SaaS ideas your next customers are already looking for
100 SaaS startup ideas for the people who said they'd pay, from agency owners to dentists. Micro SaaS ideas, AI SaaS ideas and B2B SaaS ideas: find yours, build it, sign them up.
Popular:
| # | Idea |
|---|
No idea matches this filter.
Pain points in business: what people struggle with
Search the problems to solve, as people described them on Reddit and other platforms, in their own words.
Popular:
| # | Pain point |
|---|
No pain point matches this filter.
Row-Level Security Leaks
Developers struggle to author, verify, and maintain row-level security policies, causing silent cross-tenant data leaks and unmaintainable permission logic.
In their words
I'm now specifically looking for a second pair of experienced human eyes to try to break the authorization model, rather than another automated scanner.
bancos multi-tenant (Postgres/Supabase) que vazam se um registro de outro cliente existe ou não, mesmo com RLS ligado certinho
if I ask for their public SSH key and add it to my server's authorized_keys folder (for the main ubuntu user), doesn't that give them full SSH/sudo access to the entire server?
Mapping access controls directly onto your vector chunks at query-time is a massive engineering headache.
We were quickly knee deep in the RLS maze, and the un-debuggable triggers/functions
unless all developers are ok seeing everything in a given workspace it doesn't work?
Anyone found a better way to handle the group membership thing than just rolling your own mapping table?
Our RAG permissions filter is safe and still ruins retrieval
Estamos começando a ter problemas de latência, e bug que expõe os dados de um usuário para outro. Devido os devs às vezes esquecem de declarar o contexto via where.
I have no idea if one user can modify API parameters and accidentally pull another user's database records.
Security completely ignored, everyone uses SA to log in to DB and no change tracking implemented.
There was no single decision to open the gates Just a series of reasonable calls made under time pressure that never got revisited.
replacing a complex (and scary) permissions system built on top of Snowflake with single role duckdb databases
Curious if anyone here has a process for this that isn't just 'manually re-read the code and hope you catch it'
Multi-tenant SaaS developers
Where they talk
- r/Supabase
- r/SaaS
- r/nocode
- r/MicrosoftFabric
- r/SaasDevelopers
- r/snowflake
- r/devops
- r/PowerBI
Tools they use today
- Supabase
- PostgreSQL
- Lovable
- Microsoft Fabric
- Claude
- Snowflake
- Cursor
- MCP
Why those fall short
- no guardrails, scoping, approval or automatic revert for global prod changes
- no enforced layer boundaries or role-based permissions
- Sharing keys or adding to ubuntu authorized_keys grants full server access
- AI-generated code hides bad permission rules behind a nice UI
- Contributor access overrides OneLake Security; workspace is the only security boundary
Map of ideas
Drawing the map…