PizzaLeak

The description states that PizzaLeak is a single Next.js app built with TypeScript, using Supabase (PostgreSQL + Auth + RLS), Mercado Pago for sponsor payments, and a bilingual UI via next-intl. It is described as:

• A platform where security teams can report incidents
• Where sponsors fund a pool to support those teams
• Where pizza vouchers are issued to verified teams during active incidents
• Built with a trust boundary model, where incident authenticity is validated via domain ownership and evidence links (for public incidents)
• Designed with two kill switches for automation vs. human-in-the-loop modes

The product is described as fully automated by design, but defaults to human oversight, with the ability to flip to full automation via a config flag.

Inference The author describes a system that uses magic-link authentication, an incident decision engine, and a ledger-based fund tracking system — but no evidence of actual live usage or real-world integration beyond the prototype.

The description states that PizzaLeak is a "morale-as-a-service for security teams", with the tagline:

“When the breach alarm rings, the pizza arrives.”

It positions itself as a way to recognize and support security defenders during high-stakes incidents, with sponsors backing the effort.

The author claims that the idea was inspired by the lack of recognition for security teams during long, stressful incidents — especially at 2 a.m. when no one has eaten.

They also state that the core challenge was not code, but trust and privacy — that the real product is in how it handles sensitive data and validates incident authenticity.

Inference The positioning is rooted in empathy for security professionals, but the claim of being a service or platform lacks traction evidence. It is framed as a conceptual prototype, not a commercial offering.

The description states that PizzaLeak was launched targeting Argentina first, with plans to roll out across LATAM.

It targets:

• Internal security and infrastructure teams during confirmed incidents
• Sponsors (companies) who want to support defenders
• Security professionals who are often underappreciated

The author notes that the platform is designed to be data-driven for new markets, not requiring code changes — suggesting a multi-market ICP.

Inference The target customer is not clearly defined beyond “security teams” and “sponsors.” No evidence of actual customers or sponsor engagement exists. The ICP appears to be based on the author’s own assumptions, not market validation.

The description states that sponsors fund a shared pool via Mercado Pago, tracked in an auditable ledger, where every peso flows from sponsor_in → fund → pizza_out.

It is described as a pay-as-you-go model, with fulfillment gated by live ledger balance — not blindly promised.

There is no mention of:

• Pricing tiers
• Sponsorship levels
• Revenue streams beyond the initial funding pool
• Monetization strategy beyond the hackathon prototype

Inference The business model is described as funding-based, but there is no evidence of pricing, revenue or monetization beyond the initial sponsor pool.

The project is built with:

• Next.js (App Router, TypeScript)
• Supabase (PostgreSQL + Auth + RLS)
• Mercado Pago for payments
• Magic-link authentication
• Bilingual UI via next-intl
• Serverless architecture

It includes:

• A decision engine that validates incidents
• A fulfillment system that issues pizza vouchers
• A pluggable FulfillmentProvider interface
• Two kill switches (decision_mode, fulfillment_mode) for automation control
• A privacy-first design, including encryption at rest and RLS

The author notes:

• No “order a pizza” API was available, so fulfillment is manual in v1
• The architecture is built around a single trust boundary
• The system is designed to be automated but human-in-the-loop by default

Inference The technical stack is minimal and hackathon-grade. There’s no evidence of production deployment or scalability beyond the prototype.

The description states:

• It was a hackathon project
• It was launched in Argentina first
• It has no revenue, customers or traction data beyond the author's own account
• The team size is 1 person

There is no evidence of:

• Users or sponsors
• Active incidents or pizza deliveries
• Customer feedback or usage metrics
• Product iteration or roadmap

Inference There is no traction or maturity signal. It remains a prototype.

The description does not mention any competitors, nor does it reference existing platforms for:

• Security morale support
• Incident response tools
• Sponsorship or recognition platforms for security teams

It is described as a novel concept, but there is no evidence of market analysis or competitive positioning.

Inference No competitive context is provided. The project appears to be independent of existing solutions in the space, but this is not verified.

• No traction or revenue: The project is described as a hackathon prototype with no evidence of real-world usage.
• Unproven business model: The funding model relies on sponsor pools, but there’s no evidence of sponsors or monetization strategy.
• Privacy and trust risks: The system handles sensitive incident data, but there's no evidence of audits, compliance, or security reviews.
• No scalability or automation evidence: While described as automated, fulfillment is manual in v1, and the system has no live deployment or performance data.
• Single-person team: No evidence of a team beyond one person, raising questions about execution capability.

Inference The project is highly speculative, with no commercial viability or traction to support its claims.

1. What is the actual validation process for incidents? How do you ensure that only real incidents are supported?
2. Have you had any sponsors sign up or fund a pool yet?
3. What is your plan for scaling beyond Argentina and LATAM?
4. How do you intend to monetize this beyond the initial sponsor pool?
5. Are there any privacy or compliance risks in handling sensitive incident data, and how are they mitigated?
6. What is the current status of fulfillment automation? Is it fully functional or still manual?
7. Do you have any feedback from security teams or sponsors yet?