I built TaskBounty, and one part of it gradually became a fairly capable security discovery system.

It crawls public sources for newly launched web apps, organizes and enriches them, and runs an outside-in scanner that checks what those apps expose to an ordinary visitor.

We have discovered more than 6,500 targets, completed over 1,500 scans and generated more than 2,700 findings. Some were serious or critical.

The workflow we operate requires permission before scanning and keeps the results private. But if I sell the source code, the new owner could potentially remove that restriction and run it against sites without permission.

To make the story stranger, Claude banned my account after the system was already built. I can prove when everything happened, but Anthropic did not tell me exactly why the account was banned.

I’m considering separating this from the rest of TaskBounty and selling it as its own asset. Financially, that might make sense. Ethically, I’m not sure I want to hand it to whoever offers the most money.

Has anyone dealt with a similar dual-use acquisition?

How much responsibility does a founder retain after selling the technology?

What would responsible buyer vetting actually look like?

I’m looking for advice before I list it anywhere.

I’m looking for acquisition advice on a slightly uncomfortable SaaS asset.

I built a crawler and outside-in security scanner as part of TaskBounty. The crawler discovers recently launched web apps and organizes information about them. The scanner then checks what an unauthenticated visitor can already pull from the deployed app.

It has completed more than 1,500 scans and produced over 2,700 findings. Some were critical, including exposed data and credentials.

We only scan through a permission-based workflow and do not publish sensitive findings. But the underlying technology could also be used at scale without asking for permission if the wrong buyer removed those controls.

Claude also banned my account after the system had already been built. I can verify the sequence of events.

So the question is not just what the code is worth. It is whether and how it should be transferred.

Would you:

1. Sell the whole asset after vetting the buyer?
2. License it while retaining control?
3. Require audit logs and a permanent authorization layer?
4. Avoid selling it completely?

I’d especially like feedback from people who have acquired cybersecurity, compliance or developer-tool products.

I’m considering selling the security side of a SaaS I built, but I’m unsure whether I should.

It started as part of TaskBounty. We built a crawler that discovers newly launched web apps from public sources, enriches them with information about the product and founder, and passes them into an outside-in security scanner.

The scanner checks what an ordinary visitor can already access, including exposed browser secrets, open databases, public source maps, reachable configuration files and unsafe endpoints.

The crawler has discovered more than 6,500 targets. We completed over 1,500 scans and generated more than 2,700 findings, including some critical exposures.

Our actual workflow requires authorization before a security scan proceeds, and we keep sensitive findings private. The problem is that a technically capable buyer could remove that gate and use the crawler and scanner without asking anyone.

There is another strange part to the story. Claude banned my account after the product had already been built. I can prove the timeline, although Anthropic never gave me a specific reason, so I cannot prove the scanner caused the ban.

I’m now trying to decide whether to sell the scanner, license it under strict conditions, or keep it private.

For people who have bought or sold security products:

Would this concern stop you from selling?

What safeguards would you require from the buyer?

Would you structure it as an asset sale, a license, or something else?

I’m looking for a very specific kind of beta tester.

You should have:

• An active JavaScript or TypeScript GitHub repository
• Existing automated tests
• Regular PRs created with Claude Code, Codex, Cursor or Copilot
• Willingness to give blunt feedback after several real PRs

I’m building a GitHub check that runs the PR in a clean environment, deliberately introduces small bugs into the changed code and checks whether the tests catch them.

The reason is simple: if an agent writes both the implementation and tests, everything can pass while both contain the same misunderstanding.

I’ll provide access and help with setup for free. No card, sales call or commitment.

I specifically need feedback on:

1. Whether the findings catch anything your normal CI missed
2. Whether the report is understandable
3. Whether the added CI time is acceptable
4. Which findings are noisy or wrong

Comment with your stack, test runner and coding agent if you have a suitable repo.

I’m building a GitHub check for teams using Claude Code, Codex, Copilot or similar tools on JavaScript and TypeScript repositories.

