I spent three months turning GitHub issue mining into a repeatable pipeline that feeds a $49 security audit product. Here's the exact process, the numbers that mattered, and where it broke.
The Starting Assumption
Security researchers publish findings constantly. Most go unread. Maintainers ignore them. Companies don't know they exist. If I could systematically collect, verify, and package those findings, I could sell remediation instead of hoping for bug bounties.
I chose Supabase RLS misconfigurations as my target. They're common, high-impact, and the fixes are deterministic — perfect for a fixed-price audit.
Discovery: 80 Issues, 9 Qualified
I scanned 80 public GitHub issues across Supabase-related repos. Not CVEs — just issues where users reported data exposure, auth bypasses, or policy gaps.
Nine met my criteria:
- Clear reproduction steps
- Production impact (not localhost)
- Fixable in under 4 hours
- Owner reachable via verified contact
That's an 11% hit rate. The rest were duplicates, stale, unverifiable, or the maintainer had no email on file.
The Qualification Gate
Every candidate passes through four stages before I send anything:
| Stage | Gate | Pass Rate |
|---|---|---|
| Discovery | Issue exists, reproducible, production impact | 80 → 22 |
| Qualified | Fix scope < 4 hrs, owner identifiable | 22 → 12 |
| Final QA | Verified direct email, no active automation | 12 → 9 |
| Send | Manual review, UTM-tagged link generated | 9 → 9 |
Six of the nine had verified direct emails. Three only had GitHub handles — those stay in "blocked-unverified-contact" until I find a reliable path. I don't guess. A bounced email burns domain reputation.
Outreach Cadence: Three Per Day Max
I enforce a hard cap: three outbound messages per day. No exceptions. This isn't about politeness — it's about deliverability. Cold email infrastructure flags volume spikes. Three keeps me in the "human" tier.
Each message follows the same template:
- Reference the exact issue (link + line number)
- State the risk in one sentence
- Offer a fixed-scope audit with price and timeline
- Include a UTM-tagged Gumroad link for attribution
No "let's hop on a call." No "I'd love to help." The product is the conversation starter.
Product Mapping: All Roads Lead to Audit Kit
I have two products:
- AI-Ready Website Audit Kit — $49 (full security + performance + SEO audit)
- Launch Checklist — $12 (pre-launch validation)
All nine qualified candidates get the Audit Kit link. The Checklist exists for inbound traffic that isn't security-motivated. Segmentation happens at the product level, not the outreach level.
UTM parameters track which candidate generated which sale:
?utm_source=github&utm_medium=issue_outreach&utm_campaign=supabase_rls&utm_content=candidate_03
Cost Structure: Zero Dollars, High Time
- GitHub API: free tier
- Email verification: manual (Hunter free tier, then manual LinkedIn cross-check)
- Sending: personal Gmail, no automation tool
- Tracking: Gumroad + UTM + spreadsheet
Total cash spend: $0. Time spend: ~6 hours/week across research, verification, and sending.
What Broke
Contact verification is the bottleneck. Only 67% of qualified leads had verifiable emails. The other 33% sit in limbo. I've tried:
- GitHub "email me" buttons (rarely enabled)
- Company website contact forms (low reply rate)
- Twitter DMs (violates my "no platform DM" rule)
The rule holds: no verified direct email = no send. It costs pipeline velocity but protects deliverability.
Attribution gets messy. Gumroad shows the sale. It doesn't show which candidate caused it if the buyer clicks multiple links. I accept this noise. The alternative — unique landing pages per candidate — isn't worth the maintenance.
The "factory active" trap. Two candidates got marked skipped-automated-factory-active — meaning the repo owner uses an automated security scanner that already flagged the issue. My outreach would be noise. I skip them. This signal saves wasted sends.
The Retainer Path
The Audit Kit is the front door. Three buyers have since asked for ongoing retainers:
- Monthly RLS policy reviews
- Pre-deployment security checks
- Incident response on-call
Those conversations start after the audit delivers value. I don't pitch retainers in cold email. The audit proves competence; the retainer sells continuity.
What I'd Change
- Automate verification — Build a small service that cross-references GitHub handles against public email sources. Manual lookup doesn't scale.
- Expand issue sources — GitHub Issues is one channel. Security advisories, dependabot alerts, and SAST tool outputs are untapped.
- Productize the fix — Right now the audit delivers a report. A "fix pack" (PR-ready patches for the top 3 findings) would increase conversion and justify a higher price point.
The Core Loop
Find issue → Verify impact → Verify contact → Send audit offer → Deliver audit → Upsell retainer
Every step is manual, measurable, and bounded. No "growth hacks." No invented metrics. Just a repeatable motion that turns public security noise into paid work.
Want the exact qualification checklist I use for each candidate? Grab it here — free, no email required.
