DEV Community: 李成斐

Your NDA Went Out Yesterday. Can You Prove It Was Seen?

李成斐 — Sat, 19 Sep 2026 11:31:14 +0000

Your NDA Went Out Yesterday. Can You Prove It Was Seen?

The quiet liability in every legal delivery

Every lawyer knows the feeling. The NDA goes out by email. The counterparty's counsel confirms receipt in principle. Two weeks later they say, "We never received final terms" — or worse, they act on a draft that was superseded, and suddenly the question is not who was right, but what can you prove.

For law firms, independent counsel, and in-house legal teams, document delivery is not just communication. It is the factual record a dispute or a negotiation later depends on. And plain email gives you almost none of it: no proof of open, no record of what version was actually seen, no way to claw a superseded draft back once it has left your outbox — no version record, no document tracking, no way to prove what was seen.

What a lawyer actually needs from a send

Not "did the email get delivered" — that is 2006 technology. What matters for legal work:

A timestamped record of access. When a tracked link is opened, and how the recipient engaged — a factual footprint that outlives the "I never saw it" conversation.
Proof of which version was seen. You send v2 of the terms. If the other side only ever opened v1, you know exactly what they were looking at — and you can prove the superseding version was delivered.
The ability to take it back. Revoke a link the moment a draft is obsolete or a negotiation ends. Disable download so a not-for-distribution draft cannot circulate beyond the intended recipient.
Traceable onward movement. When your NDA or term sheet is forwarded onward, the record shows whom it went to and when — so you can see that the review process has actually started.

None of this replaces a signature or a formal notice. But it replaces the black hole between "sent" and "signed" with a verifiable record.

How a tracked delivery works

DocTrail is document tracking built for high-stakes sends:

Upload the NDA, term sheet, or contract (PDF, DOCX, XLS, PPT, MD, TXT, HTML — up to 100 MB).
Share a tracked link to the specific recipient. They open it in a browser — no account, no plugin, no friction that would make opposing counsel refuse to click.
Watch the record form. Open time, reading depth, revisit — each event logged on your side, retrievable when the "did you get it?" conversation happens.

Control stays with you throughout: revoke a link when terms are superseded, toggle download off for drafts, and keep a clean per-recipient history for every matter.

The 2 AM email that never happens

The value shows up in the moments you cannot plan:

Illustrative example of DocTrail's dashboard output — not a real client result.

Opposing counsel claims the latest draft was never received. Your record shows the tracked link was opened 11 minutes after you sent it, and read through the revised clause — with a timestamp.
A draft that was marked "not for distribution" starts circulating. You revoke the link and the download is disabled — the exposure stops where your control begins.
A client asks "did they actually see our revised terms before signing?" You do not say "I think so." You say "opened Tuesday at 14:05, read through page 6, and returned once more before close."

That is the difference between running a legal practice on records and running it on recollection.

Proven category, priced for a practice

Document tracking for high-stakes documents is established — DocSend was acquired by Dropbox for $165M (2021), and open alternatives like Papermark confirm durable demand. DocTrail applies the same idea to the documents where the record matters most — here's how document tracking works for sensitive documents.

Pricing is monthly: Pro $14 · Team $42 · Enterprise $99 per month. Annual billing at 10 months' price (2 months free) is available for firms that run matters year-round.

Try it free

Reply to request a free 30-day Pro trial — we'll set you up within 24 hours.

Next time you send an NDA, do not hope it was seen. Have the record.

— I'm one of the makers behind DocTrail.

Sent Your Deck to 20 Funds? Here's How to See Who Read It

李成斐 — Sat, 19 Sep 2026 11:01:04 +0000

You Sent the Deck to 20 Funds. Three Read It. Do You Know Which Three?

The FA's real problem is not one send. It's twenty.

Ask any fundraiser how their last round went and you get the same story: the BP went out to two dozen funds, and then the founder and the FA sat in the dark for two weeks, refreshing inboxes, not knowing a thing — and with no way to tell who actually read the pitch deck.

The classic advice is "track your pitch deck." But for an FA running a process, tracking one send is table stakes. The real job is comparing twenty sends at once — and knowing, on day three, which funds are genuinely engaged and which are politely ignoring you.

