-
-
commonswift.io — agency-grade brand protection, founder-sized price.
-
CommonSwift AI — just ask, instead of digging through threat reports.
-
CommonSwift Dashboard
-
Brand-abuse detection, evaluated by AI — bounded by rules.
-
Findings — all your threats in one view, with evidence attached.
-
CommonSwift Radar: look-alike domains and phishing pages, caught as they appear.
-
Monitored domains — each with its own watch list of brand terms; scans on demand, Radar always on.
-
CommonSwift Logo
Inspiration
If someone registers a look-alike of your brand tonight, you find out when a customer gets scammed. Big brands pay monitoring agencies six figures a year to watch for this. A founder with one domain has nothing. That gap is the company.
What it does
CommonSwift is brand protection that runs itself. It watches certificate transparency logs — the public record every new HTTPS domain writes itself into — flags candidates that resemble a customer's brand, gathers screenshot evidence, classifies threats with Gemini, and drafts the takedown. It sweeps every fifteen minutes on Cloud Scheduler, in production, right now. Built on Cloud Run, Firestore, Secret Manager, Cloud Storage, Cloud Tasks, and the Gemini API.
How we built it
One human and two AI roles, with an explicit division of labor.
Claude Code is the engineering department. It writes the code, runs the 3,000+ test suite, watches production, and reports with Firestore paths and log lines as receipts. It does not deploy on its own initiative — releases wait for a human GO; the final deploy of the build required literally two words from me before it shipped.
A second AI role holds the rulings. Plans, scope decisions, and refusals go through it. When I propose something off-plan at midnight, its job is to say no and point me back at the checklist. It said no more than once this week, and it was right each time.
The product repeats this structure. Gemini classifies every candidate site — but Gemini does not set severity. Deterministic rules do: a brand asset plus a login form on a domain that isn't yours is HIGH, and the model cannot argue it down. Gemini proposes; rules dispose. Events the rules don't recognize fail closed into a review queue rather than reaching a customer. Every agent action writes an audit line recording what the model proposed, what the rules published, and which floor fired. There is no send capability in the codebase: takedowns are drafted by AI and sent by a human.
A note on the clock: this entire business — detection engine, multi-tenant dashboard, autonomous scheduling, payments, and entitlement — went from first commit to revenue-ready production in roughly the final five weeks of the 90-day window, by one human and two AI roles. The git history judges hold is the receipt. We are not claiming speed as a virtue in itself; we are claiming it as the point: operations that used to take an engineering department were written as rulings in plain English and executed, reviewed, and refused-when-wrong by AI agents. The velocity is the thesis, demonstrated.
Challenges we ran into
The night before submission, a real customer paid ₹4,199 and the payment webhook rejected every delivery — the stored webhook secret had one trailing byte too many, so the signature check refused everything, exactly as designed. The AI diagnosed it from logs in minutes and proposed the fix; I rotated the secret and approved the one-revision deploy; the customer was granted through the audited manual path twenty minutes after paying. The next two payments — including a $49 USD subscription from Sri Lanka — were granted fully automatically by the fixed webhook. The boundary held, the recovery was audited, and the fix is proven in production.
Accomplishments that we're proud of
Revenue is real and honestly labeled. Two independent customers pay today: an Indian firm on Protect (₹4,199/month) and a Sri Lankan customer on Protect ($49/month USD). My own ₹2,499 subscription — a live test of the payment path with real money — is reported as a separate related-party line in the P&L, not mixed into sales. Marketing spend to date: zero, disclosed as zero.
Beyond the founding team, the design creates work rather than only removing it: the fail-closed review queue is built to be staffed by human analysts as volume grows — a paid role that exists precisely because the system refuses to guess; drafted takedowns create paralegal-style work; and the concierge recovery path we exercised this week is a human service a customer already paid for. Directly, small brands that could never afford an agency get agency-grade protection, which protects their revenue and the jobs behind it.
What we learned
AI in production is trustworthy in proportion to what it is not allowed to do. Everything that matters here — severity floors, signature checks, fail-closed routing, human-gated deploys — is a constraint. The constraints are why a one-person company can sell trust.
What's next for CommonSwift
More brands per customer, human analysts on the review queue as volume grows, and takedown delivery as a tracked concierge service — the same pattern throughout: AI does the work, rules bound it, humans hold the judgment seats.
Log in or sign up for Devpost to join the conversation.