Built a scanner for AI-written code on the side. 7 months in: 500 users, 5,000 scans

Started VibeDoctor in February, nights and weekends next to a full-time job. It connects to a GitHub repo written with Cursor, Claude Code or Copilot and reports what the AI got wrong: leaked secrets, imported packages that don't exist on npm, Stripe webhooks with no signature check, dependencies with known CVEs. Findings only. Your own AI tool does the fixing. Where it is today, Stripe-verified on TrustMRR: 500 users, 143 GitHub App installs, 5,000+ scans, 9 active subscriptions, $108 MRR. The first four months were $0. What got the first paying customer: removing the free account tier. The scan still runs and shows how many critical and high findings you have. File paths and details sit behind a card. With a free tier, people took the diagnosis and left. What didn't work at all: scanning public repos and posting the results. Zero paying customers from that. Biggest lesson: activation was never the problem, every signup completes a scan. Getting someone from "I see 6 critical findings" to paying to see where they are is 2.6% lifetime. That is the whole game now. Scan is at vibedoctor.io. Ask me anything about the paywall or the scanner setup.