I feel like I say this in every newsletter, but the last few weeks have been a hurricane. This time, the hurricane involved a great deal of event-hosting, exciting new client convos (more soon!), rebuilding internal tools with AI, and dealing with a pretty insane security vulnerability that affected a ton of Shopify stores.
Let's get to it, then.
What we've been up to
New Commerce Outsights, new launch alert.
On September 29, we opened VisionOttica’s e-commerce experience to the world!
Those who’ve been following us for a while will remember that we had launched a read-only version of their Shopify store back in June. We’d been building toward this moment over the last months, and so it felt great to finally flip the switch (it was, in fact, a literal switch in the Shopify theme settings).
There were some interesting technical challenges to solve here, mostly tied to the fact that Shopify’s variant limit doesn’t really play nice with contact lenses, where you can have up to 8-9,000 variations per product. Full case study coming soon!
During the project, our very own Marco Arduini developed and open-sourced shopify-email-syncer, a command-line tool that lets you keep your store's transactional emails in GitHub and sync them via the CLI rather than copy-pasting them into the Shopify admin by hand.
Give it a try and let us know how it goes!
Then, on October 8, we partnered with Klaviyo, Audiense, and Shopify for Commerce Symposium: Merchant and the Machine, an event about what AI can and cannot do for e-commerce brands today.
We gathered ~60 e-commerce executives and operators from iconic brands such as Manebí, Boggi Milano, and EssilorLuxottica to discuss what has worked so far for them and what hasn’t survived contact with reality. We topped off the evening with a DJ set and live cooking show, which is always fun.
You can watch the recordings (alas, in Italian) on YouTube.
Last but DEFINITELY not least, Nebulab is now a Shopify Premier Partner! (Funnily enough, we only noticed when we signed in to the partner dashboard. Apparently, no one at Shopify thought we should know. 🙄)
I could go on and on about what this means for us, but I’ve already done it on LinkedIn, so how about you join me there to celebrate together instead?
The things that matter
Source: Felix Rieseberg
Most of us still use AI to go faster, not further
Felix Rieseberg of Anthropic describes four kinds of ambition with models. The first, speed, is doing the work you already do, only faster, which he treats as the baseline.
Altitude is working on outcomes instead of tasks: rather than updating the numbers in a quarterly business review, you ask the model to redesign the review itself.
Depth is working the way a top expert would, with their raw data and professional tools, and never letting the model grade its own work.
Range is borrowing from other fields, like having the model do the actual work of several different roles instead of role-playing them.
Our take: Lately, we've been handing models more and more ambitious jobs, including a few that sounded frankly insane as we typed them, and we keep being surprised: with enough tools and systems, the model almost always figures out a way to make it work. More often than not, the limit wasn't the model but what we thought to ask of it. It's left us suspecting that, right now, our biggest shortcoming is a lack of imagination.
Source: Nine Operators
Ridge manufactures its own buying moments instead of waiting for Black Friday
Ridge CEO Sean Frank explains how the brand turns a slow summer into an eight-figure-plus sales season.
The anchor is a sweepstakes that started as a $100K MVP and is now in its fifth year, with Tony Hawk and a Lamborghini as the grand prize.
Frank argues for a 45-day promotional window over owning a single day: "You're never gonna make a big impact on Black Friday."
Our take: The useful idea here is that you don't have to wait for the calendar to hand you demand: you can pick a quiet stretch of the year and build your own peak into it. Most brands plan around the same retail calendar as everyone else, then fight for the same inbox on the same handful of days; a window you own avoids that fight entirely.
Source: Roman Zipp
Some Shopify apps were hacked and stole your customers' credit cards
Malicious JavaScript injected into popular Shopify apps sent shoppers on some Shopify stores to a fake checkout and captured their card and personal details.
Roman traced the first case on mechanicalkeyboards.com to Hulk Product Options: the payload isn't in the app's code but arrives in a
custom_jsfield returned by HulkApps' own API.Hulk Product Options, Swym Wishlist Plus and Selleasy were all affected and have been de-listed. How the script got into the configuration is still unknown.
Our take: We've been following this one closely, because some of our clients use the apps involved. As soon as the news broke, we scrambled to notify the affected clients and disabled those apps on their stores. Luckily, none of them were hit directly. Still, for all of Shopify's work locking down the critical parts of the storefront, agencies and merchants cannot and should not stop paying attention.
News from our partners
Delivering the best commerce experiences means working with the best partners. Here's what they've done recently:
Shopify launched Shop MCP, a single connection that lets any AI agent search Shopify Catalog, build carts and check out with Shop Pay.
Klaviyo shipped a new version of Composer, its AI marketing agent, which drafts campaigns, flows and segments from your account data and publishes nothing without your approval.
Layers added contextual ranking rules that adjust search results based on the query, the shopper's context, active filters or sort order.
Loop rounded up its October updates, including a redesigned customer portal with retention features built in and native post-purchase offers for cross-sells, upsells and upgrades.
Aaand that's it for today's issue. As always, thank you so much for sticking with us, and see you very, very soon! 👋