SaaS ideas your next customers are already looking for
100 SaaS startup ideas for the people who said they'd pay, from agency owners to dentists. Micro SaaS ideas, AI SaaS ideas and B2B SaaS ideas: find yours, build it, sign them up.
Popular:
| # | Idea |
|---|
No idea matches this filter.
Pain points in business: what people struggle with
Search the problems to solve, as people described them on Reddit and other platforms, in their own words.
Popular:
| # | Pain point |
|---|
No pain point matches this filter.
Supply Chain Security Noise
Teams struggle with noisy, inaccurate, and unscalable software supply chain security scanning that flags unused or transitive dependencies, causing triage fatigue and missed real threats.
In their words
The bigger issue is the amount of remediation work that comes from open source packages, base images and third party components our developers do not maintain.
They want SAST and DAST as a priority with other trimmings as optional
We explicitly do not want to have to rely on individual developers having to remember to run cargo audit, cargo cooldown, cargo deny... for every single update
we're probably going to shell out for the highest tier license to solve SaaS company like jfrog to get that same rules engine effect
I used GitGuardian at first, but it quickly became expensive and wasn't really suited to what I wanted anymore.
if a vulnerability is identified anywhere in our dependency chain by an AI model, researcher or vendor, we know where it's used, who owns it, whether we're affected, and how quickly we can deploy a fix
every vulnerability scan seems to produce the same outcome: hundreds of CVEs inherited from upstream images before we've even deployed our own code
I've been working on using a sophisticated unsafe review skill to check out all of the unsafe crates used at Google, and filing the issues.
I spent a whole month getting my environment back up and running when they started making these big changes. Even now, I’ll come back from the weekend and everything will be broken agaib
there's a constant mandate that we MUST update or we get a negative security score. Half the time the vulnerabilities are things that simply don't apply to us.
Since roughly April, about half of our dev time has gone into security.
How do you get visibility on what application is using it when you have 1000+ devices.
my response now is just put something between you and GitHub that you can control
Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer
Security and DevOps teams
Where they talk
- r/devsecops
- r/cybersecurity
- r/kubernetes
- r/AskNetsec
- r/sysadmin
- r/devops
- r/embedded
- r/archlinux
Tools they use today
- Trivy
- npm
- SBOM
- Dependabot
- GitHub
- CycloneDX
- RapidFort
- SCA
Why those fall short
- no built-in detection of maintainer changes or suspicious PKGBUILD edits
- no security or failsafe built in; abandoned projects
- blocks every file, breaks dev environment, no dev exclusions
- still spending too much time triaging inherited vulnerabilities
- attestations exist but nobody is required to verify them
Map of ideas
Drawing the map…