It is not another AI code reviewer.

It runs the PR in a clean sandbox, executes the tests, deliberately introduces small bugs into the changed code and checks whether the tests catch them.

The idea came from something I built internally for TaskBounty. We need to verify coding-agent work before delivering it, and “the tests pass” is not always convincing when the same agent wrote both the code and tests.

I’m looking for 5 initial design partners.

You should have:

• An active GitHub repository using JavaScript or TypeScript
• Existing automated tests
• At least a few agent-generated PRs each month
• Willingness to give blunt feedback after 3 to 5 PRs

I’ll provide access and help with setup for free. No card and no sales pitch.

Comment with your stack and which coding agent you use if you are interested.

I run TaskBounty. AI coding agents complete software work, we verify the result in an isolated sandbox, and the customer receives a reviewable PR.

While building it, I created an internal system for finding potential customers.

The system crawls launch platforms, Reddit, directories, marketplaces and company websites. It resolves the real business, gathers evidence, finds traction signals, enriches the founder and contact details, then moves qualified records into an outreach pipeline.

It started as a crawler and slowly became a real internal application with hundreds of companies, scoring, filters, contact enrichment, personalized drafts and email tracking.

The wider TaskBounty work included legitimate public, in-scope security review and bug bounty research. I was using Claude heavily while working on it, then my Claude account was banned. Anthropic never gave me the exact reason, but the security and automation work are the obvious connection. Happy to prove it or show what exists.

Now I’m separating the discovery engine into a possible standalone SaaS.

The user describes the finished dataset they want. The platform decides which sources to use, finds the companies, enriches the requested fields and creates a living table.

Need another field next week? Add it in plain English and the system researches every row.

The biggest technical problems I see are source reliability, entity matching, conflicting data, crawler maintenance and making confidence visible without overwhelming the user.

I’m looking for 20 early testers. Access will be free while I build it, but you need to bring a real search request and give honest feedback.

If you want in, comment with:

1. What you sell
2. Who you sell it to
3. The hardest information to find about them

I’ll message the best use cases.

I’m turning an internal TaskBounty system into a standalone product and need people to break it.

TaskBounty uses AI coding agents to complete software work, verifies the result in an isolated sandbox and delivers it as a reviewable PR.

For our own customer discovery, I built a system that crawls different public sources, identifies real companies, finds evidence of traction, enriches founder and contact information, and organizes everything into an outreach pipeline.

The wider system also involved legitimate public, in-scope security and bug bounty research. I used Claude heavily while building it, then my Claude account was banned. Anthropic did not confirm the reason, but the research and automation seem like the obvious trigger. Happy to prove the restriction or show the existing dashboard.

The public product would let you describe any specific group of potential customers and the information you need about them.

For example:

“Find independent cybersecurity consultancies in Europe with fewer than 50 employees. Add the founder, work email, phone number, website, industries served and whether they offer penetration testing.”

The system builds the table and shows where each value came from. You can then add another column whenever you need more information.

I’m looking for 20 people who currently do sales, recruiting, agency work or business development.

You’ll get free early access. In exchange, I need:

• One real dataset you currently need
• Honest feedback on the results
• Permission to ask annoying questions about what is wrong or missing

Comment with what you sell and the exact companies you need to find. I’ll message the strongest use cases directly.

I run TaskBounty, a platform where AI coding agents complete real software work. We verify everything in an isolated sandbox before payment is released and deliver the result as a reviewable PR.

I needed a better way to find companies that might need us, so I built an internal discovery system.

It crawls Reddit, Product Hunt, Show HN, marketplaces and company websites. It resolves the actual business behind each result, looks for traction, finds the founder and contact details, scores the evidence and puts qualified companies into an outreach pipeline.

The broader TaskBounty work also involved legitimate public, in-scope security review and bug bounty research. I was using Claude heavily while building it, then my Claude account was banned. Anthropic never told me the precise trigger, but the security research and automation are the obvious connection. It was not unauthorized access or malicious hacking. Happy to prove the restriction or show the system.

