Loopnote
Embeddable customer feedback widget with AI summaries
commit 9f3c1a7d84e2 · tree b41e77c0d9a5
analysed 6 August 2026 · MV-2026.3
Provisional. Bound to commit 9f3c1a7d, it cannot change unless the code does.
- Claims and functionalityDo the advertised features actually exist in the code54 / 100 · C-
- SecurityCan someone reach data or money they should not70 / 100 · B
- Billing integrityDoes the paywall actually hold80 / 100 · A-
- Code quality and maintainabilityHow hard will this be to work on73 / 100 · B
- Tests and CICan you change it without breaking it55 / 100 · C
- Dependencies, licensing and IPCan this be sold and kept running80 / 100 · A-
- Operability and transferabilityCan a new owner run it without the founder65 / 100 · B-
- Provenance and bus factorWhere did this code come from85 / 100 · A
- AI and LLM economicsDo the AI features have a viable cost structure70 / 100 · B
Every tenant-scoped query filters by workspace. No cross-customer path found.
Enforced on the server, but access survives cancellation until the next webhook.
Followed the README on a clean machine and reached a running app in 47 minutes.
3 years of commits with a consistent cadence. Not a fresh dump.
0 critical · 9 high · 8 medium open · 3 of 7 listed features verified in code, 3 of them by running the app
What this is
A multi-tenant SaaS application that collects customer feedback through an embeddable widget and gives teams a dashboard to triage it, with AI-generated summaries and Slack notifications. Built in TypeScript on Next.js with Supabase and Stripe, and deployable by a new owner from its own documentation.
What it does
- Embeddable feedback widgetServes a script customers drop into their own site to collect feedback in a popover.packages/widget/src/mount.ts · apps/web/src/app/api/widget/route.ts
- Team triage dashboardGroups incoming feedback by project and lets a team assign, tag, and close each item.apps/web/src/app/inbox/page.tsx
- AI summariesSummarises a week of feedback into themes on a schedule, and on demand from the inbox.apps/web/src/lib/summarise.ts · apps/web/src/app/api/cron/weekly/route.ts
- Slack notificationsPosts new feedback to a channel the team connects once per workspace.apps/web/src/lib/slack/notify.ts
- Subscription billingSells three tiers through Stripe Checkout and gates project count on the active plan.apps/web/src/app/api/stripe/webhook/route.ts · apps/web/src/lib/entitlement.ts
Read from the code, not from the readme. Each line above cites a file that was checked against the repository at this commit; anything that did not check out is not on this list.
What you are buying
Measured from the repository, free. It costs nothing and proves we read the code.
Languages, by share of code
- TypeScript71%
- SQL9%
- CSS7%
- JavaScript5%
- JSON4%
- Markdown2%
- YAML1%
- Shell1%
- Size
- 34,212 lines
- Deployable services
- 6
- Contributors
- 2
- Estimated AI-authored
- 28% (low confidence)
- Time to a safe change
- About 2 days, mid-level developer
- Stack
- Next.js 14, Supabase (Postgres), Stripe, OpenAI, Vercel
- Third parties
- Stripe · Supabase · OpenAI · Resend · Vercel · Slack
Does it do what the listing says
Each claim from the listing, checked against the code. 7 assessed, 2 shown.
The three biggest risks
- 01HighClaims and functionality
The Jira integration is an email link, not an integration
The listing sells two issue-tracker integrations. You are buying one. Expect to build the other, or to correct the marketing after you take over.
Exact location, evidence, and the fix with an effort estimate - 02HighSecurity
Feedback text is rendered into the dashboard without escaping
Anyone who can submit feedback through the widget can run code in your customers' dashboards. For a product whose whole job is collecting text from strangers, this is the finding to fix first.
Exact location, evidence, and the fix with an effort estimate - 03HighBilling integrity
Cancelled accounts keep paid features until the next webhook lands
Customers who cancel keep using the product, sometimes for days. It is revenue leaking out of the thing you are buying.
Exact location, evidence, and the fix with an effort estimate
A revoked Stripe test key is still in the git history
What it means for you: This particular key is dead, so nothing is at risk today. It tells you secrets have reached the history before, which is worth knowing before you inherit the repository.
evidence.env.example:3· sk_test_51Hn…Qx2, revoked
What we found
A Stripe test secret key was committed in March 2024 and removed in the following commit. It remains reachable in the history, and Stripe reports it as revoked.
How to fix it
No action needed for this key. Add a secret scanner to CI so the next one is caught before it merges, and rotate anything that has ever been committed as a matter of course.
Thirteen further findings, by area
Every finding is written up like SEC-02 above: impact, evidence, fix.
- AI economics2 high
- Billing integrity1 medium
- Dependencies and licensing1 high · 1 medium
- Operability2 high · 1 medium
- Provenance1 high
- Code quality1 medium
- Security2 medium
- Tests and CI1 medium
Fixing 5 things takes this from B- to B+
We know which 5, how long each takes, and exactly where they are. That list is the reason most sellers unlock the report before they list, not after.
You are seeing 4 of 17 findings13 still locked
Each locked one has a location, the evidence behind it, and what it takes to fix.
- The full reportEvery finding with location, evidence, and fix
- A public certificateGraded scorecard bound to this commit, at a link anyone can check
- A prompt for your coding agentOne paste gives Claude Code or Cursor every location and fix
- One fix-and-rescanFix what we found, scan again, keep the better grade