Omnivetted

Version one, and why it had to change

The first version was a directory of AI tools fed by an automated pipeline: scrape a site, ask a model to write the listing and assign a score, extract a preview image, publish. It worked, and that was the problem. Hundreds of identical directories work the same way, the “benchmark scores” had no method behind them, and it is exactly the kind of site that Google’s quality updates keep demoting.

In October 2026 I stopped adding listings and made a decision: keep the code, domain and database, change what the site promises. Omnivetted is now a review site for a narrow niche (web scraping, proxies and data APIs, then hosting and databases for side projects), written by someone who actually pays for the tools, with real pricing and a “don’t buy this if…” section in every review. The automated generator still runs, but it only produces drafts that a human edits or discards.

What is in the codebase

The platform side was already substantial before the pivot: GitHub and Google sign-in through Supabase Auth, a member dashboard (saved and upvoted tools, submissions, orders), community reviews, a newsletter, a comparison page, and an admin console for approving tools and editing content. Paid listings are sold through a crypto checkout (NOWPayments), and transactional email goes through Brevo.

The affiliate layer I added for the new direction is small but careful: every outbound link goes through /go/{slug}, which validates the slug, picks the affiliate URL if one exists, records the click without storing raw IPs, and redirects with noindex and rel="sponsored nofollow". Click stats are exposed to the admin through a SECURITY DEFINER function so the raw table never has to be readable. A disclosure component sits on every page that can contain an affiliate link.

The audit

Before touching the direction I did a full pass over the existing code and fixed what I found:

• The payment webhook now verifies the provider’s HMAC signature, order verification matches on order ID and amount, and prices are decided on the server rather than taken from the client payload.
• Row Level Security was rewritten across four scripts: public reads limited to vetted tools, score and upvote columns no longer writable from the browser, newsletter writes moved behind a service-role API route.
• The admin allow-list moved out of the HTML, blog Markdown is sanitised before render, and every piece of user-provided text that reaches innerHTML or an email template is escaped.
• Copy that claimed numbers nobody had measured (“5,000+ developers”, “empirical benchmarks”) was removed or replaced.

Sharing a database with another product

Omnivetted and spillpromo.id run on the same self-hosted Supabase instance. That forced some discipline early: prefixed table names, a written list of which SQL scripts have run in production, and an RLS audit script that is re-run after every schema change. It is also the subject of one of the reviews I am writing.