Atlas Ledger — Launch readiness review

Atlas Ledger is a bookkeeping copilot for indie SaaS founders running $0–$50k MRR. The product is structurally sound and aligned with a clear, urgent problem. Two critical security findings remain open, both fixable inside a single development cycle.

Value proposition. Replace bookkeepers with an AI copilot that closes the month in 12 minutes.

Target users. Solo SaaS founders doing $0–$50k MRR; fractional CFOs managing 8–15 startup clients.

Launch surface. Web first, investor demo ready. Android out of scope.

• Frontend: React + TanStack Router
• Backend: Node edge functions
• Database: Managed Postgres with RLS
• Payments: Stripe Billing (subscription)
• Auth: Email + Google OAuth, 15-min token TTL
• Deployment: Edge CDN, regional failover

• RLS missing on profile table — exposed to anonymous queries.
• AI key shipped in client bundle — rotate and move to server function.
• Stripe webhook signature unverified — replayable events possible.
• Public storage bucket — move to signed URLs.

The founder is seeking introductions to two beta customers in the EU VAT bracket, and a fractional security reviewer for a one-week pre-launch hardening pass.

• 30 days: closed beta with 20 founders; Stripe and Mercury import.
• 60 days: public launch; QuickBooks export.
• 90 days: multi-entity; EU VAT module.