SaaS ideas your next customers are already looking for
100 SaaS startup ideas for the people who said they'd pay, from agency owners to dentists. Micro SaaS ideas, AI SaaS ideas and B2B SaaS ideas: find yours, build it, sign them up.
Popular:
| # | Idea |
|---|
No idea matches this filter.
Pain points in business: what people struggle with
Search the problems to solve, as people described them on Reddit and other platforms, in their own words.
Popular:
| # | Pain point |
|---|
No pain point matches this filter.
Insecure AI-Generated Code
AI-generated code ships with security flaws like hardcoded secrets, missing auth, and exposed credentials that pass tests and review.
In their words
API keys or backend secrets just sitting in the client build ... The client trusts itself ... No separation between player accounts
I just had a PCI DSS related security issue in my Nuxt application in a test audit scan report
I want a review to give me a piece of mind regarding two main things; security and stability with up to a 1000 users
I'd pay for a service that lets me use claude code without any fear of messing up my salesforce instance.
it becomes a challenge to keep track if my claude.md file blows up with many project settings like this. a more deterministic way is more stable
Can anybody tell me if these issues are really critical to fix for launching?
The UI is the only security. Buttons hidden from non-admin users, but the API happily answers anyone who calls it directly.
grep takes only a few hours, while manually understanding codebase of even a single small project can take months
There isn't an authorization model in here at all. Not a bad one. None.
ended up exposing secrets, sharing wrong data with clients, exposing unmasked names of employees of other clients
CISO has asked us to get rid of Dast and Sast and build our own AI scanners
AI generated pipelines that work but don't scale ... with PII that leaks, high cost queries, slow dashboards
When using local only models, OpenCode uploaded prompts and other data, to remote server to generate session titles
every single one of those MVPs shipped with security vulnerabilities we didn't know about.
AI-assisted developers and founders
Where they talk
- r/vibecoding
- r/cybersecurity
- r/SaaS
- r/devsecops
- r/nocode
- r/sysadmin
- r/lovable
- r/ClaudeCode
Tools they use today
- Claude
- Lovable
- Claude Code
- Supabase
- Cursor
- Codex
- GitHub
- Bolt
Why those fall short
- AI writes only the happy path; reviews miss absent checks
- grep only finds known patterns; Codex usage limits; manual review takes months
- safeguards trigger on legitimate security prompts and refuse to help
- AI tools never flag security, account isolation or crash tracking issues
- prompt-based rules are non-deterministic; agents sometimes override gates and hooks
Map of ideas
Drawing the map…