Examples

DBArena runs a TPC-C-derived workload against Supabase Postgres, its beta OrioleDB engine, Amazon RDS and Google Cloud SQL at seven matched sizes, and publishes every result as a file with open tooling. On the results page RDS scores 299 transactions a minute per dollar at Large against Supabase Postgres’s 137 at about the same price; Supabase leads at Small and its beta leads when data exceeds memory. A vendor benchmark is believed in proportion to the losses it prints: printing these lets the wins be cited instead of argued with.

GitHub Security Lab ran its own taskflow agent against popular Android apps and reported 24 real vulnerabilities, two of them named - a location leak in OsmAnd and an account takeover via deeplink in Wikipedia’s app. What makes it copyable is the last section: the taskflows are in a public repository, the post gives the one script to run them against your own repo in a codespace, estimates one to two hours for a medium project, and says what it costs - a Copilot licence and a lot of premium model requests - and that every finding still needs a security researcher to triage. The receipt is the campaign. The limit is also stated: no false-positive rate is published, so the 24 is a count of confirmed bugs, not a precision figure.

The headline is exact - 118,538,803 queries a second, sustained sixteen minutes across 512 shards and 1.22 PiB - and the post spends its first section on what the run did not do: no writes, joins or cross-shard queries, shards primary-only with no replicas, no failover attempted, and an error rate stated to the query (about one in 1.8 million). A developer audience supplies those caveats anyway; printing them yourself is what makes the headline citable instead of a claim to argue with, and it markets a sharded Postgres engine without an adjective.

A vendor benchmark that survives scrutiny because its method is checkable: 100 synthetically generated support tickets in five tonal variants, seven stated usability checks, and cost-per-usable-response reported rather than list price. Publishing the whole spread - the priciest model at roughly 1,446x the cheapest, open-weight medians far below proprietary - is what makes the table citable instead of dismissible, and it markets Neon’s AI Gateway without a single adjective.

The rename (neonctl → neon) is cosmetic; the marketing move is everything around it. Neon assumes the first reader of its interface is a coding agent, gives that reader three focused entry points, and then - the part to steal - writes the exact AGENTS.md snippet it wants developers to paste, down to “run neon checkout <branch> alongside git checkout -b.” Getting named in the file agents read at session start is this cycle’s version of getting into the quickstart, and Neon is the first vendor to just write the entry for you instead of hoping you compose one.

Most outage posts apologize in adjectives. This one prints the uncomfortable specifics: monthly commits went from 1.4B in April to 2.9B in August and the platform failed to scale with them; a client-side retry loop in GitHub’s own Copilot amplified traffic during recovery; and the remediation is stated in checkable quantities - 3M+ CPU cores, 120PB of storage, Azure’s share of platform load moved from 12% in May to roughly 58%. Developers respond because the account is verifiable and self-implicating - naming your own product as part of the cascade is what makes the rest of the post credible. The copyable move: a postmortem is trust content only when it carries the numbers that hurt.

“We moved our docs onto our own platform” is a press release; this post is a ledger. Val Town left Astro and Cloudflare for its own runtime - server- rendered, no build step, edits live in about 100ms - and then names exactly what that costs readers: markdown parsed on the server, CSS concatenated at request time, uncached pages that can take ~500ms. The explicit UX > AX > DX ranking admits the migration optimizes for the builder’s feedback loop, and invites the audience to argue. Copy the shape: if you dogfood in public, publish the column of the ledger that runs against you - it is what makes the other column readable as fact rather than marketing.

The post exists to promote Netlify’s OpenRouter-backed model support in Agent Runners, and it earns the read by doing the thing vendor comparisons almost never do: running the same build prompt three times through 11 models - Claude Opus 5 and Sonnet 5, GPT-5.6, Gemini, Kimi, GLM, DeepSeek - and showing the results including the broken images, the low-contrast pages, and a credit cost that spans 2.4 to 519 for the same task. The uncomfortable conclusion survives publication too: the most expensive model doesn’t reliably win. That honesty is the pitch - the feature being sold is model choice, and the data makes the case for choice better than any adjective could.

The workflow itself is ordinary vendor content: Seer opens PRs for detected issues, Claude routines pick the right engineer and ping them in Slack, action rate rises about 21% and 48-hour response rate about 13%. What earns the read is the third number - PRs closed without merging rose 12.5% - printed alongside the wins and then argued as healthy, because engineers often investigated Seer’s narrow fix and shipped a broader one instead. Seer costs $40 per contributor per month, so this post is doing commercial work; disclosing the metric a skeptic would hunt for is what lets it. Copy the shape: report the delta that hurts, then make the case, in numbers, for why it’s the right trade.

