BFCM is one month away.
58,277 founders and marketers are getting this newsletter today!
Welcome to the 316 new operators who joined us this week. 🤯
TOOL OF THE WEEK
Your SMS flows reach 30% of carts. Recover gets the other 70%.
Hey Fastlane Insiders! 👋
Around this time every year, I start hearing the same line from merchants: "We're not adding anything else before Black Friday." Honestly, it's the smartest thing anyone's told me all month. This year I'd take it one step further. The best prep you've got left might be taking something away.
October made that pretty clear. Attackers hijacked three trusted Shopify apps and used them to send shoppers to fake checkouts, and none of the affected merchants had touched their own code. While I was writing up this week's audit, one story stuck with me: a brand still paying for a $500 app long after the person who installed it had left the company. Nobody remembered it was there. That's the kind of thing I'd want you to find in the next 29 days, not after.
The other one on my mind is quieter. Shopify moved the knowledge base AI shopping agents read from, and your store policies now publish to those agents automatically. Most merchants I talk to haven't noticed yet. Reading your own returns policy the way an AI agent would is ten minutes well spent this week.
And if you're already wondering who answers the inbox at 11 PM on Thanksgiving, save my conversation with Nico Bivero of Penbrothers for your January planning.
Grab a coffee. Here's what's inside this week's edition:
🤝 This Week's Partner: Levanta, and how to put creator reach to work before BFCM.
🎧 This Week's Podcast: How to know if you're ready to hire offshore, with Penbrothers CEO Nico Bivero.
💡 Knowledge Drops: the 20-minute app audit October made necessary, and what Shopify's knowledge base move means for AI shopping agents.
🔥 Tool of the Week: Redo Recover, which texts the 70% of abandoned carts your SMS flows never reach.
📡 Industry Pulse: Who pays when an AI agent buys wrong, Google's ads on AI Mode follow-up questions, USPS billing you for foreign duties, and Walmart's 14-day Black Friday.
Let's dive in. 👇
BFCM Is One Month Away. Turn Creator Reach Into Revenue.
The BFCM countdown is on, and shoppers are getting ready to spend. But where those shoppers end up buying is something worth paying attention to.
Levanta's research found that 74% of creators send traffic to multiple shopping destinations. For ecommerce brands, that's more opportunities to get products in front of shoppers who are ready to buy.
There's still time to put creator affiliate marketing to work to drive sales before the holiday rush. Levanta helps brands discover influencers, manage partnerships, and track performance across Amazon, Walmart, Shopify, and beyond, all in one place.
Need a little extra motivation? Book a demo today and get a $100 gift card of your choosing, plus 10% off your annual SaaS fees when you sign up for a Gold or Enterprise plan.
🎧 New Podcast Episode! 🎧
The Signal You're Ready to Hire Offshore (It Isn't Revenue)
Most founders look at offshore hiring as a way to save money, and that's usually where it goes wrong: the cheapest candidate, a rushed handoff, and a role that churns before it ever pays off. And if you sell through the holidays, you already know the hardest seat to fill is the 11 PM Saturday one.
This week, I sat down with Nico Bivero, Co-Founder and CEO of Penbrothers, an employer of record that builds remote teams in the Philippines. Nico started it in 2014 with one Makati office of about 50 seats. Today it employs more than 1,200 people and has placed more than 5,000 team members across 262 global businesses.
Here's what we unpacked:
The readiness signal isn't a revenue number. Nico points to one thing in your hiring pipeline that tells you it's time, and it has nothing to do with headcount or how big you are.
Chase cost efficiency, not cost savings. If cheap is the only filter, you hire the wrong people and skip onboarding. Nico names the three criteria he'd rank above salary.
Start with roles that have a scoreboard. Process-driven seats with clear KPIs travel well across time zones. Nico explains which roles to hold back early, and why.
The 180-day Hypercare framework. Penbrothers built six months of support after studying why some offshore hires thrive and others struggle. Half of it is aimed at you, not the new hire.
Where Fiverr and Upwork stop working. One client's freelancer found out she had no social security or health coverage when she became pregnant. That client now has more than 100 people through Penbrothers.
AI fluency is the new tiebreaker. Given five equally qualified virtual assistant candidates, clients often pick the one already using Claude or Gemini. Nico also raises a question about junior staff that nobody has answered yet.
An honest timing note: if you're hoping to staff up for Cyber Week, it's too late to onboard someone well, and Nico would be the first to tell you rushing it is the mistake. Listen now, then make it part of your January plan, especially if night, weekend, or holiday coverage is the seat you can't fill locally.
💡 Knowledge Drops of the Week 💡
Your Riskiest Black Friday App Is One You Already Trust
Shopify's own checkout wasn't breached in October. Attackers got into the settings of three trusted apps instead (Hulk Product Options, Selleasy, and Swym Wishlist Plus) and used them to send shoppers to fake checkout pages. Fudge's running timeline shows how fast it moved, from October 10 to October 18.
The fix isn't another security app. It's fewer apps, with a name next to each one. The script was hard to spot in the admin, and it fired only once per browser session, which is why one test checkout isn't enough.
Here's what's working:
List every app that can touch your storefront. That means installed apps and enabled theme embeds, with a flag on anything that accepts custom code. It takes about five minutes, and the article shows where the second list hides.
Ask who would notice if it disappeared. If nobody would, uninstall it. Turning off an embed isn't the same thing, and the article explains the difference. For the apps you keep, open the settings and look for custom code you didn't write.
