Launch week
Stenvakt went public a week ago. This is what launching a security app on my own has looked like so far, and how I'm trying to find the people who need it.
A quiet launch, then a loud one
Stenvakt 1.0 went up on 1 November with no announcement. Before telling anyone, I wanted a full bug scan of the app and an install test on a Mac that had never seen it. The fixes from that scan shipped as 1.0.1 the next day. It's at 1.0.8 now.
Then came the loud part: a post on X and a Show HN. The first X post reached four people. Links in posts get buried, and my account is small. What I learned: start with a problem people recognise, show the app doing something, and put the link in a reply.
The inbox after Show HN
Within a day there were about fifteen emails. Most were automated pitches built from my Show HN title. Two were worth a lot:
- Someone on X pointed out that stenvakt.com had no Content-Security-Policy.
- An AI agent noticed that the DMG download had no published checksum, while the zip did.
Both were fixed the same day. A security app's own site has to pass the checks it runs on yours, so the site now has a strict Content-Security-Policy, a security.txt, HTTPS enforced on every subdomain, DNSSEC and CAA records. The download page has a checksum for both files.
The rule I use now: if an email names a specific fact I can check, I check it. If it names a score or a fear, I delete it.
Finding the people who need it
Stenvakt is for people who run a handful of servers themselves. They don't search for "server hardening app". They post things like "locked myself out with ufw" or "how do I patch ten servers after this CVE" on Hacker News, Reddit and forums.
One of the launch emails was from Vaibhav, who builds Needle. It finds threads where people ask for a tool like yours, or complain about the one they use. I offered him a swap. He turned down the Stenvakt side, said he wouldn't use it enough to make the trade fair, and gave me a month of Needle anyway.
I like the idea a lot. Building the app is the part I know how to do; finding leads, and the places where talking about Stenvakt actually helps someone, is the part I struggle with. A tool that brings me the threads where someone already has the problem is exactly what I was missing.
How Needle works
You give it your website and the phrases your future users would write. It watches Reddit, Hacker News, Stack Overflow, GitHub, Lobsters, Bluesky, Mastodon, X, Product Hunt, forums and a few more for those phrases. Then it throws away the noise (tutorials, memes, job posts, spam) and ranks what's left by how likely the person is to need a tool right now. The best threads come to you in a morning digest, or in Slack, Discord or a webhook if you want them there.
By Needle's own numbers from a month of searches, about 83% of keyword matches turn out to be noise, and only about 1 in 20 posts it reads is a strong buying signal. That's the part that's hard to do by hand: a search for "ufw locked out" means reading dozens of old posts to find the one where someone still needs help today.
Why it fits a tool like this
The thing I care about most: Needle never posts for you, and it never asks for your social logins. It can draft a reply, but you read the thread and write the answer yourself. That matters to me. Communities like Hacker News and r/sysadmin can smell a pasted sales pitch, and the only replies that work there are ones that actually help. Stenvakt gets mentioned only when it's the honest answer to the question.
For Stenvakt, the useful phrases are the ones people write when something just went wrong, or before they try something risky: locking themselves out with ufw or a changed SSH port, Docker ports showing up on the internet behind a firewall, patching a handful of servers after a big CVE, looking for a Webmin or Cockpit alternative, or asking whether unattended-upgrades is safe on a production box. Those people don't need an ad. They need the answer, and sometimes the answer is a tool.
It also works inside Claude and ChatGPT, so you can ask it what people said about server hardening this week without opening another tab. Plans start at $15 a month, with a 7-day free trial and no card.
I've only just started with it. He was upfront that Reddit coverage is thinner this month because of Reddit's API changes, while Hacker News and the forums aren't affected. In a couple of weeks I'll write here what it found, and what was noise.
What's next
Updates ship every week, free for everyone. If you run your own servers, try Stenvakt: the review is read-only and changes nothing. The first ten people to make an account get a month of Pro. And if something breaks, tell me. I read every report myself.
Matija