ghostinterview.dev · LIVE
Built for my mom's interview. Then for everyone else's.
An AI interview coach. Type the question you were just asked and get an answer back in under three seconds, in your own voice, built from your resume and your context.
Launched
Jul 2026 · HN + Product Hunt
PH day one
108 visitors · 170 views
SEO pages
20 → 68 in 48 hours
Revenue
$0 · no paying users
The only reason nobody got hurt is that I have zero paying customers. That is luck, not engineering.
01
My mom had an interview. She is a PhD cancer biologist and a Fulbright alumna, and she still wanted to prepare properly, so I built her something that would sit beside her and help. Then I realised the thing I'd made for one person worked for anyone, and put it online.
02
The landing page runs a WebGL particle ghost written from scratch — no library, no helper, nine thousand points that scatter away from the cursor and dissolve as you scroll. I wrote it because I wanted to know whether I could, and the honest answer for a while was no.
03
In July I found my own marketing said five free sessions a day in twelve separate places. The app had been hardcoded to three since the twelfth. Nobody had complained, because nobody had noticed. I rewrote all twelve rather than quietly change the number in the code, and in the same pass I deleted a free-trial button that led nowhere and refused to write a testimonial from a user who didn't exist. Shipping fast is not the same as shipping dishonest.
04
One endpoint took an email address straight off the URL and returned that person's Stripe customer ID with no authentication at all. A second endpoint would take that ID and mint a live billing-portal link. Chained together, anyone who knew a customer's email could read their card's last four digits, their billing address and every invoice, and cancel their subscription. I confirmed it against production with curl before touching anything, then fixed it by verifying the session token server-side on every route, and re-ran all four attacks until each one came back 401. The only reason nobody got hurt is that I have zero paying customers. That is luck, not engineering.
GET /api/find-customer?email=…200no auth header sent
GET /api/create-portal (that id)200live billing portal
What that opened
After
Session token verified server-side, on every route. All four attacks re-run.
GET /api/find-customer401GET /api/create-portal401
Built with
Next
HookForge