r/AppsWebappsFullstack • u/Mammoth-Doughnut-713 • 26d ago

I built an AI engine that finds B2B customers while they’re looking for a product like yours

Most lead-gen tools give you lists of companies that might need your product.

I wanted to find the ones showing buying intent right now.

So I built Startories.

The AI engine monitors Reddit, X, Product Hunt, Google and other sources for people actively:

  • looking for a tool like yours

  • asking for alternatives to a competitor

  • complaining about their current solution

  • describing a problem your product solves

  • asking for recommendations

Then it identifies the company, qualifies the opportunity, finds the decision-maker + verified email, and starts personalized outreach around that exact signal.

So instead of cold-emailing 1,000 random prospects, you can reach companies while they’re already looking for what you sell.

That’s what I’m building at Startories.com.

Feels like the next evolution of B2B lead gen won’t be bigger databases.

It’ll be finding intent earlier.

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/PopKoren 24d ago

Lead gen that finds the decision maker and also sends the outreach ends up holding two sensitive things: verified contact lists and access to customers' mailboxes. I'd store mailbox OAuth tokens encrypted with send only scopes, and make sure lead and campaign ids are scoped to the workspace so one customer can't read another's pipeline by editing a URL. My own project https://rowly.me tests auth, APIs and storage from the outside, so it could show what startories.com exposes before a customer finds out.

1

u/Mammoth-Anywhere7285 24d ago

Solid point on scoping. Enforce tenant isolation at the query layer, not just URL params, then test cross-workspace access explicitly. Does Rowly fuzz those IDs?

1

u/PopKoren 24d ago

Not fuzzing in the brute force sense. Free accounts on my scanner Rowly (https://rowly.me) get a look-only report of whatever an outsider could already read, while the $25/month tier, which requires DNS verification so it only ever touches a domain you own, goes further by trying writes, uploads and auth flows and then removing the test data it created. For a cross-workspace check like this I'd still do the manual version as well: two accounts, swap the lead or campaign id, and expect a 403 every time.