[ Idea ]Found 12 Nov · 1 YC · 1 private communities · 1 GitHub

Doorknob

Security checks for every hackathon team's app, scored fairly.

Should you build this?Checking

This idea is still going through the six checks.

0 products · 10 sourcesPending

The problem

Teams building apps with AI often ship the same security holes, and event organisers have no practical way to check them all.

A hackathon or demo day can receive 50 to 500 live app submissions, and judges have no neutral way to compare their security. Existing scanners sell to one founder at a time for $2 to $29, so no one covers the whole event.

Seen in 1 YC · 1 private communities · 1 GitHub

The idea

Doorknob collects every team's live URL with consent, scans them, and publishes a comparable security scoreboard while giving each team private fix steps.

1Organiser creates an event and teams submit their live app URL.
2Each team verifies ownership with a meta tag or file, then the scan runs.
3Teams get a private fix list, and judges see a public grade scoreboard.

Price: ₹4,999 per event (up to 100 submissions: scoreboard, per-team private reports, organiser summary). ₹12,999 per event (up to 500 submissions, white-label scoreboard, sponsor-ready aggregate report). ₹1,499/month for communities running monthly demo nights. Teams get a free basic report; an optional ₹799 re-scan and fix pack is a possible upsell.

[ The six checks ]0 of 6 done

1Not built in alreadyNot checked

2An AI agent can't do itNot checked

3Nothing similar existsNot checked

4People pay for thisNot checked

5Strong scoresNot checked

6Real sourcesNot checked

1 · Not built in alreadyNot checked

2 · An AI agent can't do itNot checked

Who paysThe hackathon or demo-day organiser: a college tech club (GDG on Campus, Takshila-type), a community or DevRel lead, or a sponsor's DevRel budget. They pay a flat fee per event. Teams use it free.

Who uses itTeams and solo builders in hackathons, college-fest demo days and builder-community showcases who ship AI-written apps with Supabase, Firebase or Vercel backends. The organisers run the programme.

First 10 usersAdarsh offers free pilots to organisers he already knows, via X DMs, LinkedIn, and the GDG on Campus, Takshila and Superteam India circles. He runs the scan on the next 3 events he attends or can reach, on opt-in submissions only. He posts an anonymised 'state of hackathon app security' thread on X from those runs, with no team names, then DMs the 10 organisers who engage with a flat-fee offer for their next event. He also scans his own hackathon demos first as a case study.

Why not just AIThe buyer is a non-technical organiser who can't review 100+ projects, and a team's own agent only sees its own repo and grades its own work. Doorknob adds four things an agent can't. It runs from an external attacker's view across all submissions, using one consent flow and scoped, rate-limited probes. Judges can trust it because a neutral third party produces the score, not the teams. It holds cross-event baselines, such as 'safer than 70% of apps at comparable events', which only come from aggregating many scans. And it runs the coordination: collecting URLs, verifying ownership, and sending private findings to teams.

[ Inspired by ]What it borrows, and what's different

Vibe App Scanner
Scans a live URL for exposed secrets, Supabase RLS and Firebase rules, then gives copy-paste fix prompts. It is single-user and sold per founder. Doorknob is cohort-level: one organiser link, consent and ownership verification per team, a comparable scoreboard, and cross-event baselines.
ShipSniffer
Runs deeper database checks only on sites whose owners verify ownership, and publishes aggregate findings from scanning launched apps. Doorknob turns the ownership-verification idea into an organiser workflow (submission form plus per-team token) for hundreds of teams at once, and sells to the event, not the individual.
Composal (YC Fall 2026)
Swarms of agents that use your product like real users to find bugs before release. Composal is B2B and checks features. Doorknob checks the attacker's-eye security surface of many small AI-built apps at once, for non-technical organisers and judges.

