EdgeWitness

Who it's for

Indie web agencies and EU SME site operators fronted by Cloudflare or similar CDNs; today they cope with one-off scans (Webbkoll, Blacklight), manual curl diffing, or CMP cookie scans that cannot say what their own CDN added.

The problem

Legal: GDPR Art. 30 and consent disclosures must list every third-party script and processor, so one silently injected CDN script makes the published privacy policy factually wrong; time: nobody runs daily rendered-DOM diffs between origin and edge by hand.

How to build it

Web app: DNS-token-verified site onboarding, daily multi-vantage fetch plus headless-browser render diff of HTML/headers/cookies, a signature database of known edge injections, email/Slack alerts, monthly PDF/CSV ledger.

How it makes money

Web agencies pay $29–$79/month to monitor 5–25 client sites, because the injector-attributed monthly ledger is client-reportable compliance evidence their CMP doesn't produce and a DIY cron diff neither renders JavaScript nor attributes known injection signatures.

Why it doesn't exist yet

Incumbents skip it: Cloudflare won't build a tool whose job is naming Cloudflare as the injector, and consent-management platforms monetize banners and scan from the outside only, so they can't distinguish what you deployed from what your edge added. The indie gap: with owner-granted origin access, a tiny team can do the origin-vs-edge diff and injector attribution that neither CMPs nor malware scanners attempt.

First users

The 217-point HN thread on Cloudflare's silent analytics injection is a primed audience; a Show HN with a live demo diffing a real Cloudflare-fronted domain, plus EU agency and privacy-engineering newsletters, lands the first 10.

Build size

1 person x 7 weeks. Included: DNS-verified onboarding, daily fetch+render diff from 2 vantage points, ~20-signature attribution DB, email/Slack alerts, monthly PDF ledger. Excluded: blocking or removing injections, cookie-banner generation, mobile-app monitoring.

Biggest risk

Cloudflare stops silently injecting (or ships a prominent off-switch), and a CMP like Cookiebot adds injector attribution to its scanner — either event collapses the anger and the differentiation at once.

Conditions for a hit (all 3 required)

• Adding a domain requires proving origin control via DNS TXT or origin-only header token; the service then fetches each monitored page at least daily from at least two network vantage points and stores both origin and edge copies.
• When the edge copy contains a script, cookie, or header absent from origin, the user receives an email or Slack alert within 15 minutes naming the injected asset URL and the identified injector (e.g., 'Cloudflare Web Analytics'), with before/after evidence attached.
• A monthly downloadable PDF/CSV ledger lists every third-party asset observed on the edge with first-seen/last-seen dates and injector attribution, formatted for GDPR Article 30 records.

How it's judged (in 6 months)

Show HN post for the product scoring >=100 points OR Product Hunt daily top 5, with a public demo page diffing a real CDN-fronted domain and a public pricing page(judgment date 2027-02-17)

AI self-confidence 40/100 — self-reported likelihood of meeting the criterion, not a business success rate