AdShield — AI Ad-Policy Risk Checker - Sell Project

A finished, deployed SaaS for advertisers who can't afford an ad account ban. Users paste ad copy, a landing page URL, or account settings; AdShield returns a risk score, the specific policy rules at issue on the targeted platform, the phrases that trigger them, and a rewritten version that passes. Built as a complete product, not a prototype: auth, subscription billing, usage quotas, check history, and an admin analytics view are all implemented and working. Free tier is 3 checks a month; Pro is $19/month. What's built: a two-layer analysis engine (a 34-rule deterministic layer grounds an OpenAI pass, with severity floors so a critical finding can't be averaged away); 66 policy rules across Meta, Google Ads and TikTok, each with the platform's rule text, enforcement consequence, and a deep link to the live policy page; full SaaS scaffolding (auth with password recovery, Stripe subscriptions with webhooks and customer portal, usage quotas, check history with privacy-respecting erase, founder-only admin analytics); and a marketing site with pricing, FAQ, and a public policy browser. Tech stack: Next.js 14 (App Router) + TypeScript strict mode, Tailwind + hand-written shadcn/ui over Radix, Supabase (Postgres/auth/RLS), Stripe, OpenAI gpt-4o-mini ($0.0004/check), deployed on Vercel, dependencies pinned to exact versions. Verified, not just claimed: the AI engine works in production (live demo). Scoring is calibrated and regression-tested (npm run engine:demo). The database was attacked with a 38-assertion suite that found and fixed 5 real vulnerabilities including 2 revenue bugs. All 66 policy links are HTTP-checked (npm run check:links). Citations are guarded to be platform-correct. No server secret reaches the browser (verified by bundle grep). A pre-listing security review found and fixed 4 real issues (paywall bypass, an SSRF with a 19-payload regression suite, a spoofable rate-limit key, an open redirect), plus a quota race and a webhook ledger gap, both fixed at the database level. Disclosed up front: Next.js is pinned to 14.2.35 patching a known middleware-bypass CVE. npm audit shows one critical and one high advisory inside Next.js itself (AVIF image-optimizer RCE, postcss source-map issues) — neither path is reachable in this app (no next/image, no images config, no uploads; postcss is build-time only). Upgrading to Next 16 clears both and is a clean post-sale task. Full detail in the README's security section. No users, no revenue, no traffic. This is a finished, tested codebase and a working deployment, sold as an asset, priced accordingly. What's included: full commented source, README (architecture + engine design), DEPLOY.md, hardened idempotent supabase/schema.sql, test suites (engine calibration, database security, policy link checking), and transfer of the Supabase and Vercel projects. What the buyer still needs to do: swap in their own Supabase/Stripe/OpenAI/Vercel accounts, move Stripe to live keys, add a transactional email provider (Resend/Postmark), have a lawyer review the privacy policy/terms templates, and point a domain at it. Ideal buyer: someone already selling to performance marketers — an agency, media-buying community, or ads tool with an audience — who can put this in front of users on day one. Live demo: https://adshield-swart.vercel.app