“We run our busiest thing on our own platform” is the oldest proof move in developer marketing, and on its own it’s unfalsifiable. Cloudflare’s version works because the migration hit two of its own published limits - 1,000 subrequests per Worker invocation, 1,024 Workflow steps - and instead of engineering around them internally, the platform teams raised the ceilings for every customer (subrequests now default 10,000, up to 10M on paid plans). The self-reported numbers (9B requests/day, 98.6% cache hit) are the hook; the checkable changelog line is the evidence. Copy the shape: real workload, named friction, shipped public fix.

The headline find is real (three live-format API keys in 27,075 public ChatGPT prompts from the DevGPT dataset), but the tactic is everything around it: the post prints the 1.12% alert rate, admits 48% of alerts came from a single noisy UUID rule, discloses a CredData F1 of 0.449 that beats no one’s marketing copy, and names the limitations it can’t measure. Developers read vendor benchmarks looking for what’s hidden; publishing the noise first removes the thing they’d have dunked on and turns the comment thread into a methods discussion. The whole play is reproducible - the dataset is public - which is what separates it from a claim.

Most VPN marketing waves its hands at “military-grade encryption.” Tailscale does the opposite: one long post walks the whole system bottom to top - the WireGuard tunnels, the NAT-traversal dance, the DERP relays for networks that block UDP. It is the signature-content play. A developer who reads it comes away able to reason about the failure modes, which is exactly the person who then trusts the product enough to run it. Explaining the mechanism is the differentiation, because the competitors won’t.

When @clerk/nextjs stopped making temporary keys silently, a missing key became an error telling the developer “and your agent” to run npx clerk@latest init - written, Clerk says, “for both humans and agents: plain instruction, no jargon, and the exact commands to run”. The first version listed init beside link, env pull and the dashboard option with nothing marking it as the no-signup path, and coding agents “read the error as ‘an account is needed’”, so Clerk added one line saying the command needs no account and writes temporary dev keys (merged 2026-10-07). The tactic to copy is saying what is not required, because an agent acts on an error without asking. Clerk’s growth engineer estimated CLI users “probably” doubled or tripled afterwards, on a video hosted by a vendor that sells agent testing; treat that as one estimate, not a result.

After telling every customer to rotate every environment variable on 21 October 2026, Railway published fifteen short pages, one per action: each database’s credentials, AWS, GCP and GitHub access, and usage checks for Stripe, OpenAI, Anthropic, Grok and OpenRouter. The Anthropic page walks through revoking the key in the Claude Console, replacing it on Railway, redeploying, and reading usage and cost by key for traffic that does not look like yours. A developer facing a leaked-key incident needs a checklist, not a statement, and a page per provider is one they can work through and hand to a teammate. What to do better: say in the same message that deploys are paused, because a rotated key reaches a running app only on redeploy.

The file names two products, Page Fetch and Web Search, points the agent at a quote endpoint “for per-unit pricing, funding minimums and commercial terms” and tells it to “Check usage cost AND minimum cash required against the budget”, lists the payment methods (x402, mpp, card, a Stripe Link token) and says an agent may act “on their own behalf with no human in the loop” with anonymous credentials. The move to steal is the address: the storefront sits at the URL an agent already looks for, not behind a dashboard. Read it as the vendor’s own description of itself; the $1 per 1,000 requests Frontier rate appears only on the human homepage, the agent page quotes per task, and Keenable has published no count of purchases agents completed, so whether anything buys through it is not yet known.

The docs page is the artifact. It opens with what Spin is, gives three ways in (dashboard, Wrangler, or “your agent directly through our skill”), and puts the prompt itself on the page as a copyable block with two placeholders for the domains and where the widget goes; agents that have not loaded the skill are told to fetch developers.cloudflare.com/turnstile/spin/prompt.md. The move to steal is treating a prompt as a versioned onboarding artifact with a counter: Cloudflare reports 30,000-plus copies and 65,000-plus widgets since July (its own dashboard figures), which is a first-success number no quickstart page ever produced. The honest limit is that the counter measures copies and widget creations, not sites that stayed protected.

The docs page is the artifact: it opens with curl https://neon.com/auth.md, the protocol document an agent reads first, then neon claim create --env-pull, and states the whole offer in numbers - 100 MB of storage, 1 GB of transfer, 72 hours, a 15-minute claim code, and credential rotation the moment a claim begins. The move to steal is publishing the unclaimed tier as a pricing line rather than a security policy, and treating the claim as the agent’s activation event: Neon says it chose anonymous registration over an allowlist to see which agents find the file and how far they get.

