Phishproof

• 

  desktop phishproof

Inspiration

The rise in phishing attacks, especially targeting small and mid-sized businesses, inspired us to build a simple, effective tool that helps teams test and improve their resistance to email-based social engineering. Many companies don't have the time or resources to implement enterprise-grade security awareness platforms, so we aimed to deliver a streamlined Micro-SaaS solution that's fast, affordable, and intuitive.

What it does

PhishProof is a lightweight platform that allows businesses to: Schedule and send simulated phishing emails to employees Track who clicked, reported, or ignored the emails Generate reports to assess risk and monitor awareness over time Customize email templates with their own branding (on paid plans) Each user gets their own private dashboard, where they can manage recipients, view test performance, and upgrade plans — all with zero technical setup. Schedule and send simulated phishing emails to employees

How we built it

Frontend: Built using [Bolt] and hosted on Netlify, with full responsiveness and clean UI components.

Backend/Auth: Powered by Supabase (PostgreSQL, Supabase Auth, RLS-secured profiles).

Payments: Integrated with Stripe for subscription billing and plan management.

Domain & Routing: The app is deployed on app.toscatek.it and the phishing test tool lives on phishproof.toscatek.it.

Email Templates: Custom HTML email templates for signup, magic link, invite, and more — styled with logos and Italian localization.

Challenges we ran into

Row-Level Security (RLS): Configuring secure per-user data access in Supabase was tricky, especially while avoiding organization-based models.

Email Template Rendering: Ensuring email templates worked across clients and supported logos and responsive layouts took a lot of iteration.

Multi-plan Logic: Mapping Stripe subscriptions back to Supabase in real-time via webhooks required robust error handling and plan sync logic.

Accomplishments that we're proud of

We built a fully functional, secure SaaS in record time — including authentication, billing, and multi-user logic.

Clean, branded email templates in Italian were custom-coded for each Supabase trigger.

We avoided bloat by shipping only the features most small businesses need, making the tool lean and intuitive.

What we learned

Supabase + Stripe is a powerful stack, but requires careful integration when handling authenticated workflows.

Bolt can accelerate development, but clear instructions and modular thinking are critical to avoid bugs or scope creep.

Micro-SaaS projects thrive when you focus on one pain point — phishing awareness — and execute it very well.

What's next for website

Add team support (multi-user access under one account)

Integrate phishing awareness training modules for those who fail tests

Allow custom domains and branded senders (e.g., [email protected])

Expand analytics with click heatmaps and delivery metrics

Offer yearly billing discounts and better usage-based scaling

Built With

• api
• supabase