Original Summary

Disclosure up front: I built this, it's called WhoOwnsWhat.xyz , and there's a paid plan. The post is mostly the lessons, the link is at the bottom. Why I built it I started a side project with a co-founder. Domain, Vercel, Notion, Slack, Claude: all on my card, all on my accounts. We trust each other, but on paper he owns nothing, and I had no clean way to split the bills. Before this I co-founded and sold a software agency. In due diligence, the expensive questions were never about the code. They were "who owns this domain?", "whose card is on this account?", "who can recover this login?". Most two-person projects can't answer those either. So: a shared ledger. Who paid what, who owns what, and what breaks if one of you disappears. What's inside Log a cost, it splits by your agreed shares (any ratio, up to 8 people) Settle up through your partner's Revolut / Wise / PayPal link (money never touches us) Asset list: domain, repo, hosting, each with owner, payer, backup admin, recovery email Risk alerts: "domain has one admin and recovery goes to a personal Gmail" "Breakup simulator": what dies tonight if you vanish Founder records: a dated snapshot each founder confirms with their own sign-in MCP server: tell Claude Code or Cursor "I paid $20 for Vercel" and it's logged and split The 9 lessons 1. Check search data before you write content, not after. I wrote a hackathon team agreement guide because I loved the idea. Search volume: about zero. "Vesting schedule template": about 10 a month. Meanwhile "splitwise alternative" gets ~590 a month with very low competition, and "team charter template" gets thousands. Interesting to me ≠ searched by anyone. 2. Free tools before the app. A Google Sheet, a founder agreement template, a cost split calculator and a handover checklist went live first. They're useful on their own, they rank, and they gave me something to link to before the app existed. 3. Boring stack wins when AI writes most of the code. Plain HTML, a ~500-line Node build script, Supabase, Vercel functions. No framework. Fewer moving parts meant fewer places for the AI to confidently break things I couldn't debug. 4. RLS is not the whole security story. Pre-launch audit found that signed-out visitors still had table-level grants on every table, including TRUNCATE, which ignores row-level security. Not reachable through the API, but it shouldn't exist. Run your database's security advisor and look at grants, not just policies. 5. Keep the secret key out of the server entirely. Every write goes through Postgres functions that check permissions themselves. The server only holds the public key. If the API leaked its whole environment, an attacker gets nothing a website visitor doesn't already have. 6. For AI tools, say what each action does NOT do. I collapsed nine MCP tools into one, and every action description end

  • 情报分类：服务器与云资源
  • 分类依据：内容涉及服务器、云资源或网络线路
  • 信息来源：Reddit · SideProject
  • 发布时间：2026/10/19 18:55:03