Launched July 14, 2026, this is the first mass-market platform to treat the agent as a first-class reader and actor. Every docs page is available as markdown, the whole set ships as one /llms-full.txt, and the quickstart’s opening move is handing domains-v3.json to your LLM “so your agent reads the same docs you do.” The part worth copying is the transactional design: registration is quote-then-execute (exact price plus a short-expiry quoteToken), every attempt carries an idempotency key so a retry can’t buy twice, a consent object records which agreements were accepted - and there is no card-number field anywhere in the API. The guardrails are the pitch: they’re what makes delegating a purchase to an agent feel safe.

Stripe’s reference popularised the three-column layout - a stable nav on the left, prose in the middle, runnable code on the right - but the tactic worth stealing is smaller and harder to copy: when you’re logged in, the code samples carry your test API key. There is no gap between reading and running. The skeptic pastes one block and sees a real charge object come back, on their own account, before they’ve decided to trust you. The docs aren’t describing the product; they are the first successful call.

The page sells three plans ($5 of trial credit, Pro at $50 with 15% off usage, Team at $200 with 20% off) and then does the thing the other October 2026 plans did not: it names the scope of the discount in one sentence, “inference on DigitalOcean-hosted open models, including Kimi K3 and GLM 5.3”, and the exclusion in the next, “Frontier models like Claude and GPT are available pay-as-you-go at standard rates and aren’t part of the discount”. A buyer can work out the bill for a month of Claude before signing up, which is exactly what Cursor’s and Vercel’s pages of the same month leave to a forum thread. The move to steal is the pair of sentences, not the percentage: whatever the discount covers, say what it covers and what happens at the first token of a model it does not.

The page groups features under Review, Triage, Explain, Secure and Enterprise Controls, and under Review the line reads “Slop Detection - Flag low-quality AI-generated PRs”, present from Essentials at $24 a user a month (annual) through Enterprise. The capability predates the page; the changelog extended it to private repositories on 2026-08-21. What is worth copying is the vocabulary decision: the problem the buyer already names in their own standups is the name on the price list, so the table reads as an answer rather than a rebranding. The honest limit is that the word is slang with a shelf life, and a vendor that adopts it will have to retire it when the audience does.

The post states the rule in one sentence - “you only pay when a changeset it generates is merged into your codebase” - and names the industry default it rejects: charging per token, with a fee on top, whether or not anything lands. “A diff is not an outcome; a merged changeset is” is the positioning line, and it turns a pricing decision into an argument about what the agent is for. The honest limit is on the pricing page, not the post: Enterprise starts at $16K a year and “includes credits for AI features”, so the per-merge rate is not public yet, and the model is a sales motion until it is.

Under the price tables the page says “you and your agent can query our pricing data using SQL” and gives a public, read-only Postgres URI with the libpq parameters beside it. A machine reader gets the number as data with a schema, not as prose to parse, and a buyer can answer “what does this cost at volume” with a query rather than a spreadsheet. Two honest limits: the database covers the Postgres and Vitess SKUs only - the new Neki rates sit in the tables above it - and it is a demo of the product as much as a pricing surface, which is exactly why a database company could ship it in a week.

The number is on the page. Supabase separates fixed from usage-based cost, links the meter to a dashboard, and ships a spend cap that’s on by default - the runaway-bill fear that kills usage-based signups is pre-empted before the developer asks. Opacity reads as something to hide; a real price with a cap is itself a trust signal. This is the verifiable-claims play applied to the one page where dev tools most often hide behind “Contact sales.”

The recap (2026-10-15) lists Python on Vercel GA, Daemons, Drives, the eve agent framework, Connect with MCP Events, AI Gateway controls, Token Pass, Bring Your Own Cloud on AWS, enterprise-managed authorization and AI SDK 7, and ends with “We’ll see you in May for Ship 2027”. Three things to copy. One canonical recap page that ties every release together, with the home page carrying the same framing, so the week reads as one event rather than ten posts. A framing that survives the list, here “agentic infrastructure”, so a reader who skims three items can still say what the week was about. And a date for the next one, which turns a launch into a cadence a developer can plan around. The honest limit is in the list itself: a dozen launches share one spike, so a release that needed its own week, Token Pass arguably, is read as a bullet.

