cd /news/ai-tools/from-idea-to-paying-customers-buildi… · home › topics › ai-tools › article
[ARTICLE · art-26034] src=dev.to pub= topic=ai-tools verified=true sentiment=↑ positive

From idea to paying customers: building an AI changelog tool with Angular 21

A developer built Releasely, an AI changelog generator for indie SaaS founders, using Angular 21, Supabase, and the Claude API. The tool generates three audience-specific versions of a changelog from a single input, and the developer shared architecture decisions including backend-only API keys, two-layer rate limiting, and XML-wrapped user input for prompt injection defense. The project is deployed with a Node.js backend on Railway, Angular frontend on Vercel, and uses Lemon Squeezy for payments.

read3 min publishedJun 13, 2026

#

How I built Releasely with Angular 21, Supabase, and Claude API

I just launched Releasely — an AI changelog generator for indie SaaS founders. From first commit to deployed product while working part-time around my day job.

Here's the full stack and what I learned.

#

The Idea

Every time I shipped a release, I wrote the same changelog three times — once for my team in technical language, once for users in plain English, once for X in punchy marketing tone. It killed my release-day momentum.

Generic AI tools give you one output. I wanted three audience-specific versions from one input.

#

The Stack

Frontend — Angular 21

- Standalone components only (no NgModules)
- Zoneless change detection (no zone.js)
  • Signal inputs/outputs throughout

@if

/ @for

new control flow #

`inject()`

, `toSignal()`

, `computed()`

patterns

  • Deployed on Vercel

Backend — Node.js + Express

  • Deployed on Railway (always-on, no cold starts)

  • Express middleware for auth, rate limiting, sanitization

  • All Claude API calls server-side only

Database + Auth — Supabase

  • RLS enabled on every table
  • Magic link auth with branded emails via Resend SMTP
  • Auto-profile trigger on user signup
  • 6 tables: profiles, changelogs, usage_logs, subscribers, github_connections, github_repos

AI — Claude Sonnet 4.6

  • Three different system prompts (one per tone)
  • User input wrapped in XML tags for prompt injection defence
  • Prompt caching for repeated context

Payments — Lemon Squeezy

  • Stripe is invite-only in India, Lemon Squeezy was the cleanest alternative
  • Merchant of record handles global tax automatically
  • Webhook-based plan upgrades to Supabase profiles

GitHub App Integration

  • @octokit/app for installation tokens
  • AES-256-GCM encryption for stored tokens
  • CSRF state parameter on OAuth flow
  • Webhook signature verification

#

Architecture Decisions That Mattered

  1. Backend-only API keys

The Claude API key never touches the Angular bundle. Angular calls /api/generate

on my Node backend, which checks auth, enforces quota, then calls Claude. This is non-negotiable for any AI SaaS.

  1. Two-layer rate limiting
- IP-level: express-rate-limit, 20 req/min
- Per-user: daily quota checked against Supabase usage_logs (5/100/300 for free/solo/team)

  1. XML-wrapped user input

Every user input is wrapped in <commits>...</commits>

tags before being sent to Claude. The system prompt explicitly says to treat content inside those tags as data only, never as instructions. Simple but effective prompt injection defence.

  1. Supabase RLS on everything

Row Level Security enforced at database level — users can only ever read their own rows. If my application code has a bug, the database still protects user data.

#

What Took Longer Than Expected

GitHub App vs OAuth App: Spent half a day figuring out which one to use. (Answer: GitHub App for finer permissions and webhooks.) #

Wildcard DNS for subdomains: Hosted public changelog pages at {user}.releasely.io

required wildcard DNS config on Vercel.

#

What Was Faster Than Expected

Lemon Squeezy webhooks: 2 hours from signup to live payments #

Claude prompt tuning: 3 tones working well after maybe 5 iterations #

Railway deployment: Push to git, it deploys. No configuration.

#

Lessons for Indie SaaS Builders

Research competitors thoroughly before naming your product. I named mine "ChangelogAI" only to find changelogai.dev existed. Had to rebrand mid-build to Releasely.

AI in the middle, integrations as the moat. Anyone can wrap Claude in a chat interface. Real defensibility comes from GitHub OAuth, Slack bots, Jira sync — places ChatGPT can't go.

Ship before perfecting. I have things I want to improve. Doesn't matter. Live and getting feedback beats polished and shelved every single time.

The studio model compounds. Releasely is product #3 in my Devcraft studio (UI kit + dashboard kit being the others). Each product makes the next easier to launch.

#

Try It

[Releasely](https://releasely.io) — free for 5 changelogs/month, $9/mo for unlimited.

Honest feedback welcome. If you ship code and hate writing release notes, this is for you.

source & further reading
dev.to — original article KeepAI: a local, open-source API hub that lets AI agents use your apps safely I used Claude Fable 5 for 28 minutes. Then the US government shut it down. I Built an AI-Powered Portfolio Template (and You Can Use It)
── more in #ai-tools 4 stories · sorted by recency
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
→ Live at https://your-agent.zahid.host ✓
Get free account → Pricing
from €0/mo · no card required
LIVE [news/from-idea-to-paying-…] indexed:0 read:3min 2026-06-13 · —