[ Sources ]10 cited

A study of 1,072 Supabase-backed vibe-coded apps found 98% had at least one security flaw, and 16% had a critical one.symbioticsec.ai ↗
A passive scan of about 31k live vibe-coded apps found that 57% of reachable Supabase backends allowed anonymous table reads, and 394 apps exposed tables named after people (users, patients and similar).vibe-eval.com ↗
Veracode's latest report (Oct 30, 2026) says AI code security improved from 56% to 62% passing, but 38% of tasks still produce vulnerable code.securityinformed.com ↗
CVE-2025-48757: about 170 of 1,645 scanned Lovable projects had Supabase Row Level Security misconfigured, exposing user data. The same failure mode recurs in vibe-coded hackathon-style apps.dev.to ↗
A scan of 155 launched vibe-coded apps found 37% ship a Supabase anon key, so all their data security depends on RLS, and 91% have no Content-Security-Policy. Passive scanning can't prove RLS is on, so deeper checks need owner consent, which Doorknob's submission flow supplies.shipsniffer.com ↗

[ Idea ]Found 12 Nov · 1 YC · 1 private communities · 1 GitHub

Doorknob

Security checks for every hackathon team's app, scored fairly.

Should you build this?Checking

This idea is still going through the six checks.

0 products · 10 sourcesPending

The problem

Teams building apps with AI often ship the same security holes, and event organisers have no practical way to check them all.

Seen in 1 YC · 1 private communities · 1 GitHub

The idea

Doorknob collects every team's live URL with consent, scans them, and publishes a comparable security scoreboard while giving each team private fix steps.

1Organiser creates an event and teams submit their live app URL.
2Each team verifies ownership with a meta tag or file, then the scan runs.
3Teams get a private fix list, and judges see a public grade scoreboard.

[ The six checks ]0 of 6 done

1Not built in alreadyNot checked

2An AI agent can't do itNot checked

3Nothing similar existsNot checked

4People pay for thisNot checked

5Strong scoresNot checked

6Real sourcesNot checked

1 · Not built in alreadyNot checked

2 · An AI agent can't do itNot checked

[ Inspired by ]What it borrows, and what's different

Vibe App Scanner
Scans a live URL for exposed secrets, Supabase RLS and Firebase rules, then gives copy-paste fix prompts. It is single-user and sold per founder. Doorknob is cohort-level: one organiser link, consent and ownership verification per team, a comparable scoreboard, and cross-event baselines.
ShipSniffer
Runs deeper database checks only on sites whose owners verify ownership, and publishes aggregate findings from scanning launched apps. Doorknob turns the ownership-verification idea into an organiser workflow (submission form plus per-team token) for hundreds of teams at once, and sells to the event, not the individual.
Composal (YC Fall 2026)
Swarms of agents that use your product like real users to find bugs before release. Composal is B2B and checks features. Doorknob checks the attacker's-eye security surface of many small AI-built apps at once, for non-technical organisers and judges.

[ Sources ]10 cited

A study of 1,072 Supabase-backed vibe-coded apps found 98% had at least one security flaw, and 16% had a critical one.symbioticsec.ai ↗
A passive scan of about 31k live vibe-coded apps found that 57% of reachable Supabase backends allowed anonymous table reads, and 394 apps exposed tables named after people (users, patients and similar).vibe-eval.com ↗
Veracode's latest report (Oct 30, 2026) says AI code security improved from 56% to 62% passing, but 38% of tasks still produce vulnerable code.securityinformed.com ↗
CVE-2025-48757: about 170 of 1,645 scanned Lovable projects had Supabase Row Level Security misconfigured, exposing user data. The same failure mode recurs in vibe-coded hackathon-style apps.dev.to ↗
A scan of 155 launched vibe-coded apps found 37% ship a Supabase anon key, so all their data security depends on RLS, and 91% have no Content-Security-Policy. Passive scanning can't prove RLS is on, so deeper checks need owner consent, which Doorknob's submission flow supplies.shipsniffer.com ↗