SaaS ideas your next customers are already looking for
100 SaaS startup ideas for the people who said they'd pay, from agency owners to dentists. Micro SaaS ideas, AI SaaS ideas and B2B SaaS ideas: find yours, build it, sign them up.
Popular:
| # | Idea |
|---|
No idea matches this filter.
Pain points in business: what people struggle with
Search the problems to solve, as people described them on Reddit and other platforms, in their own words.
Popular:
| # | Pain point |
|---|
No pain point matches this filter.
Overbroad Agent Credentials
AI agents inherit broad, long-lived credentials with no per-task scoping, revocation, or audit trail, creating security and attribution risks.
In their words
how do you guys keep the records up to date regarding these NHIs and their privileges ?
we had a full mesh of point-to-point calls, no consistent auth between them, and zero visibility into which agent triggered which downstream action
the biggest value isn't adding more connectors it's having one reliable SDK for auth, permissions, state, logging, and account management so I don't have to rebuild that for every agent
It doesn’t fix the cross-agent handoff visibility gap on its own, but it at least gives us a solid baseline for what each individual agent was authorized to do
I really don't want them using this same role when working with AI agents, as I'd like to limit the agents' blast radius.
I want them to keep doing that without having the credentials sitting in their workspace.
most of our agents run under one shared service account with broad permissions
Your auth doesn't stay after you change the model or switch sessions.
do you treat coding agents as normal user activity, suspicious automation, or a separate identity with its own policy and audit trail?
I want one model that treats a person and an agent the same, by identity and no broker box sitting on the internet
if one agent spawns another, does the child just inherit whatever access the parent had
The agent has the same rights as a user at the moment, which I hate, but no one has offered a silver bullet solution for this
every week I encounter something that doesn't work or work well
why do they not want me or anybody else to pay them to create delegated/short-lived identities
AI agent developers and operators
Where they talk
- r/AI_Agents
- r/hermesagent
- r/aiagents
- r/LLMDevs
- r/AI_Governance
- r/devops
- r/LangChain
- r/AskNetsec
Tools they use today
- MCP
- Hermes
- Claude Code
- GitHub
- OAuth
- Claude
- git
- API keys
Why those fall short
- Directory scoping breaks on cd; possession of a key implies authority
- rule file cannot catch a secret the agent already saw
- no short-lived creds for password-only switches and BMCs; agents still read secrets on hosts
- no agent identity, task-based permissions, or run reconstruction
- No peer authorization; sessions disconnect; single-machine by design
Map of ideas
Drawing the map…