Gregory Pierce

I audited an AI-written billing service this week. 22 findings, 10 critical.

None of them crashed. All returned 200. Four that stuck with me: an auth check that silently lets anyone in when one env var is missing, SQL injection in the one query that wasn't parameterized, a broken permission boundary so anyone can attach a charge to a workspace that isn't theirs, and a Stripe retry that double-grants seats because there's no idempotency check anywhere.

I've been lurking on Product Hunt for a while before launching my own app today.

One pattern I keep noticing: products with bigger teams or at least teams that look bigger tend to dominate the leaderboard.

More makers = more built-in upvoters on day one.
EDIT: THIS IS FROM A SOLO DEV :(

A couple of weeks ago we started testing Reddit ads for Causo Fundraising, mainly because Reddit has already been one of our strongest organic acquisition channels.

After ~2 weeks:

• 226 spent

• 31,483 impressions

• 165 clicks

• 0.52% CTR

• 1.37 CPC

• ~10 conversions