Now I’m considering turning the discovery engine into a separate product.

The idea is that you describe the exact database you need:

“Find 200 accounting firms in the US that specialize in ecommerce companies. Add the managing partner, email, phone number, website, office locations and current CRM.”

The system figures out where to search, builds the database and shows a source and confidence level for every value.

If you need another field later, you add a column in plain English and it researches every existing record.

I’m trying to validate three things:

1. What exact dataset would you ask it to build?
2. How do you get that data today?
3. Would you trust an automated result, or would you need a human to verify it?

I’ll give the first 20 serious testers free access while I build the public version. Comment with your use case and I’ll reach out.

Please tell me if this is useful, unnecessary or completely unrealistic.

I run TaskBounty, where AI coding agents complete software work and we verify the result inside an isolated sandbox before delivering a PR.

While building it, I needed a way to find good potential customers.

So I built an internal crawler that discovers companies across Reddit, launch platforms, marketplaces and the wider web. It identifies the real business, finds traction signals, scores the evidence, enriches the founder and contact information, and puts everything into an outreach workflow.

The internal product now has hundreds of leads, custom filters, contact enrichment, personalized email drafts and engagement tracking.

Part of TaskBounty also involved legitimate public, in-scope security review and bug bounty work. While using Claude to help build and research the system, my account was banned. Anthropic has not confirmed the exact reason, but I believe that work triggered it. Happy to prove the restriction or show what I built.

Now I think I may have accidentally built the foundation of another SaaS.

The public version would let you describe a highly specific group of potential customers. The system would decide where to find them, collect the information and build a custom table.

Want another data point later? Just add the column in plain English.

Instead of learning scraping, enrichment APIs, data waterfalls and Clay formulas, you would describe the finished dataset you want.

I'm giving the first 20 testers free access while I build it. In exchange, I want honest feedback and a real search to test the system against.

Comment with:

1. What you sell
2. Who you need to reach
3. The hardest information to find about them

I'll choose the most interesting searches for the private beta.

A really common thing with Lovable apps is that Row Level Security never gets turned on, which means anyone with your public key (it's right there in the page) can read your whole database. Easy to miss, easy to fix.

I built a free scanner that checks this and a few other common leaks (exposed keys, reachable .env, source maps). Paste your app URL and it tells you in a few seconds. Read-only, never logs in.

task-bounty.com/scan. Run it on your own app and let me know what it finds, happy to walk you through fixing anything.

I’m building TaskBounty, a service that helps JS/TS teams raise coverage by delivering behavior tests as a PR.

We just launched a public JS/TS Coverage Index:

[https://www.task-bounty.com/coverage-index\](https://www.task-bounty.com/coverage-index)

I’m not trying to pretend coverage equals quality. It does not. The framing is: coverage is a map, not a grade.

Current index:

* 98 JS/TS repos tracked
* 51 with measured public signals
* 47 with no obvious public signal
* per-repo pages
* README badges
* result challenge flow

Question for testing people:

What would make this less misleading?

Ideas I’m considering:

* show mutation score where available
* label line coverage and branch coverage separately
* distinguish provider coverage from sandbox-measured coverage
* add “methodology warnings” on each result page
* avoid ranking language entirely

What else should be included before you would trust a public coverage signal?

I’m building TaskBounty, a service that helps JS/TS teams raise coverage by delivering behavior tests as a PR.

We just launched a public JS/TS Coverage Index:

https://www.task-bounty.com/coverage-index

I’m not trying to pretend coverage equals quality. It does not. The framing is: coverage is a map, not a grade.

Current index:

• 98 JS/TS repos tracked
• 51 with measured public signals
• 47 with no obvious public signal
• per-repo pages
• README badges
• result challenge flow

Question for testing people:

What would make this less misleading?

Ideas I’m considering:

• show mutation score where available
• label line coverage and branch coverage separately
• distinguish provider coverage from sandbox-measured coverage
• add “methodology warnings” on each result page
• avoid ranking language entirely

What else should be included before you would trust a public coverage signal?