That is a distribution problem, and it deserves distribution-grade data.

The pattern: one deck, many rooms, zero visibility

A typical Series A process looks like this:

Monday: BP v1.2 goes to 20 funds. Each gets a personalized one-pager and a link.
Wednesday: three funds replied "thanks, reviewing." Twelve said nothing. Five haven't even opened it.
You call the three who replied (easy). You email the twelve (generic). You ignore the five (assumption).

Here is what actually happened under the surface — and what the FA never sees:

Illustrative example of DocTrail's dashboard output — not a real client result.

Fund A opened the BP Tuesday at 09:14, read steadily through page 18 (the full financial model), and came back Thursday for another 11 minutes. Someone is doing real diligence.
Fund B opened it once, skimmed to page 4 in 90 seconds, and never returned. The partner glanced; the analyst killed it.
Fund C never opened the link at all — but the founder's BP was forwarded onward from Fund D's inbox on Wednesday. A conversation is happening that nobody logged.

No reply means different things in each of those three cases. Treating them the same is how processes die.

What a multi-send view changes

DocTrail is document tracking built for senders who send a lot — upload the BP once, share a separate tracked link to each fund, and get per-recipient reading data instead of one ambiguous blob:

Per-fund open and read depth. Each link carries its own read-status history — opened or not, how far the reader progressed, page by page.
Time and return visits. A fund that opens the deck twice in a week is doing work. A fund that never returns after 90 seconds is not.
Forward chain. When a recipient forwards a link through DocTrail, you see who it went to and when — movement that a plain inbox never shows.
Control per link. Revoke a stale version fund-wide when v1.3 replaces v1.2; disable download when a draft is not for distribution.
Clean follow-up queues. Instead of "email everyone the same nudge," your call list writes itself: deep readers first, skimmers second, non-openers get the one-line version.

Readers need no account and no plugin — each link opens in a browser, and the send-side dashboard updates in real time.

The day-three call list

With reading data, the FA's Wednesday looks different:

Call Fund A — they read the model twice. Ask about the specific numbers they spent time on. That call closes.
Send Fund B one sharp line: "Saw you skimmed the overview — happy to send the 3-page summary if useful." Either they bite, or they don't — either way you stop guessing.
Call Fund D — if someone there forwarded the deck onward, you'd see who it went to; the meeting is already half-scheduled in their head.

The difference between a process that survives on hope and one that runs on data is exactly this list.

Built for a proven category

Document tracking for high-stakes sharing is established — DocSend was acquired by Dropbox for $165M (2021), and open alternatives like Papermark confirm the demand. DocTrail is built for the same job with per-send reading intelligence at the center — here's how document tracking reveals what happens after you hit send.

Pricing is monthly and simple: Pro $14 · Team $42 · Enterprise $99 per month. Most deal teams go Team ($42/mo) — annual billing gets 2 months free.

Try it free

Reply to request a free 30-day Pro trial — we'll set you up within 24 hours. Tell us how many documents you send per month and how many recipients per document, and we'll recommend the right plan.

Next round, don't ask "who replied?" Know who read.

— I'm one of the makers behind DocTrail.

The one-person company workflow: how to track every document you send

李成斐 — Fri, 28 Aug 2026 12:02:21 +0000

The one-person company workflow: how to track every document you send

Running a one-person company means every document you send is a direct extension of your time: proposals, contracts, pricing sheets, follow-ups. And the worst part isn't writing them - it's the silence after.

You send a proposal on Monday. Wednesday you ping the prospect: "just checking in." They say "still reviewing." You wait. Another week passes.

Meanwhile, the document sat unread in their inbox the entire time - and you had no way to know.

A document workflow for solo founders

The tools solo founders usually rely on (email attachments, Google Drive links, Notion pages) share one flaw: they treat sending as the end of the process. In reality, sending is the beginning of the part that matters - reading.

