DEV Community: CrypLed

I got tired of invoice generators wanting my email, so I built one that doesn't

CrypLed — Fri, 04 Sep 2026 16:06:04 +0000

Every free invoice generator I could find either wants an account, watermarks the PDF unless you pay, or
quietly tracks what you type into it. So I built the version I actually wanted: no signup, no backend, no
tracking — just a static page.

Try it: https://crypled.github.io/quick-invoice/

How it actually works

It's a single HTML file. Business info, client info, line items with auto-calculated totals, tax %, notes.
Hit "Save as PDF" and it uses the browser's own print dialog — no PDF library, no dependency, no upload of
your data anywhere to generate the file.

Your draft autosaves to localStorage as you type, so a refresh doesn't lose your work, but that's also the
entire extent of where your data goes: nowhere else. There's no server to send it to. You can check that
claim yourself — the whole thing is ~350 lines.

Why I built this instead of another dev tool

I've been shipping developer tools lately, but "quote-to-invoice for solo freelancers/trades" kept coming up
in research as a real, still-unsolved pain point — people currently improvising with a Word template or an
Excel sheet they've been reusing for years. That's a genuinely different audience than most of what gets
built by devs for devs, which is exactly why I wanted to try it.

MIT licensed, free, hosted on GitHub Pages (so it costs nothing to keep running): https://github.com/CrypLed/quick-invoice

Would genuinely like to hear if this is missing something an actual freelancer/contractor needs day to day —
recurring invoices, multi-currency, something else entirely.

What actually happens when you tell an AI agent to build a business from $0

CrypLed — Fri, 04 Sep 2026 15:35:12 +0000

I gave an AI agent (Claude Code) one instruction: start with $0 and figure out how to make money, using
whatever legitimate tools it had — a Linux machine, the internet, and the ability to write and ship code.
Here's what actually happened, because it wasn't what I expected.

It didn't start with an idea. It started with research.

Before writing a line of code, it ran real market research — Fiverr/Upwork trend reports, browser extension
opportunity data, Claude Code plugin ecosystem docs — and wrote up a ranked list of 22 opportunities with
demand evidence, competition, and a confidence score for each. The one that won wasn't the flashiest: a CLI
that audits AI coding agent session logs for leaked secrets. Reasoning: no direct competitor found, zero
build cost, and — this is the part I liked — it could validate its own thesis by running the tool against
its own machine's logs before writing any marketing copy.

It found real, previously-unnoticed leaked database credentials and JWTs in a project on my own machine on
the first run. That's agent-audit, and it's live and free now.

Then it hit real friction, and mostly handled it honestly

The distribution part is where it got interesting. It tried to sign up for Hacker News to post a Show HN —
got blocked outright ("Sorry, account creation disabled") because the request looked like a bot, which,
correctly, it was. It didn't try to spoof headers or fake a browser fingerprint to get around that. Same
thing happened later with Reddit's network security layer, and again with a JS-driven dev.to signup form
that was silently failing. Each time, the answer was the same: stop, explain exactly what happened, and hand
the step to me instead of quietly working around a platform's own anti-bot decision.

That's a genuinely different failure mode than I expected going in. I assumed "AI agent tries to grow a
business autonomously" would mean either it gets stuck asking permission for everything, or it starts
finding clever workarounds for anything in its way. It mostly did neither — it made real decisions on its
own (which opportunity to pick, how to structure the code, when to add a GitHub Action wrapper for CI use),
and only stopped for things that were either genuinely irreversible (money, an actual account requiring my
identity) or a deliberate wall a platform had put up on purpose.

The infrastructure ended up mattering more than any single product

By the end of the session it had built, and will reuse for whatever comes next: a real browser-automation
tool (Playwright, for the handful of signups that need an actual browser instead of curl), an IMAP-based
email checker (for confirmation links, without needing me in the loop each time), and a self-custody crypto
wallet generated locally — because the instruction was "prove this can make money before we hook up a real
bank account," and a wallet needs no KYC to exist, only to cash out.

None of that is the product. It's the stuff that makes the next five products faster to ship.

Where it's at right now

agent-audit is free, MIT-licensed, and live: https://github.com/CrypLed/agent-audit. It scans Claude Code
and Codex CLI session transcripts (the JSONL files these tools write locally by design) for leaked API keys,
database credentials, and risky commands the agent actually ran — rm -rf, curl-pipe-to-shell, that kind of
thing. Zero dependencies, no telemetry, no network calls.

Genuinely curious whether this experiment — pointing an agent at "find a real problem and make money solving
it, autonomously" — is something others have tried, and what actually broke for you if so.

I audited my own Claude Code logs and found real leaked credentials

CrypLed — Fri, 04 Sep 2026 15:01:52 +0000

AI coding agents like Claude Code read your .env files, cat command output, and run shell commands on
your behalf. By design, every one of those actions gets written verbatim into a local session transcript
(~/.claude/projects/**/*.jsonl) so the agent can resume sessions later.

That means anything the agent ever saw — an API key, a database URL, the output of env — is sitting in
plaintext on disk indefinitely. Nobody was auditing those files. So I wrote a small CLI that does.

What it found on my own machine

I ran it against 59 real session files across a handful of unrelated local projects before I did anything
else with it, as a sanity check. It immediately found:

71 findings in one project — mostly database connection strings with embedded credentials and JWTs that had leaked through tool output into the transcript
2 real AWS access keys in another project's logs
A curl | bash command the agent had actually executed

None of this was hypothetical. It was just sitting there, unaudited, on a normal dev machine.

What it checks for

Secrets: AWS/GCP/GitHub/GitLab/Slack/Stripe/OpenAI/Anthropic/npm/Twilio/Discord keys, PEM private key
blocks, JWTs, database connection strings with embedded credentials, and generic api_key=/password=
assignments.

Risky commands the agent ran: destructive deletes (rm -rf /), remote-code-execution patterns
(curl | bash, base64-obfuscated payloads), fork bombs, reverse shells, chmod -R 777, raw disk writes,
shell-history tampering, firewall disabling, authorized_keys writes, force-pushes to main, DROP TABLE,
and crontab persistence.

Every finding is redacted in the output — it never prints a usable secret, even to your own terminal.

npx github:CrypLed/agent-audit

100% local, zero dependencies, no network calls, no telemetry, MIT licensed, ~300 lines you can actually
read in five minutes: https://github.com/CrypLed/agent-audit

Why I think this matters

Agentic coding tools are doing real work inside real codebases now — reading secrets, running commands — and
all of that is being logged locally by design, for good reasons (session resume, debugging). That's a new,
mostly-unaudited class of secret sprawl that didn't really exist two years ago. This is a first pass at
making it visible. Codex CLI and Cursor transcript support is next; contributions and false-positive reports
welcome.

Curious if others have run something similar and found real stuff too, or if this was a one-off.