IdeaWell

Project ideas from Hacker News discussions.

The Twelve-Factor App (2025)

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

Theme 1 – MFA is painful/unsustainable; many want a single strong factor (passkeys/FIDO2)
- “The problem is the M. Anything beyond a single factor is unnecessarily painful. Make the single factor good (passkeys or FIDO2 or whatever) and the problem is solved without ‘M.’” – loeg
- “MFA as whack‑a‑mole UI sucks.” – browningstreet
- “Every time I leave my phone in the other room to ‘finally get some work done’, please enter this goddamn number we sent to your SMS, and I close my laptop.” – VeninVidiaVicii

Theme 2 – The 12‑Factor App methodology is still relevant and widely referenced
- “Still incredibly relevant. Even if you don’t apply it, there is so much to learn by reading this in 15 minutes.” – nebezb
- “I can’t believe how old this is and I feel like most devs still haven’t internalized this which is a shame.” – superposition
- “Oh! That's a term I have not heard in a long time!” – rietta

Theme 3 – Storing secrets in environment variables is insecure; vaults or workload identities are preferred
- “Secrets should go in a vault and retrieved with the help of a workload identity.” – patmorgan23
- “The env is not a secret store … It's as poor a delivery mechanism as ~/.bashrc is.” – nebezb
- “The environment is a crappy place for config data.” – zbentley

🚀 Project Ideas

Generating project ideas…

PasskeyFirst Auth Broker

Summary

  • Enables passkey‑only login for web applications, removing the need for SMS or authenticator‑app OTPs.
  • Adds risk‑based step‑up (push notification, YubiKey, SMS) only when an anomalous login is detected.

Details

Key Value
Target Audience Developers and enterprises seeking smoother MFA for internal apps and customer portals
Core Feature WebAuthn‑based passkey registration/assertion service with adaptive trust scoring
Tech Stack Node.js (Express) or Go, WebAuthn library, Redis for session state, optional AWS Cognito/Azure AD as IdP backend
Difficulty Medium
Monetization Revenue-ready: SaaS pricing per monthly active user (MAU)

Notes

  • HN users complained that “a passkey should be enough” and despised receiving SMS second factors when a passkey is already available (Passkeys are the right thing but they need more work).
  • Provides a concrete way to replace the painful “whack‑a‑mole” MFA flow with a seamless, device‑bound authentication that still steps up when risk warrants it.

VaultInject – Zero‑Env Secret Loader

Summary

  • Fetches secrets from external vaults (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager) and loads them directly into process memory, bypassing environment variables.
  • Automatically wipes secret buffers after use to prevent leakage via printenv, crash reporters, or child processes.

Details

Key Value
Target Audience Backend engineers building 12‑factor apps who want to avoid insecure env‑based secret handling
Core Feature Library/CLI that retrieves secrets, decrypts them into guarded memory, and provides a getSecret() API returning a zero‑able buffer
Tech Stack Rust (for memory safety and explicit zeroing) or Go with securezero utilities; sidecar model for Kubernetes; integrates with common vault SDKs
Difficulty High
Monetization Hobby (open‑source core) with optional paid support/enterprise tier

Notes

  • Commenters warned that “the environment is a crappy place for config data” and that secrets injected into env are easily leaked via diagnostics tools.
  • VaultInject directly addresses the desire for “secrets should go in a vault and retrieved with the help of a workload identity” while keeping the developer experience simple.

ContextAware MFA Gateway

Summary

  • Learns each user’s typical login context (device, location, time) and treats known‑good contexts as trusted, skipping MFA.
  • Acts as an OIDC/SAML broker in front of existing IdPs (Okta, Azure AD) and inserts step‑up only when the login deviates from the learned pattern.

Details

Key Value
Target Audience Enterprise IT admins and end‑users who juggle many MFA prompts daily
Core Feature Adaptive trust engine that reduces MFA friction by remembering trusted devices/sessions
Tech Stack Python/FastAPI, Redis for session storage, scikit‑learn or simple rule‑based scoring, Docker container for easy deployment
Difficulty Medium
Monetization Revenue-ready: per‑seat monthly subscription

Notes

  • Users described the pain of “leaving my phone in the other room” and wanting to “use my work PC as a trusted device” to avoid repetitive MFA.
  • This gateway would let trusted machines bypass the SMS/app step, cutting down on the “3‑10 variations of workflows” that frustrate power users.

Read Later