A practical workflow with DocTrail:

Send with a tracked link - every proposal, contract, and pricing page becomes a tracked document (one paste, no plugin)
Watch the reading signals - you see when it's opened, which pages get attention (pricing? terms?), and how long
Follow up with intent - instead of blind "checking in," you follow up because the pricing page was read twice yesterday
Close the loop - the document's access log becomes part of your deal record: who saw what, when

Why this matters more for solo founders

In a team, someone might casually mention "oh, they opened the deck last week." When you're alone, there is no such person. The document itself must tell you.

It also protects you: a tracked link with expiry and watermarking means your pricing sheet doesn't float around forever.

The tools

DocTrail - document tracking (free tier)
A simple CRM or even a spreadsheet - for the follow-up schedule
Calendar reminders keyed to reading events, not send dates

Try it

Send your next proposal with a tracked link. The follow-up conversation writes itself.

Stop guessing. Know who read it.

The proposal you sent is a black box. Here is what document tracking reveals

李成斐 — Thu, 27 Aug 2026 13:32:01 +0000

The proposal you sent is a black box. Here is what document tracking reveals

You send a proposal on Tuesday. On Friday, the prospect says "we're still reviewing." You have no idea whether:

They opened it at all (or it went to spam)
They read the pricing page, or skipped straight to the deliverables
The decision-maker saw it, or only their assistant did
They forwarded it to a competitor for comparison

In B2B sales, follow-up timing is everything. The window right after someone reads your proposal is when they are most engaged - and most likely to make a decision. But if you don't know they read it, you miss that window.

What tracking changes

DocTrail attaches reading intelligence to every document you share:

Open + per-page reads - know exactly which sections got attention (pricing? case studies? terms?)
Time on page - a 6-minute read of your pricing page means something very different from a 20-second skim
Forward detection - know when your proposal was shared internally (a good sign) or externally (worth a call)
Alerts in real time - the moment a key page is read, you know it

The follow-up script becomes obvious

Instead of "just checking in," you can say:

"I noticed you spent time on the pricing section - happy to walk through the numbers if useful."

That's not creepy - that's useful. It shows attention, saves the prospect effort, and puts you in the follow-up conversation from a position of insight, not guesswork.

For teams, not just individuals

Sales managers get visibility too: which reps send tracked links, which deals have engaged stakeholders, which proposals went dark. The pipeline stops being vibes.

Try it

DocTrail - free tier included. Send a proposal, share the link, and watch the read signals arrive.

Stop guessing. Know what they read.

Sending sensitive documents? Here is how to stay in control

李成斐 — Thu, 27 Aug 2026 13:01:56 +0000

Sending sensitive documents? Here is how to stay in control

When you send a confidential document - an M&A data room, a draft NDA, a term sheet, a due diligence file - you are handing over control. The question is not whether the recipient is trustworthy; it is whether you can know what happened after send.

The gap in "secure sharing"

Most secure sharing tools stop at access control: passwords, expiry links, watermarks. They protect the perimeter. But they leave you blind to what happens inside:

Did the counterparty's counsel actually open the NDA, or is it still sitting unread?
Which partner downloaded which file from the data room?
Did anyone forward your deck to a third party you never authorized?
After a deal falls through, can you produce an audit trail of who saw what?

For FA teams, law firms, and sales organizations, these aren't nice-to-haves. They are the difference between "we think the deal is on track" and "we know the other side read the final terms last night."

What tracking adds

DocTrail layers visibility on top of the usual security controls:

Per-page access logs - see exactly who opened which pages, when, and for how long
Download detection - know when a document was downloaded, and flag it in real time
Forward-chain tracking - if a link gets shared, you see the chain
Audit trail - a complete record of access, useful for disputes and compliance
Granular controls - password / email-OTP, expiry, dynamic watermarking, and disable download/print/copy per link

Privacy-respecting by design: visitors are told they are being tracked, and tracking can be switched off per link.

The use cases

M&A / FA: know which buyer's team actually reviewed the data room before the term sheet
Legal: prove (or disprove) that a counterparty saw the NDA - with timestamps
Sales: know the procurement officer read the proposal - and what they lingered on
HR: track offer letters and reference checks

Try it

DocTrail is live with a free tier. Send a document, share the link, and watch the reading behavior arrive in real time.

Stay in control. Know what happens after send.