I’m working on a service that helps teams raise test coverage, and I’m trying to sharpen the positioning.

The offer is currently:

“Test coverage to 80%, delivered as a PR.”

I know 80% is imperfect. It’s not a substitute for meaningful tests, risk-based testing, mutation testing, etc.

But for SaaS teams with very low coverage, it seems like a useful commercial threshold:

- high enough to force real work

- understandable to buyers

- common enough to be familiar

- measurable enough to verify

Question for QA folks:

Would “to 80%” make you more or less likely to trust the service?

What would be a better promise?

- risk coverage?

- critical-path tests?

- file-level gap report?

- coverage + mutation score?

I’m building a coverage service and want to sanity-check our quality bar with testing people.

The product promise is:

“We raise coverage to 80% by delivering tests as a PR.”

But obviously coverage can be gamed, so we’re trying to make the guarantee stricter:

- no tests that only assert mocks were called

- no snapshot spam unless requested

- no lowered coverage thresholds

- no excluded files without approval

- existing tests must stay green

- before/after coverage report

- customer can reject low-quality tests

Question:

What else belongs in the quality bar?

If you were reviewing a PR that claimed to increase coverage, what would immediately make you reject it?

Context: we also have a free coverage gap checker, but I’m mostly looking for QA/testing feedback here rather than promotion.

I’m building TaskBounty, a service that takes SaaS repos to 80% test coverage by delivering the tests as a finished PR.

The free entry point is Coverage Check:

https://task-bounty.com/coverage-check

What it does:

- public repos: reads public coverage from Codecov / Coveralls / SonarCloud if available

- private repos: runs a read-only sandbox scan and sends back current coverage, gap to 80%, and top files to test first

I’m trying to figure out if the positioning is clear enough.

The intended buyer is not really OSS maintainers. It’s founders / CTOs with private repos who know their coverage is too low but don’t want to pull engineers off product work.

Questions:

1. Is the public/private split clear?

2. Would you trust the private scan flow?

3. Is “coverage to 80%, delivered as a PR” specific enough?

4. What would make you bounce?

Happy to run a free teardown for the first few repos people drop here.

I’m working on TaskBounty and would appreciate founder-level feedback.

We originally positioned it as a broader AI code-fix platform. That was too vague.

We narrowed the wedge to:

“Test coverage to 80%, delivered as a finished PR.”

The lead magnet is a free Coverage Check:

https://task-bounty.com/coverage-check

For private repos, the idea is:

- install read-only access to one repo

- we run the suite in a sandbox

- send back current coverage, gap to 80%, and top files to test first

- if useful, we can deliver the tests as a PR

The buyer we’re aiming for:

Seed-Series B SaaS teams, especially before SOC2, enterprise sales, diligence, or reliability pushes.

Question:

Is this narrow enough to be a strong wedge, or does “test coverage” still feel like a vitamin?

I’m especially interested in feedback from people who have sold devtools or run engineering teams.

I’m testing a lead magnet for a B2B devtool and would love feedback from other SaaS founders.

The product:

TaskBounty takes a repo to 80% test coverage and delivers the tests as a finished PR. Flat price, refund if we miss the target.

The old funnel was too product-led:

“Here is an AI code tool.”

The new funnel is more diagnostic:

“Run a free coverage gap report on one repo.”

The report gives:

- current line coverage

- gap to 80%

- top files where tests reduce the most risk

- whether a fixed-price sprint makes sense

Public version:

https://task-bounty.com/coverage-check

Private repo version:

read-only scan, sandboxed, no card.

My thesis is that founders don’t want “AI test generation.” They want to know:

“how bad is coverage, what should we test first, and can someone make this problem go away?”

Curious:

- Would this lead magnet work on you if you had a messy repo?

- What would make you trust or distrust the private scan?

- Is 80% a strong promise or too arbitrary?