column names. That is fine for a person working on screen, but ask a generative AI to write code and the names are neither known nor predictable. That was the deciding factor.
Azure, too, turned out to be too fine-grained for a micro-SaaS. The granularity of its settings and its operating assumptions are built for a team of engineers developing and running it. Not a question of better or worse — the scale it assumes was simply different.
Chapter 2: a full migration to a foundation that suits AI
In July 2025, a first commit titled "Supabase + Vercel" started the repository over. The reasons were clear, and every one of them came back to whether an AI could work with it.
Figure 3: Every reason came back to AI being able to work with it
Deep dive: for payments, the boring, proven option
Stripe has Checkout, the customer portal and webhooks all covered, with plenty of prior art alongside Supabase. Taking the proven, unsurprising option was the right call.
Even with the foundation settled, though, development was still precarious. We were using Claude and Codex from the CLI, but context broke between sessions. That lack of continuity kept catching us out, and authentication in particular was a recurring place to get stuck.
Chapter 3: skills and memory, and the work itself moves onto AI
In February 2026 we began defining repeated work as skills, and in April we started running memory. Work that had lived in one person's head turned into procedures that could be reproduced.
Figure 4: Skills as procedure, memory as a store of facts
Deep dive: so the same trap isn't walked into twice
Memory holds lessons like "written this way, it breaks here" and "that assumption was wrong." The AI in the next session stops walking into the same trap, and the drain of explaining everything from scratch each time drops sharply. The detailed practice is in The reality of long-running AI development.
Merged PRs went from 3 in February to 274 in May
Put in numbers, the change in output is unambiguous. Between February and April it moved two orders of magnitude.
Figure 5: Merged PRs by month (June is partway through)
Deep dive: the team did not get bigger
The jump did not come from adding people, and not from skills and memory alone. What did it was the AI workflow maturing as a whole: letting the AI touch real environments over MCP, turning specs into plans it could run on its own, verifying with tests, running a two-lineage review, and backing all of it with CI and quality gates. Each of those is its own post.
What mattered was the tooling maturing, more than the model getting smarter
The models did improve. But with the same model, what you can produce changes completely depending on the tools it holds and the way the work runs.
Figure 6: The deciding factor was not a choice of library
Deep dive: the same person, in the same hours
Supabase and Vercel were genuinely good choices, but the deciding factor was not any individual library — it was the whole way of working, and its tooling, maturing together. That is why the same person, in the same hours, can now ship an order of magnitude more.
- The reality of long-running AI development: the context wall, and running memory
- What MCP changed: giving AI hands
- Two-track review with Claude and Codex: surfacing blind spots with a different AI lineage
- How We Keep AI-Written Code Secure
The micro-SaaS that came out of a year of rebuilding while shipping is PentaTrail / CTEM.
Appendix: the three chapters, and why we switched
Table 1: period and foundation
| Chapter | Period | Foundation |
|---|---|---|
| Chapter 1 | April–July 2025 | Microsoft no-code (Power Platform / Dataverse / Azure) |
| Chapter 2 | From July 2025 | A full codebase on Supabase / Vercel / Stripe |
| Chapter 3 | From February 2026 | AI-native development built on skills and memory |
Table 2: the limits found on no-code
| Limit | Detail |
|---|---|
| Assumes a person | Built around a person operating a screen; points away from automation |
| Weak configuration management | Diffing, tracing history and rolling back are all awkward |
| Unreadable column names | Auto-generated internal names a generative AI cannot predict |
| Authentication integration | The harder you keep it inside the framework, the more it costs |
Table 3: merged PRs by month
| Month | Merged PRs |
|---|---|
| February 2026 | 3 |
| March | 10 |
| April | 178 |
| May | 274 |
| June | 250 (partway through the month) |
Visualize your attack surface with PentaTrail CTEM/ASM
From discovery to vulnerability validation and remediation — all powered by the CTEM framework.
Get Started