Sent a pitch deck? Stop guessing whether they read it

李成斐 — Thu, 27 Aug 2026 12:31:49 +0000

Sent a pitch deck? Stop guessing whether they read it

Every founder, FA, and salesperson knows the feeling: you send your pitch deck or proposal, and then... nothing. A black box.

Did they read it? Which pages? For how long? Did they forward it to their partner?

Email attachments, WeChat files, and cloud links all have the same problem: zero visibility after send.

The cost of the black box

For a founder raising a round, this isn't just curiosity - it's strategy:

You send your deck to 30 investors, 3 reply, and you have no idea which of the other 27 actually read it.
The "golden follow-up window" (usually within 24 hours of reading) gets wasted because you don't know they read it.
Your weekly update to the board says "contacted X investors" - a number that is essentially made up.

The same story plays out in B2B sales (did the procurement officer open the proposal?), legal (did the counterparty's counsel actually review the NDA?), and hiring (did the candidate's reference actually read the offer?).

The fix: document tracking

DocTrail is a document sharing and tracking tool built for this exact problem:

Per-page reading analytics - see exactly which pages were read, in what order, and for how long
Reading completion + heatmaps - know if they skimmed or studied
Forward-chain tracking - see if your deck was forwarded, and to whom
Real-time notifications - get pinged the moment someone opens your document
Security controls - password / email-OTP access, NDA prompts, expiry links, dynamic watermarking, and disable download/print/copy

It's privacy-respecting by design: visitors are informed before access, and tracking can be disabled per link.

Try it

DocTrail is live at doctrail.pages.dev. Free tier included.

Stop guessing. Know who read it.

Why One Person Can Run an AI Company Today

李成斐 — Sat, 22 Aug 2026 02:17:59 +0000

Why One Person Can Run an AI Company Today

一、AI CEO（atoma）通过 MCP 连接 8 个业务系统、258 个工具。

二、闭环：产品（虚拟工具包 5 站）→ 流量（dev.to 内容 + 截流 + GEO）→ 转化（PayPal）→ 交付（HMAC 下载）→ 归因追踪。

三、本文由 AI CEO 一句话自动发布（publish_engine MCP 工具）。

DocTrail: Know Exactly Who Read Your Documents

李成斐 — Sat, 22 Aug 2026 00:13:05 +0000

DocTrail

Track document opens, read time, and engagement — the DocSend alternative with analytics built in.

Real-time alerts when someone opens your doc
Per-page engagement tracking
Privacy-first design

Perfect for sales decks, proposals, and investor materials.

AI Privacy Gateway: Strip PII from AI Prompts Before They Leave Your Machine

李成斐 — Fri, 21 Aug 2026 23:12:14 +0000

AI Privacy Gateway

A practical guide to keeping your sensitive data out of AI prompts.

Why it matters

Every prompt you send to a cloud LLM contains potentially sensitive information. A privacy gateway sits between you and the model, stripping PII before anything leaves your machine.

How it works

Intercept — the gateway captures outgoing prompts
Detect — PII detectors identify emails, phones, addresses, keys
Redact — sensitive tokens are replaced with placeholders
Forward — the sanitized prompt goes to the model
Restore — the response is rehydrated with original values

Key benefits

Local-first — processing happens on your device
Zero-knowledge — providers never see your data
Drop-in — works with any OpenAI-compatible endpoint

Try it

The full implementation is available as an open-source project with a CLI, a local gateway daemon, and MCP integration for AI agents.

AI Privacy Gateway — strip PII from AI prompts before they leave your machine

李成斐 — Mon, 17 Aug 2026 13:03:31 +0000

Every AI coding assistant (Cursor, Claude Code, Copilot) sends your code to third-party servers. Every time you paste customer data into ChatGPT, that data leaves your machine. Every DeepSeek prompt crosses an international border.

I wanted a dead-simple fix: a local proxy that strips PII from AI API calls before they leave my machine. No SaaS dependency. No "sign up for enterprise." Just docker run and forget it.