Test checkout three times, then again every week. Use a fresh private window, the standard Checkout button, the cart drawer, and mobile. That weekly repeat is the only part of the audit that would have caught October's attack while it was running.
Under $500K, cut hard: keep the apps that take payment, ship orders, collect reviews, or capture email, and re-add anything else in January. Between $500K and $2M, run the full audit, starting with any app that accepts custom code. Past $1M, the harder job is ownership, so keep a short register with an owner next to every app. If you run five apps or fewer, installed every one yourself this year, and already test checkout weekly, you can skip most of this.
Shopify Moved the Knowledge Base AI Agents Read. Check What It Published.
AI shopping agents answer your customers' policy questions from your Shopify knowledge base. This month, Shopify retired the standalone Knowledge Base app and moved it into your admin under Sales channels > Agentic > Knowledge base. The old app stops working after January 15, 2027.
Two details matter more than the move. Store policies and contact info now publish to agents automatically, before anyone reviews them. And the query log that showed what customers were asking AI assistants is gone. Meanwhile, when Bill Hunt tested 122 Shopify stores, only 2 of 88 questions about canceling an order came back with a usable answer.
Here's what's working:
Review what went live by default. Your policies and contact details are already reaching agents. If your returns policy is missing conditions, processing times, or countries, an agent will fill the gap with industry-standard guesses. The guide shows the quick scan test every policy should pass.
Write FAQs from real tickets, not a template. Generic questions don't separate you from the store next door. Start with 10 to 15 pulled from your actual support inbox, and add gaps like order cancellation as additional facts.
Test it yourself, because the log is gone. Ask ChatGPT, Claude, Perplexity, Copilot, and Gemini the same policy questions and check whether they cite you correctly. The guide shows what a good answer looks like next to a bad one.
Most smaller stores had their old app facts moved over automatically, so start with the review. If you had more than 1,000 facts in the old app, they weren't migrated, and you'll need to re-enter the ones you want to keep before January 15. One honest caveat from Shopify's own help page: a knowledge base improves accuracy, but it doesn't change how often you show up in AI results.
🔥 Tool of the Week 🔥
Your SMS flows reach 30% of carts. Recover gets the other 70%.
Your abandoned cart flows only text shoppers who opted into SMS marketing. That's about 30% of your carts. The other 70% never subscribed, so your flows never reach them.
Recover does. Trained agents text those shoppers one-to-one in real conversations. They answer sizing questions, handle shipping objections, send a code, and win the sale back. No automation, no templates, no blasts.
It runs alongside the flows you already have. Nothing to rebuild, nothing to rewrite, five minutes to install on Shopify.
You only pay for results, backed by a 10x ROI guarantee.
⚡ This Week's Industry Pulse ⚡
Every week, I come across strategies and insights that are just too good not to share. Here's what caught my attention this week.
AI shopping agents are moving faster than the rules on who pays when they get an order wrong. Early Warning Services CEO Cameron Fowler's son used Meta's Muse agent to buy a red coat in the wrong size, and nobody could say who was liable. Stripe says there's no case law yet. Visa, Mastercard, and American Express each handle agent transactions differently, and Wells Fargo now warns customers that sharing logins with an AI tool can leave them on the hook. Before you welcome agent orders this season, ask your processor how it handles a disputed one.
Google is expanding ads in AI Mode to 10 more countries, including Canada, Australia, and the Philippines, with Brazil, Mexico, and the UK coming in Q4. In the US, multiturn ads now appear on follow-up questions, labeled Sponsored, so you can show up in the third question of a conversation, not just the first. Google says sponsored and organic product listings already get similar click-through rates in AI Mode, but that claim covers product grids, not text ads. Check your own numbers before you shift budget.
USPS can now bill you for foreign duties your customer didn't pay. The rule took effect October 19 and covers every country, and switching to UPS or FedEx doesn't remove the risk. You pay the invoice even while you dispute it, the charge can apply to returned or lost parcels, and late invoices accrue 6% interest. The EU's flat €3 duty per product type runs through June 2028. If you ship internationally on thin margins, look at Delivered Duty Paid for eligible destinations before holiday orders go out.
Walmart stretched its Black Friday and Cyber Monday events to 14 days this year, up from 10 in 2025. Early Black Friday runs November 12 to 15, the main event November 23 to 29, and Cyber Monday November 30 to December 2, with thousands of gifts under $20 and early access for Walmart+ members. That's the deal calendar your shoppers will compare you against. If your offer only runs four days, decide now whether you're starting early or holding firm on margin.
The Trust You Never Revisited
Looking back across this week, one thread runs through almost everything. An app you installed two years ago still had a path to your checkout. A returns policy you wrote once is now the answer an AI agent gives your customer at midnight. Even a parcel you shipped to France can come back weeks later as a duties invoice. None of it is broken today. It just hasn't been checked in a while.
So here's my ask for the next few days. Pick one, the app audit or the knowledge base review. Each takes less than an afternoon, and both are a lot easier now than in the middle of Cyber Week.
Hit reply and tell me how many apps you uninstalled. I'm genuinely curious what the real number looks like across stores, and I'll share what I hear in a future edition.
The best Black Friday prep this year might be subtraction.
Keep building,
Steve
Side note: if night and weekend coverage is the seat you keep failing to fill, save Nico's episode for your January planning. He's refreshingly clear about when offshore hiring is the wrong move.
