PadHold

Who it's for

Security/compliance leads at 50-5,000 person aerospace, defense, and dual-use hardware companies whose developers already run Cursor; today they cope with raw firewall logs, one-off mitmproxy sessions, or banning the editor outright.

The problem

Legal: after the SpaceX acquisition, proprietary code context transits the corporate family of a direct competitor, which is an ITAR/CUI and conflict-of-interest problem they must answer with evidence, not vibes. Time: manually attributing proxy logs per developer per feature is hours of guesswork per audit.

How to build it

macOS+Windows menu-bar app that installs a local TLS proxy with a user-approved CA, writes a local per-request ledger, offers a maintained SpaceX-endpoint blocklist toggle, and exports signed PDF+JSON attestations; optional webhook for weekly team rollups. No code content leaves the machine.

How it makes money

Team licenses at roughly $150/dev/yr with a $1,500/team minimum, paid because the alternatives are banning a tool engineers already rely on or flying blind into an export-control finding; free mitmproxy can't attribute traffic per editor feature or produce a signed audit-ready ledger.

Why it doesn't exist yet

Incumbents skip it: Cursor cannot credibly audit or restrict its own parent company's data flows, and DLP vendors (Zscaler, Netskope) sell generic egress proxies but won't reverse-engineer one editor's per-feature semantics for a niche this size. The indie gap: one developer with mitmproxy and protocol patience can ship the attribution layer in weeks and ride the acquisition news cycle straight to the buyers who feel the conflict first.

First users

Security engineers at launch/space/defense firms (Rocket Lab, Blue Origin, NASA prime contractors) who read HN — the launch post writes itself — plus ITAR compliance consultants who need client-ready evidence and each bring 2-3 client companies.

Build size

2 people x 10 weeks: includes the local proxy, per-feature traffic attribution for Cursor on macOS+Windows, the SpaceX-endpoint blocklist, and signed PDF/JSON export; excludes Linux, MDM fleet deployment, SIEM integrations, and support for other AI editors.

Biggest risk

Cursor ships a native enterprise admin dashboard with egress audit logs and endpoint allowlisting (they already sell privacy modes, so this is a plausible fast-follow), collapsing the case for a third-party tool; secondary risk is cert-pinning changes that break interception.

Conditions for a hit (all 3 required)

• Produces a per-request ledger covering 100% of one Cursor install's HTTPS traffic with timestamp, destination host, byte count, and the triggering feature (autocomplete, chat, or codebase indexing), browsable per developer per day.
• Ships a maintained blocklist of SpaceX-controlled domains/ASNs and, when enabled, denies matching requests while showing each blocked event with timestamp and byte size.
• Exports a date-ranged, cryptographically signed attestation (PDF plus machine-readable JSON) enumerating every host that received code context from that machine, formatted to attach to an ITAR/CUI audit file.

How it's judged (in 6 months)

A public launch of this shape with either >=500 GitHub stars or Product Hunt daily top 5, verifiable by 2027-03-02(judgment date 2027-03-02)

AI self-confidence 45/100 — self-reported likelihood of meeting the criterion, not a business success rate