AI Privacy Gateway is a transparent HTTP reverse proxy that does exactly that:

30-second deploy: docker run -d -p 9999:9999 ghcr.io/gunxueqiu6/ai-privacy-gateway:lite — then change your AI client's base URL to http://localhost:9999
26 entity types auto-detected (v2.0.3): phone numbers, email addresses, China ID cards (18-digit), bank cards (Luhn-validated), API keys (20+ known formats: OpenAI sk-, AWS AKIA, GitHub ghp_, Stripe sk_live_, etc.), China Unified Social Credit Codes, passports and HK/Macau/Taiwan permits, IPs, URLs, dates, amounts, postcodes, plate numbers, coordinates, MACs, person names (Chinese + English via optional spaCy NER), and custom regex patterns
<1ms latency overhead (self-measured): a compiled union regex pattern makes one pass per request; optional NER fallback adds ~2–5ms for fuzzy entities
SSE streaming support: sliding-window buffer resolves entity boundaries across chunk boundaries — no buffering delay, no missed PII
AES-256-GCM encrypted vault: optional persistent mapping storage for round-trip reconstruction; stateless mode available
Works with any OpenAI-compatible API: ChatGPT, Claude, DeepSeek, Cursor, Copilot, Open WebUI — anything that can change its base URL
PolyForm Shield: free for noncommercial use, source available, zero telemetry, fully local

Why I built it:

I work with customer data — phone numbers, emails, transaction records. Every week I'd catch myself pasting something containing PII into an AI tool. The existing options were all wrong for my use case:

LLM Guard (MIT): Python SDK with transformer deps — slow install, ~5ms latency, no SSE streaming
Presidio (MIT): Microsoft's analyzer — Docker Compose + NLP models + PostgreSQL, no Chinese NER out of the box, no proxy mode
Nightfall / Private AI (commercial): cloud-hosted, enterprise-priced, your data hits their servers
PasteGuard (MIT): browser extension only — misses API tools like Cursor or Claude Code

None of them let me change one URL and be done.

Architecture (simplified):

[AI Client] --raw request--> [Privacy Gateway :9999] --masked request--> [AI API]
                              |
                              +-- [Regex Engine: 26 patterns, <1ms]
                              +-- [spaCy NER: names, locations, orgs (optional)]
                              +-- [AES-256-GCM Vault: optional mapping storage]
                              +-- [Audit Log: JSON/Syslog]

The proxy intercepts requests to /v1/chat/completions, scans the JSON body for PII patterns, replaces matches with typed placeholders ([PHONE_abc123], [EMAIL_xyz789]), then forwards the sanitized request upstream. The AI provider gets semantic context — but never raw sensitive values.

Tech stack: Python 3.11+ / FastAPI, compiled regex engine, spaCy (zh_core_web_sm + en_core_web_sm), SQLite encrypted vault (AES-256-GCM), SSE sliding-window buffer, pub/sub audit bus, optional load balancer for multiple upstreams.

Current status: v2.0.3. Tests with adversarial fuzzing; benchmark suite in CI (self-measured on our test corpus).

Honest limitations:

Regex misses unconventional PII formats — transparent about ~95% recall for structured types on our test corpus, not 100%
NER recall for Chinese names is imperfect — catches common names, misses uncommon ones
False positives on things like long order numbers triggering bank-card patterns — a --strict flag helps
Single-process Python server — scale behind nginx for high throughput
Masking is not a silver bullet: if the model already knows a person from context, placeholders can still be connected — redaction mode ([REDACTED], irreversible) exists for higher-stakes data

What I want feedback on:

Does the proxy-vs-SDK tradeoff make sense for your team?
Which PII types are missing for your use case?
Would you use a managed enterprise version (self-hosted, RBAC, audit export, SLA)?

GitHub: https://github.com/gunxueqiu6/ai-privacy-gateway
Website/Demo: https://privacygw.pages.dev

Happy to answer technical questions about the regex engine, streaming buffer, or vault design.

MatrixGrow Publish OK 151931

李成斐 — Mon, 17 Aug 2026 07:19:26 +0000

MatrixGrow Publish OK 151931

Automated test - publish channel verified.

Content

End to end publish works.

MatrixGrow Publish Test 151854

李成斐 — Mon, 17 Aug 2026 07:18:48 +0000

MatrixGrow Publish Test 151854

Automated test via MatrixGrow API - unique title check.

Content

Verifying the publish channel works end to end.