The case at a glance
- Gross volume: ~$11K (public Stripe figure read by a commenter: $11,795.50)
- All-time paying customers: 350+
- Signups: almost 8,000
- Top TikTok slideshow: ~1M views, still sending signups weeks later
- Production time per slideshow: 1-2 minutes
- Team size: 2
- Paywall redesign: conversion tripled
Stack: checkvibe.dev, Stripe, GitHub OAuth, TikTok, slideys.app. Nothing else disclosed.
The operator runs checkvibe.dev. You paste a URL or connect a GitHub repo, and it surfaces what's leaking: secrets sitting in frontend code, open database rules, missing security headers. A generation of builders now ships apps they didn't write, and the tools that wrote them default to permissive. The leak isn't a bug in any one app — it's a property of how the code got generated. He found the window while it was still open.
What he's actually selling (the AI code security wedge)
The product isn't the scan. The product is an integer.
The first paywall blurred every result and barely converted. The second shows the count of critical issues and keeps the findings locked. Conversion tripled. A blur says "we're hiding something." A count says "you have 4 problems." One is a sales tactic; the other is a diagnosis the buyer can't un-hear.
That's also why the distribution costs nothing. People building with AI tools post their live URLs constantly — for feedback, for launches, for validation. That's a prospect list updating itself hourly with no data purchase involved. The scan is the research step and the pitch at the same time. Generic cold DMs got ignored. DMs opening with "here's what I found in your app" got replies almost every time, because he delivers the product first and asks for money after.
He isn't competing with the funded AI security platforms running Zoom-call sales motions. He's competing with the buyer's own vague anxiety, and he wins by converting it into a number in under thirty seconds.
If your product needs a paragraph to describe, you've built something you'll have to sell forever.