Replayhook

Who it's for

Small SaaS engineering teams and indie integrators who currently debug webhooks using ngrok, webhook.site, or manual logs.

The problem

Time: engineers spend hours reproducing flaky webhook deliveries (out-of-order, retries, truncated bodies, provider signatures) and waste release cycles; legal: some payloads can't be forwarded to third-party debug tools and require redaction; payment: missed webhook failures cause chargebacks/refunds.

How to build it

Browser-hosted dashboard + lightweight CLI webhook sink (single binary) that installs on a staging host or dev laptop; optionally a small hosted collector for users who opt in. Integrates with GitHub/GitLab, Stripe, Slack, Twilio via prebuilt provider parsers and with local HTTP endpoints via the CLI.

How it makes money

Who pays: small SaaS teams, consultancies, and platform integrators. Price: $15/month per seat for hosted collector + unlimited replays or $300/year for a self-hosted license; why they pay: reduces debugging time, prevents refunds/chargebacks, and lets on-call engineers reproduce incidents without escalations; why they won't use a free option: free tools lack signed-replay, timing fidelity, and redaction/compliance features necessary for production-sensitive payloads.

Why it doesn't exist yet

Incumbents (ngrok, webhook.site) only expose raw request capture or a tunnel; they don't model provider retry/timing semantics, re-sign payloads, or offer provenance-aware redaction for sensitive fields. Big cloud debuggers avoid storing real production payloads for legal/wholesale-solution reasons. An indie can ship a focused, privacy-first recorder+replayer that replays exact delivery semantics and re-computes provider signatures while offering per-payload redaction templates that keep teams compliant.

First users

1) Two indie SaaS teams hit by flaky Stripe/PayPal webhooks who need deterministic replay to fix edge cases; 2) One dev tools-focused consultancy whose debugging sessions sell as billable hours; 3) A couple of open-source maintainer projects integrating CI webhooks; 4) a payments integrator who uses replays during on-call; 5) early adopters from Hacker News threads about webhook pain — they adopt because Replayhook saves 1-4 hours per hard-to-reproduce bug and lowers incident MTTR.

Build size

2 people x 8 weeks (backend + CLI + dashboard). Scope includes: provider parsers for Stripe/GitHub/Twilio/Slack/PayPal, a CLI sink to capture and replay to local endpoints, a hosted optional collector, re-signing logic for Stripe-style HMAC signatures, timing/retry scheduler, and per-payload redaction templates. Excludes enterprise SSO billing, on-prem appliance packaging, and >20 provider adapters out of the box.

Biggest risk

A major tunnel/debugging vendor (ngrok or a major cloud provider) ships first-class signed-replay and compliant redaction features as a free tier, removing indie differentiation; or providers change signing schemes to be unreproducible without internal keys.

Conditions for a hit (all 3 required)

• Captured replay bundle: For each captured webhook produce a single gzipped bundle containing raw request bytes, provider name, timestamp, retry index, headers, and a JSON 'delivery manifest' so any replay is bit-for-bit reproducible (observable by downloading a bundle within 1 minute of capture).
• Signed replay: Given a captured Stripe/GitHub/Twilio webhook bundle, the tool can replay to any endpoint within original timing and re-compute the provider signature header (e.g., Stripe-Signature) within 5s of user click, so the receiving server sees a valid signature during replay (observable by verifying the endpoint's signature acceptance during replay).
• Redaction templates with provenance: Before storing or sharing a bundle, the UI shows detected PII fields (credit card fragments, email, SSNs) and can apply a deterministic redaction mask plus an audit log entry; this redaction+audit pair is downloadable and shows which bytes were removed and why (observable by inspecting the redacted bundle and audit log).

How it's judged (in 6 months)

GitHub 1,000 stars or Product Hunt daily top 5 (either milestone qualifies)(judgment date 2027-03-30)

AI self-confidence 60/100 — self-reported likelihood of meeting the criterion, not a business success rate