Show HN: I built a SaaS without knowing how to code – am I an idiot?

It's called learnfrom.co, a platform for creating, hosting and selling online courses.

I started building it because I wanted to solve a problem I had with existing course platforms. I kept running into things I wanted to change, so I started building them myself.

The problem: I wasn't really a software engineer.

Instead, I started using AI to build the product. I'd describe what I wanted, let it write the code, test it, fix things when they broke, and repeat.

That somehow turned into a real product. LearnFrom is now used by 100+ creators and businesses, with real students and real payments going through it.

And that's where I'm starting to get uncomfortable.

"It works" and "it's well engineered" are obviously not the same thing.

So I'm bringing it to HN to find out how much trouble I'm actually in.

If you were reviewing this before I'd let more customers depend on it, what would you look for first?

Security? Authentication? Authorization? Data isolation? Payments? Architecture? Performance? AI-generated code? Something I haven't even thought about?

Please assume I'm guilty until proven innocent.

Show HN: I built a SaaS without knowing how to code – am I an idiot?
learnfrom.co

For context: I can read and understand some HTML and CSS, but beyond that I really can't code.

I started building LearnFrom by describing what I wanted to AI, letting it write the code, testing it, fixing what broke, and repeating the process.

Somehow, that turned into a real SaaS used by 100+ creators and businesses.

And now I'm wondering whether "it works" is a very dangerous substitute for "it's well engineered."

That's what I'd like HN to help me figure out.

I’ll start with saying that I think it’s good you’re asking about this. A lot of things are possible these days with all these AI tools, but they don’t solve the problem of unknown unknowns.

I think the most honest thing I could say is that it’s almost certainly not “engineered well” but there’s nuance to that. The most important bit is that it almost certainly has at least one vulnerability or issue that could lead to a whole host of problems for both you and your users. Given, that’s true of all code, but without being vetted by someone who knows what to look for there’s a much higher chance some low hanging fruit was missed.

If it’s safe and secure and actually works, then the rest doesn’t matter so much. Not saying it’s gotta be Fort Knox, but even the smartest models can easily miss something that an experienced human wouldn’t.

I would strongly recommend hiring an experienced developer to at least audit it. Will be a lot cheaper than an out of control cloud bill or worse, lawsuits.

I commend you for opening yourself up to potential torment here for the sake of your product and its users, but a) nobody is gonna do it for free and b) even if they did, well, you get what you pay for!

I actually asked Claude to audit the codebase specifically for security vulnerabilities. It found a few things and I fixed them, but I'm very aware that asking another LLM to check the LLM-generated code might be the software equivalent of asking the fox to inspect the henhouse.