How to build and grow a SaaS
In this article, I’ll be discussing lessons from building maquete.ai - a platform that turns architecture prints into photorealistic renders using AI. Five days after launch, we got our first paid user. Here’s how I built and marketed the platform.
Before starting
Don’t you dare write a single line of code before you know who your customers are and how you will reach them. For example, my users are architects and my co-founder already has a large architecture network.
Having a network of people to sell to is a massive advantage. I’ve previously created apps that got zero traction because I didn’t know how to reach my target users.
Even better, talk to potential users and see if the app is something they’d be interested in before you even build it. This isn’t a sales pitch though. Ask probing questions to see if they’d pay for a solution to a specific problem without mentioning your idea. That way, you get accurate feedback.
Nowadays, people are vibe coding SaaS businesses to launch into the void. Don’t be that person.
Building the app
Today, AI is so powerful that coding an entire SaaS by hand is analogous to deciding you will do your taxes in your head rather than using a calculator. Claude Code and LLMs are very competent programmers and work at speed. Some engineers at even the largest companies are no longer writing code, only checking code generated by LLMs.
For example, I offloaded the production of a language toggle in maquete.ai that I built because many of our users are based in Brazil. I’ve previously done this using the i18n language package and it took me the best part of a day to finalise. Claude Code did it in 30 minutes.
That speed comes with a caveat, however. Bear in mind that AI generated code contains 1.7x more issues than human-written code. That doesn’t mean don’t use AI. Just be aware of potential vulnerabilities and plan to resolve them. To assist, use Claude Code or CodeRabbit to review your pull requests in GitHub. Alternatively, grant Claude Code access to your codebase and ask it to perform tests with a specially engineered prompt, such as the one in the footnotes1.
I personally don’t like the idea of letting Claude build your entire app from scratch, especially if you don’t verify it’s security. Hackers will be able to steal user info if your API routes aren’t protected. However, using Claude to build specific features or enhance the UI is an excellent idea. That way, you still consider the codebase to be fundamentally under your control.
Managing the codebase
Next.js is a popular framework for creating frontend applications. It’s easy to set up and host on Vercel for free. API routes can also be placed in your Next.js app, allowing for a full stack project to be deployed in one codebase.
Be aware, however, that serverless function billing can trigger high Vercel costs. Founders often spin up a quick MVP using Next.js and Vercel and forget to enable any limits, often not expecting that their app will take off so quickly. One founder was hit with a shock $96k bill after reaching 650k users. She didn’t have any usage limits set and didn’t enable cached responses on API endpoints. After 56 million function invocations a day, the bill grew. What was otherwise a fantastic product was hampered by a large server bill because the founder didn’t take the time to add guardrails.
To avoid high Vercel function costs, I build a separate backend in Python and hosted it on Railway.
MVP
MVP stands for Minimal Viable Product. A lot of people focus on the word ‘minimal’ rather than the word ‘viable’. Build something thoroughly tested that won’t break in users’ hands. If a user arrives at your site and it doesn’t work, they’re not going to sign up and they definitely won’t pay.
However, you shouldn’t spend months and months building the perfect app to only then realise that no one would pay for it. Build a few key features that work well and then get it into people’s hands. Once they’ve started using your app, ask them for feedback to better inform your product roadmap.
Asking your users to join a Zoom call with you so you can view how they interact with your app is a well-thought-out idea. Conversing over email won’t give you the same understanding of how they use your app.
Pricing
Understand your costs and margins to inform your pricing. Don’t guess. I once opened a supplement business where I had no idea what my revenue was. We went out of business.
Let users experiment with your app by offering a free tier. This can take the form of a free trial, limited free credits, or a permanent free tier with paid features.
At maquete.ai, we offer 10 free lifetime credits.
I’ve built. Now where are my users?
You should know exactly where they are from your pre-build planning. It’s time to reach out to those potential users and offer to demo your app. This can be friends and family at the start. Don’t just send a link because they’ll forget.