The launch post turns “our sandbox is secure” - an unquotable adjective - into a checkable market event: up to $1,000,000 in payouts, August 18 to September 1, $50,000 for a cross-tenant read, scoped to the Firecracker microVM and network boundary that agents depend on, and a promise to publish the techniques and fixes afterwards. The follow-up (2026-10-14) kept it: 1,285 reports, 57 valid, $242,000 paid, a Linux kernel zero-day and a cross-tenant leak found by a Vercel intern, printed beside the outside researchers’ bugs. The copyable move is both halves: give security work a date and a number, then publish what the money bought, the embarrassing findings included.

Julian Storer - creator of JUCE and the Tracktion DAW - shipped an open-source GUI coding agent built solo over six months and took 276 points and 100+ comments on Hacker News with zero launch budget, in the most saturated devtool category of the year. Every element is the earned-channel playbook: credibility accumulated in public over decades, a repo you can clone and run immediately, no waitlist, no signup, no telemetry, and an AGPL core with an Apache-licensed extension SDK so commercial builders aren’t scared off. The title even leads with the reputation (“by the creator of JUCE”) - the trust shortcut is the headline. If you don’t have a famous founder, the runnable-artifact half of the play still works on its own.

Instead of scattering releases across the calendar, Cloudflare batches them into recurring themed weeks - Developer Week, Birthday Week, Security Week - each a daily drop of real product, mostly free tier. The rhythm does the marketing: developers learn the dates, the press pre-books coverage, and every day compounds the last. It’s the runnable-launch play at an operating cadence - the 2024 inference launch during one such week drove a reported ~15% spike in new developer signups. The format is the moat; a single big-bang launch can’t create the same standing anticipation.

The docs say it in one line: “No authentication required. The server is open: no API key, OAuth flow, or Squarespace account is needed to connect or call tools.” Two tools today, domains_generate_names and domains_search, both read-only, with available results carrying a checkout link to squarespace.com where the standard purchase flow runs. The shape to steal is the split: the lookup step is open so an agent can shop you without holding a credential, and the write stays behind the account. Squarespace publishes no launch date and no rate limits, so treat the tool list as current at the time you check it, not as a promise.

The diagram developers half-remember for an OAuth or OIDC flow is usually scattered across a spec, a blog post and a slide deck. Auth0 put eight of them - Authorization Code with PKCE, the OIDC variants, SAML 2.0 SP-initiated, DPoP request and usage, Discovery - on one site with no product in the frame, and announced it on 2026-09-30. The move to steal is the distribution choice: a reference published on its own domain is linkable from a Stack Overflow answer or an agent’s citation without routing the reader through your information architecture, and it stays useful to people who never buy from you. The honest limit is that the site carries no dates, so check a flow against the spec before citing it as current.

Three copyable moves in one artifact. The zero-friction shape - no account, no metered tier, connect the MCP endpoint and go - treats agent-facing discovery as a rail worth owning rather than a product to sell. The context arithmetic is the pitch: Postman claims a brief answers in roughly 27x less context than the official spec it summarises, which is a benchmark a skeptical developer can check. And the brief’s “Not supported:” lines are the sharpest detail - telling the machine reader what an endpoint cannot do prevents the failed integration that would otherwise be blamed on the API.

The changelog entry (2026-10-09) gives the agent the whole shopping path, domains search, domains check and domains price, and then states the last step’s behaviour in one sentence: run non-interactively, domains buy “returns a structured, machine-readable error and the suggested next commands, so the agent hands the confirmation back to you, prohibiting it from spending money without your approval”. The move to steal is that the refusal is designed, not accidental: the error is machine-readable and tells the agent what to do next, so the flow fails forward into a human confirmation of price, renewal and registrant instead of dying. The honest limit is that it only fits a purchase the person will own for years; for a small, reversible buy, the same vendor would be making the agent wait for nothing.

The changelog entry states the formula in one line, build plus post-build time rounded up to the next whole minute and multiplied by the machine’s vCPUs, and shows the vc inspect output with the four numbers a team needs to see which build drove the bill. The move to steal is the unit: a meter that is only legible as an aggregate invoice is a meter the buyer discovers too late, and a per-deployment figure turns “why was September expensive” into a sortable list. The honest limit is that it explains the bill without capping it; the spend limit is a separate setting.

The hero is one sentence and one verb, and the verb is “trust”. The first button goes to Docker Sandboxes, not to Desktop or Hub, so a thirteen-year-old brand is now fronted by a product launched at a keynote on 2026-09-24. The move to steal is positioning on reach: the claim is about what an agent is allowed to touch, argued as “Kits make authority reproducible”, and it is backed by a spec promised to the CNCF rather than by a feature list. The honest limit is that the promise is a keynote line until a filing appears, and the homepage will read differently the day Docker changes its mind, so check the hero before citing it.