Type-Driven Authorization Middleware for Web Apps

P5/10May 3, 2026
WhatA language-agnostic middleware and code-generation tool that enforces authorization state transitions (anonymous → authenticated → access-controlled) through the type system, making auth bugs impossible to compile.
SignalMercury encodes security invariants like authorization levels into Haskell's type system so they can't be forgotten, and engineers across languages recognize this pattern is massively underutilized despite preventing entire classes of critical security bugs.
Why NowTypeScript and Rust adoption has exploded, bringing type-system sophistication to mainstream developers; high-profile auth breaches continue to plague SaaS companies; AI code generation makes it even easier to accidentally skip auth checks.
MarketEvery SaaS company with user-facing APIs; adjacent to $15B+ AppSec market; competes with manual code review and tools like OPA/Cedar, but none enforce auth at the type level across common languages.
MoatDeep integration into the build/CI pipeline creates high switching costs; a growing library of authorization patterns for different frameworks becomes a defensible asset.
A couple million lines of Haskell: Production engineering at Mercury View discussion ↗ · Article ↗ · 418 pts · May 3, 2026

More ideas from May 3, 2026

Retrofit Physical Control Kits for Touchscreen CarsP6/10Aftermarket hardware modules that add physical knobs, buttons, and dials for climate, volume, and navigation in cars that went all-touchscreen.
Haptic Feedback Layer for Automotive TouchscreensC6/10A screen-overlay or software-hardware module that adds precise tactile feedback and raised-edge zones to existing car touchscreens, making them usable without looking.
Automotive UX Testing Platform with Driver Safety MetricsC7/10A SaaS platform that lets automakers test infotainment designs with real drivers, measuring eyes-off-road time, task completion errors, and cognitive load before committing to production.
Observable-by-Default API Client SDK PlatformP6/10A platform that generates fully instrumented, observable API client libraries for third-party services — with built-in tracing, timeout controls, and fault injection — so engineering teams don't have to write their own.
Personal Finance OS With Programmatic Account ControlC7/10A personal banking layer (or Mercury-like neobank for consumers) that lets individuals create unlimited named sub-accounts, per-category virtual cards, automatic allocation rules, and a full API for programmatic access and plaintext accounting sync.
Haskell Cloud Build and Cross-Compilation ServiceC5/10A managed build service specifically for Haskell projects that handles cross-compilation (ARM Mac to x64 Linux), static linking, dependency caching, and produces small deployment-ready binaries — eliminating the painful Docker-based build workflows.