Opportunities › Client-aware password manager with breach containment › Proposed app
Bulkhead
Self-hosted vault that caps what any one device can read and flags odd access.
- Score
- 26
- confidence 38
- Evidence
- 4
- items on the page
- Rivals
- 1
- named in sources
- First version
- 45 d
- estimate
- Type
- Desktop app
- PWA: runs in the browser, installs on Mac and Windows
- Market since
- no product yet
- New market · AI estimate
ScreensConcept
Desktop app: Security setup, vault management and access monitoring require careful review of device logs and sensitive settings at a computer. Sample screens on a computer, in the proposed brand. Their numbers are sample data.
Access today
1 alert to review3 devices
About this appAI proposal
Bulkhead is a self-hosted password manager for people who already use passkeys but still hold legacy logins. It limits how many secrets each device can read in a given time, so one compromised laptop cannot hand over the whole vault.
Every secret gets a sensitivity level. Each device gets a budget per level. When a secret is read from a second device, the first device is told, and you can cut off the suspect endpoint from your phone.
It is built for security-conscious individuals and small teams who want to see which device touched which secret, and to keep the damage of a stolen endpoint small.
- Tagline
- Legacy passwords, kept in compartments. One bad device won't open them all.
- Voice
- CalmPrecisePlainspoken
- Why this name
- A bulkhead is the wall in a ship that keeps one flooded section from sinking the vessel. It states the idea of containing damage in one plain word.
In the first version
Members say which features they would use. It tells PWAS what people want; it changes no score.
Per-device read limits
Set how many secrets each device can open per hour or day. A compromised client hits the cap before it can copy everything.
No member yet
Sensitivity levels
Label secrets as low, medium or critical. Critical ones need stricter budgets, or approval from another device.
No member yet
Cross-device access alerts
When a secret is read from another device, your other devices get a notice naming the device and the secret.
No member yet
Access timeline
See which device read which secret and when. Rapid reads from one device across many secrets stand out.
No member yet
Brand identityAI proposal
Check the name against trademark registers before using it.
Palette
#14232BDeep Ink · primary, text#F6F3ECPaper · surface#E0902BSignal Amber · accent, alerts#2F7D5BMoss · data, safe state#B53A2EBrick · danger, locked#D9DEDDSlate Mist · borders, dividers
Typography
Aa
Bulkhead
PricingAI proposal
The material gives no competitor prices. These tiers are a starting point to test, following the opportunity's idea of licensing by users or secrets managed, or per-organization annual fees.
Solo
Free
- 1 user
- Up to 5 devices
- Per-device read limits
- Cross-device alerts
Team
$4 a month
- Per user, up to 50 users
- Sensitivity levels and approvals
- Access timeline, 1 year
- Shared vaults
Organization
Contact us
- Unlimited users
- Admin alert console
- Audit log export
- Priority support
Would you pay Team · $4 a month?
Your answer tells PWAS which prices people accept. It changes no score.
No answers yet.
What it could be worthEstimate
What a software business making this much sells for today, from real deals. Pick a monthly revenue.
If it makes
Worth about
$194,000
Sale range $132,000 to $263,000
$120,000 a year in revenue
From 87 software businesses listed and sold on Empire Flippers in the last year, revenue vetted by the broker: they sell for about 19× their monthly revenue, most between 13× and 26×.
Measured on profit, the middle deal is 32× monthly net profit: about 2.7 years of profit.
An estimate, not an offer or financial advice. A real price depends on profit, growth, churn, how much of the work is the owner's, and the buyer.
How it would growAI proposal
How the product would reach new customers through its own use, and how the first ones would be found. A plan to test, not a result.
- Built-in loop
- No loop in the product. Reaches customers through content, self-hosting communities and direct sales. Teams may invite colleagues into a shared vault, but the product has no strong loop in its own use.
- Do they become customers?
- Invited teammates are already inside a paying account, so invites add seats, not new buyers. Test whether security-minded individuals who self-host convert to team plans.
- First customers
- Small security-minded engineering teams of 5 to 30 people that use passkeys for sign-in and keep legacy service credentials, and that already self-host internal tools.
- Where to reach them
- Hacker News and Show HN: Post a technical write-up on blast-radius limits for password managers, where the problem was raised, and invite early testers.
- Self-hosting communities: Offer a free single-user tier and a Docker guide in self-hosting forums and newsletters.
- Direct outreach to small dev shops: Message CTOs and security leads at small teams and offer a guided setup for a pilot.
- First milestone
- Five small teams paying for an annual plan after a 30-day pilot, with at least half acting on a cross-device alert.
Why people already pay for this
- Public claimUsers want to restrict the number of secrets that can be accessed per time on each client to limit damage from compromise.
- Public claimExisting password managers lack per-client breach detection: users are not told if secrets are accessed by another client.
- Public claimCompromise of a single client device currently allows access and exfiltration of all secrets at once, a worst-case scenario users want to prevent.
- Public claimPassword managers do not commonly implement secret categorization by importance or client-level controls for containment and transparency.
Tech stack
Every proposal builds on the same PWA base, installable from the browser on any phone or computer. Dashed boxes are what this app adds.
- AppNext.js and TypeScript
- PWAManifest and service worker
- UITailwind CSS
- Data and authSupabase Postgres
- PaymentsStripe
- EmailResend
- HostingVercel
- This app · Self-hosted packagingDocker image with a single-node serverThe product is sold as a self-hosted server, so customers need an easy way to run it on their own machines.
- This app · Passkey authWebAuthn library for device sign-inDevices unlock with passkeys and each gets a stable identity for per-device limits.
RisksAI inference
- TechnicalRate limits on secret reads are only enforced if the server holds the keys. With end-to-end encryption, a compromised client may already hold copies, so the design must keep secrets server-gated.
- CommercialPrivacy-focused users may prefer free open-source managers. Many may not pay for containment unless alerts prove useful in a real incident.
- TechnicalA PWA gets less access to the operating system than native apps, which limits autofill and device identity. Weak device identity makes per-device limits easier to evade.
- CommercialStrict limits can block honest users, such as when many logins are needed at once. Too many false alerts would lead users to switch the feature off.
- RegulatoryHolding customers' credentials, even self-hosted, invites security scrutiny. Buyers will expect an independent audit before trusting a new vault.
Everything marked AI proposal or AI inference was written by a model from the evidence on the opportunity page. The proposed name must be checked against trademark registers before it is used.