Social media
Social media is a tried and tested way to organically grow your app, and some businesses become an overnight success with one viral reel. Use your own account following to help get initial followers, otherwise you may end up posting into the void. Fun reels do well - such as street interviews or other natural-looking videos that blend in with people’s feeds.
Reddit
Besides social media, forums such as Reddit can be a good way to promote. Many have successfully grown a user base by posting on subreddits such as r/SaaS, r/Entrepreneur, or subreddits relevant to their niche.
SEO
Another common way people tackle marketing is with SEO (search engine optimisation). SEO measures how high your site ranks on search engines. One way to achieve good results is by including popular ‘keywords’ on your site. When people search those keywords in Google, your site is more likely to appear because it includes those keywords. To find relevant keywords, you can use Google Ads Keyword Planner (just create a Google Ads account without putting any money in). Enter your industry and find what people are typically searching for in Google when finding relevant results. Then include those search terms in your site.
Having a blog on your site can also help, as you can create posts around keyword terms that may show up on Google. For example, top 10 supplements for energy.
If using Next.js, you can add metadata in your layout file that is optimised for SEO. I like to ask Claude to create me ‘god-tier metadata’.
Backlinks
SEO ties in nicely with backlinks. Backlinks are hyperlinks from other sites that link to your website. Having “good” backlinks helps with SEO ranking. List your site on directories such as Product Hunt and Beta List. A good Product Hunt listing can also help get early users. Make sure to plan assets, videos/GIFs, and good tag lines to post.
Another way to get backlinks is to reach out to blogs asking them to write a post about your site or offering to write a post for them. This shouldn’t be your first priority when building a SaaS, however.
Affiliate marketing
What’s better than selling your own app? Having other people sell it for you, of course. Creating an affiliate program can benefit you by letting influencers with a following advertise your app in return for a revenue share.
At maquete.ai, we will be giving architecture influencers a ‘free trial’ promo code to distribute to their following. When someone eventually converts to a paying user, the influencer get 25% of the first month of that user’s revenue.
Paid ads
Don’t. It’s not worth paying for traffic until you know people would pay for your app. That’s it. Once you know people are converting, you can find suitable keywords and run Google Ads or boost Instagram/TikTok reels that achieved high engagement organically.
Don’t let Google advise how your Google Ads should look. They want you to burn money. Ask Claude for help there if you aren’t sure what you are doing.
These are various ideas and tactics I deployed with maquete.ai. I hope you found them useful.
You are performing a comprehensive code audit of a production SaaS application. Review the entire codebase and produce a structured report covering every issue you find. Be thorough and specific — reference exact file names and line numbers where possible. Audit the following areas:
Exposed API keys, secrets, or credentials in code or config files
Missing authentication or authorisation checks on routes
Unvalidated or unsanitised user inputs
SQL injection or ORM misuse risks
CORS configuration issues
Missing rate limiting on sensitive endpoints (auth, payments, AI generation)
Stripe webhook signature verification — is it actually being checked?
Any endpoint that could be called without a valid session Error handling
Unhandled promise rejections or bare try/catch blocks that swallow errors silently
API routes that return stack traces or internal error details to the client
Missing loading and error states in the frontend
AI API calls with no timeout or retry logic
Database operations with no rollback on failure Data integrity
Missing database constraints or indexes that should exist
Race conditions in billing logic (e.g. credits being deducted twice)
Any place where user data could be corrupted or lost silently Performance
N+1 query patterns in database calls
Large base64 images being passed through the API unnecessarily
Missing pagination on any list endpoints
Unnecessary re-renders or missing memoisation in React components API design
Inconsistent response shapes between endpoints
Missing input validation on any FastAPI route
Routes that do too much and should be split Frontend
Sensitive data stored in localStorage or exposed in client-side code
Missing form validation or validation that can be bypassed
Any place where user-facing error messages expose internal details
Console.log statements left in production code Billing & credits
Any way a user could use paid features without being charged
Free tier limits that could be bypassed
Stripe webhook handlers that don’t handle all failure cases For each issue found:
State the file and location
Explain the problem clearly
Give the specific fix — code where applicable
Rate the severity: Critical / High / Medium / Low Other issues