Over the past few weeks, I’ve been focusing on learning by actually building instead of just watching more courses. So far, I’ve completed two portfolio projects: 1. Bookstore Support Automation — n8n + Supabase + Vector Search I built a support workflow that receives customer questions, uses embeddings and semantic search to find the closest approved question in a Supabase/pgvector knowledge base, checks a similarity threshold, retrieves the stored answer, and handles fallback cases safely. Building it taught me a lot about: - n8n workflows - Webhooks and APIs - JSON and data mapping - Embeddings and vector search - Supabase / PostgreSQL / pgvector - Thresholds and fallback logic - Debugging integrations - Logging and testing workflows 2. Event Services Lead Qualification & CRM Automation — GoHighLevel For the second project, I focused more on the business side of automation. I built a system for an event services business that captures incoming leads, collects their event information, applies qualification rules, creates and manages opportunities in the CRM pipeline, adds tags, creates follow-up tasks, sends internal notifications, and updates the opportunity as the lead moves through the process. This project helped me understand much more about: - CRM automation - Lead qualification - Pipeline and opportunity management - Business rules - Follow-up workflows - Tasks, tags, and internal notifications - Designing automation around an actual business process rather than just connecting tools I’m happy with how much I’ve learned from building, debugging, testing, and documenting these systems. But there’s one part I haven’t figured out yet: Getting my first real client. I don’t have clients yet, and I’m trying to understand how to make the jump from “I can build these systems” to actually getting conversations with real businesses and convincing someone to trust me with their problem when I’m still at the beginning. For those of you who started from a similar position:

My previous portfolio was pretty basic, so I wanted to create something that actually reflects the kind of work I’m building today. This time, I focused on creating an immersive 3D experience with interactive scrolling, motion, and a more cinematic visual direction. The portfolio showcases my work across: • AI Automation • AI Agents & Voice AI • Full-Stack Development • Intelligent Business Systems • APIs, Integrations & Workflow Automation The goal was simple: not just to show my work, but to make the portfolio itself an experience. I’d genuinely love to hear your feedback — what works, what could be improved, and how the overall experience feels. Check it out: https://ahmed-portfolio-x.vercel.app/ Thanks everyone for taking the time to check it out.

Real example from a project I'm on right now: the client isn't a developer. No coding background. Just used AI tools (Claude, Lovable-style builders) to go from "manual phone bookings" to a live system with a real Supabase backend, server-side pricing logic, CRM automation, and locked-down security — RLS, rate limiting, per-user access tokens, the works. A few months ago this would've needed a small dev team. Now it's one motivated person + AI, learning the actual concepts (not just copy-pasting) as they go — reading terminal output, debugging deploy errors, understanding why a service_role key can't touch the frontend. Here's my honest question for this community: Is the bottleneck for "non-developers shipping real production systems" actually gone now, or are we just moving the failure point downstream — to the security review, the edge cases, the 2am "why did this break" moment nobody without dev experience knows how to debug? Not trying to be a doomer — genuinely impressed watching this happen in real time. But curious what people who've been building longer think: what's the thing AI tools still can't teach someone in this position, no matter how good the prompts are?

Spent the last couple days moving an entire GHL + n8n booking automation (inquiry → approve/reject → payment → confirmation) from a sandbox testing account into the client's real production sub-account. Sounds simple — swap some IDs, right? In practice this meant rebuilding the pipeline, custom fields, and every native GHL trigger automation from scratch in the new location, then updating 4 separate Config nodes across the n8n workflows with new location ID, 5 stage IDs, and 6 custom field IDs. The bug that ate the most time: one request kept failing with a cryptic "property contact_id should not exist" error. Turned out to be a single stray space in a URL — contact_id ={{...}} instead of contact_id={{...}}. GHL's API interpreted the space as part of the parameter name, so it genuinely didn't recognize contact_id (trailing space) as a valid field at all. One character, completely opaque error message. Bigger lesson from this whole migration: never assume an error means what it says on first read. Had multiple moments where the obvious explanation (permissions, missing data, indexing lag) turned out to be wrong once I actually traced the raw request/response instead of guessing. Ruling things out systematically — checking the literal URL sent, not just the error text — is what actually finds these. Result: All 4 workflows now confirmed working end-to-end in the real production account with real payments flowing through. Next up: scoping a 5th workflow — automated review requests. Guest gets a link 24h before checkout, submits a rating + comment, owner reviews it in GHL and decides what goes live on the site. Figuring out the handoff between GHL and the website's own backend now.

Spent this week hardening the security layer on a production system I've been building with AI assistance — Row-Level Security, rate limiting, credential rotation, a full secrets audit across the codebase. Every fix came from an AI-generated prompt. Every decision about what needed fixing, why, and in what order — that was still 100% human judgment. That's the pattern I keep noticing: AI has closed the execution gap almost completely. Writing the RLS policy, generating the rate-limiter, auditing the code for leaked keys — all fast, all correct when prompted well. But it hasn't closed the judgment gap. Knowing that a shared guest password is a real liability before a client ever asks. Knowing which vulnerability actually matters for this specific system vs. which is theoretical. Knowing when "it works" isn't the same as "it's safe to ship." Question for the group: for those of you building real client work with AI tools — where do you feel that judgment gap most? Security? Architecture decisions? Knowing when to stop optimizing and ship? Curious whether this shows up the same way across different domains (dev, marketing automation, voice agents, etc.) or if it's uniquely sharp in technical/security work.