Alex ⚡ building Sumbrel

Building Sumbrel 🛠️
I break SaaS so you don’t have to.
Shipping in public.

[Alex ⚡ building Sumbrel @TrySumbrel]

Me reading my own code from 3 weeks ago:

"who wrote this"

*checks git blame*

"oh."

[Alex ⚡ building Sumbrel @TrySumbrel]

Where 279 SaaS websites live (what I could detect):

Cloudflare 123
Vercel 113
Framer 16
Webflow 13
AWS 11
Netlify 9
Railway 9

[Alex ⚡ building Sumbrel @TrySumbrel]

@andr3barroso I use a design system as my foundation, then customize the UI with intentional choices around typography, spacing, colors, and interactions. I also use real products for inspiration rather than blindly following AI-generated patterns. The key is to give the app its own identity..

[Alex ⚡ building Sumbrel @TrySumbrel]

@BatsouElef Dépends, bugs are great to fix with AI… but cyber fixes mostly with sumbrel

[Alex ⚡ building Sumbrel @TrySumbrel]

@RobinHill85 @Manixh02 I'm sorry to hear that, hope you have sumbrel next time...

[Alex ⚡ building Sumbrel @TrySumbrel]

@Manixh02 And that’s exactly the problem. You can check 20 things manually… and still miss the 21st. That’s why we built https://t.co/vL9lNmz8wC ☂️

[Alex ⚡ building Sumbrel @TrySumbrel]

@1Umairshaikh Best question, best answer for that is testing your app directly on https://t.co/vL9lNmz8wC ... for free ofc

[Alex ⚡ building Sumbrel @TrySumbrel]

@Gaus450 @itsalicesoul Best strategy, but testing alone, hmm...

[Alex ⚡ building Sumbrel @TrySumbrel]

@trader_girlie @itsalicesoul Imagine a tool that does it automatically for you 🥰

[Alex ⚡ building Sumbrel @TrySumbrel]

@Shahbaztwt @itsalicesoul That’s exactly what I was thinking before creating https://t.co/p9ctW7XNm2

More than 900 SaaS are being launched worldwide every day, and many of them are already generating MRR.
Now imagine how many of them overlooked the small security details... 😅

[Alex ⚡ building Sumbrel @TrySumbrel]

@itsalicesoul Cause https://t.co/p9ctW7XNm2 does the work for me :-)
Score your SaaS free on the homepage, no account needed 😅

[Alex ⚡ building Sumbrel @TrySumbrel]

My spreadsheet import worked perfectly on localhost.

In production it hung forever. No error.

The culprit: my own Content-Security-Policy, blocking a blob: web worker.

I got protected from myself.

[Alex ⚡ building Sumbrel @TrySumbrel]

11 of the 279 SaaS homepages I scanned had a secret sitting in their JavaScript. 2 of them critical.

If it's in your bundle, it's public.

Minification is not encryption.

[Alex ⚡ building Sumbrel @TrySumbrel]

Production has a sixth sense for the exact moment you close your laptop.

[Alex ⚡ building Sumbrel @TrySumbrel]

What's the one security thing you KNOW you should set up, but haven't yet?

[Alex ⚡ building Sumbrel @TrySumbrel]

I build Sumbrel with several AI coding sessions working in the same repo.

One of them staged a file deletion. Another one committed it.

New rule for my agents: nobody stages anything they're not committing right now.

[Alex ⚡ building Sumbrel @TrySumbrel]

Every scan in Sumbrel comes with a share card I designed to be boring on purpose.

Your domain, your score, and one question: "And your SaaS?"

Never the findings.

[Alex ⚡ building Sumbrel @TrySumbrel]

I just tested Opus 5.5 and made a short vertical format to promote our app, pretty crazy :O

[Alex ⚡ building Sumbrel @TrySumbrel]

I deleted a feature.

Forgot 3 imports.

The build broke. Then the server crashed. Then it crashed again.

3 fix commits in 6 minutes. Not my finest evening.

[Alex ⚡ building Sumbrel @TrySumbrel]

Honest question: did you scan your own site before launching?