Inspiration
I've spent 15+ years in independent music, A&R and creative strategy, and I've watched good records disappear because nobody heard them in the first few weeks after release, which is exactly when every platform decides what to push. The tools available to independent artists are usually tied to one distributor, or they're scams selling "guaranteed streams" that get songs removed. I wanted to build the release team that independent artists can't afford.
What it does
DropRadar takes a song's genre, mood, tempo and story and:
- Matches it with playlists, blogs, creators, DJs and communities, scoring each one for fit and writing a personal pitch for each
- Plans a 30-day rollout, from four weeks before release to a month after, with every step explaining why it matters
- Creates content: captions, short-form video ideas and hashtags
- Captures fans through a smart link that sends listeners to any platform and collects their emails, so artists own their audience
- Tracks results by day, platform and traffic source
- Protects the release with a scam-promoter scanner, fake-stream spike alerts and an account security checklist
How I built it
I defined the product, features and security requirements, then directed the build using AI-assisted development with Claude Code.
- Back end: Node.js and Express with SQLite
- Front end: HTML, CSS and vanilla JavaScript, mobile-first with light and dark modes
- Hosting: free on Render, with the code on GitHub
Coming from a cybersecurity background (CompTIA Security+ studies and prior identity and access management work), I made security a core requirement:
- Passwords hashed with bcrypt, and accounts locked after 5 failed sign-ins
- Secure HttpOnly, SameSite session cookies and CSRF protection
- A strict Content Security Policy and escaping of all user input to prevent XSS
- Access controls on every request so users can only see their own data
- Smart links that can only redirect to real platform domains, preventing phishing redirects
- Rate limiting and an activity log of sign-ins and security events
Challenges
The biggest challenge was ethical, not technical. My first idea guaranteed artists 1,000 streams per platform. Researching platform rules showed that guaranteed streams count as artificial streaming, which can get songs removed and royalties withheld. I redesigned the product around real listeners only and turned fake-stream detection into a feature.
I also had to keep the whole project free to build and host, so the matching and writing engine runs on rules I designed instead of a paid AI service. It's built so a real AI model can be added later.
What I learned
- How streaming algorithms reward early saves, replays and shares, and why bought streams backfire
- How to turn an idea into a working full-stack app by directing AI tools with clear requirements
- How to apply security concepts I'm studying, like access control, session security and input validation, to a real product
- How to scope a project to what can be built well, and leave the rest for a roadmap
What's next
- AI-powered genre tagging and pitch writing
- A real curator directory where outlets opt in
- Email delivery for fan lists and plan reminders
- Two-factor login for DropRadar accounts
- A pilot with independent artists
Built With
- bcrypt
- claude-code
- css3
- express.js
- github
- helmet
- html5
- javascript
- jwt
- node.js
- render
- sqlite
