DangleWatch

Who it's for

Maintainers of open-source infrastructure (SondeHub-scale civic/science projects) and 1-50-person SaaS teams whose repos, docs, printed QR codes, OAuth callbacks and webhook URLs reference third-party domains. Today they run one-shot subdomain-takeover scripts (subjack) and HTTP link checkers, and get registrar reminders only for domains they themselves own.

The problem

Legal/security: a lapsed referenced domain is a supply-chain hijack — polyfill.io served malware to 100k+ sites, researchers who registered expired endpoints received live webhook traffic with credentials, and the 696-point SondeHub story shows a single joke-domain lapse escalating to geopolitical leverage. One hijacked reference can force breach disclosure, emergency re-releases, and printed-material recalls.

How to build it

CLI + GitHub Action that extracts external domains from code, package manifests, docs and CI configs with file:line citations; hosted dashboard doing daily RDAP polls, registrant-hash diffing and expiry countdowns; email/Slack alerts plus a weekly digest and public per-domain history page.

How it makes money

Free CLI scan as lead-gen; hosted continuous monitoring at $20/mo per org (up to 500 referenced domains) and $99/mo for agencies with client portfolios — they pay because the free snapshot can't do daily state tracking and alerting, and because one hijacked webhook/OAuth domain is a breach-disclosure event that neither registrars nor link checkers will catch.

Why it doesn't exist yet

Incumbents split the problem three ways: registrars monitor only domains you own; link checkers only fetch HTTP status; attack-surface platforms scan your assets, not your outbound references — so 'domains you depend on but don't control' has no watcher. The indie gap: RDAP polling of a few hundred domains per org is cheap, rate-limited, thin-margin work the big scanners skip, and the SondeHub thread just made the blast radius obvious to exactly the right buyers.

First users

The 696-point SondeHub HN thread is a self-selected audience of infrastructure maintainers saying 'we should audit our dependency domains'; ship the free CLI into that tailwind as a Show HN, and the first 10 are open-source projects in that thread plus commenters' employers who want the always-on hosted monitor.

Build size

1 person x 6 weeks. In scope: URL/domain extraction (tldextract + manifest parsers), RDAP status/expiry polling with registrant-hash diffs, GitHub Action, email/Slack alerts, per-domain history page. Out of scope: multi-provider CNAME takeover fingerprinting, HTTP content diffing, takedown or domain-recovery assistance.

Biggest risk

GitHub ships 'referenced-domain health' natively inside code scanning or Dependabot alerts, making a standalone monitor redundant for the exact repo-centric buyers this bet depends on.

Conditions for a hit (all 3 required)

• Given a public GitHub repo URL, returns within 5 minutes a complete inventory of external domains referenced in code, package manifests, docs and CI configs, each with file:line citations — verifiable against a published ground-truth test repo containing at least 50 planted domains.
• Shows for every referenced domain its RDAP registration status, expiry date and registrant-hash, refreshed daily, on a public per-domain history page.
• Delivers an email or Slack alert within 24 hours when a watched domain enters redemptionPeriod/pendingDelete or its registrant-hash changes, demonstrable on a public test domain the project lets lapse during the judging window.

How it's judged (in 6 months)

A public GitHub repo matching the shape with 1,000+ stars, or a Product Hunt daily top-5 launch, or documented adoption in the security docs of at least 3 notable open-source infrastructure projects(judgment date 2027-02-20)

AI self-confidence 35/100 — self-reported likelihood of meeting the criterion, not a business success rate