Issue 002 - Two things that can kill your app. Neither one is the code.

This week I went digging through the communities where builders actually talk.

Two problems kept coming up. Neither one is about the code. Both can kill your app before it makes you a cent.

Here is what I found this week.

Most AI coding platforms show you a security check. You run it. Something happens in the background. You move on.

But do you actually know if your Supabase is leaking user data right now? Do you know if someone can change a number in the URL and read another user's records? Do you know if your payment webhooks accept fake events because nobody validated the signature?

Most AI builders don't. Not because they don't care. Because the check ran and nothing exploded and that feels like safe.

A pentester went through 50 AI-built SaaS apps this year. Found the same three holes every single time.

One: any user can access any other user's data just by changing a number in the URL.
Two: webhooks accept fake payment events because the signature was never checked.
Three: single use discount codes redeemed multiple times at the same time.

None of these show up as errors. Your app looks fine. It runs fine. Until someone finds the hole and your database is gone or your revenue is being drained while you sleep.

The security tools that exist cost $99 and up and assume you have a DevOps team. You don't. You have an AI model and a weekend.

The gap: a security checker built for AI-coded apps running on Supabase. Paste your app URL. It tests the three holes that appear every time. Returns pass or fail in plain English. No jargon. No 40 page report. Just what is broken and exactly what to hand your AI model to fix it.

The evidence: A pentester posted in r/microsaas after auditing 50 AI-built apps and found the same three holes every time without exception. A non-technical founder in r/nocode built a CRM and only discovered it was leaking data between users after it went live. Multiple threads in r/lovable this week with builders asking whether their Supabase RLS is actually configured correctly or just assumed to be.

Buildable in a week or two: Yes. Build the UI with any AI coding tool. Small Node backend runs the three checks against your live app. Supabase stores the results. Resend sends the report. Charge $19 a month or $49 for a one time audit. Founders will pay that to stop worrying about something they cannot see.

Who already charges for this: Enterprise security tools at $99 and up built for DevOps teams with budgets and headcount. Nobody is doing this for the AI builder who just wants to know if their app is safe before someone else finds out it is not.

Most AI coding platforms have a restore feature. Version history. You have probably seen it.

Here is what nobody tells you. That restore only works if the platform lets you into your project.

A founder posted in r/lovable this week. Their site went down. The platform flagged the project for abuse with no warning, no explanation, no timeline. Support not responding. Website down. Losing sales. And every version of their code sitting locked inside a platform they cannot access. No GitHub sync. No backup. No way back in.

This is not a bug. This is what happens when your entire business lives inside someone else's platform and that platform decides to close the door. You did not lose your code in one dramatic moment. You just found out it was never really yours.

Lovable, Bolt, Replit. They all have GitHub sync. But you have to set it up yourself and most people never do because the app works fine without it and fine feels safe until it is not.

The gap: an automated daily backup tool that connects your AI coding projects to your own GitHub without you touching anything technical. No setup headache. No remembering. Just your code sitting in a place that belongs to you, backed up every single day, whether you thought about it or not. If your project gets locked or blocked tomorrow you open GitHub and everything is there.

The evidence: A founder posted in r/lovable this week with their website down and sales bleeding out. The project was flagged with no warning and no timeline. Support not responding. Code trapped. They had no GitHub sync because nobody told them it was the difference between losing an afternoon and losing everything. The thread had builders replying saying they had never set it up either.

Buildable in a week or two: Yes. Build the dashboard and connection flow with any AI coding tool. GitHub API pulls your project files on a daily schedule. Supabase logs every sync so you can see exactly when your last backup ran. Resend sends you an alert if a backup fails so you are never sitting on a gap without knowing. Charge $9 a month. The kind of thing founders pay for once and never think about again because it just runs quietly in the background keeping your work safe.

Who already charges for this: Nobody at this price for this use case. General backup tools exist but none are built for the AI builder who shipped their app in a weekend and does not want to think about infrastructure. That is exactly why this gap is still open.

Next week I am going back in.

North Operator