SaaS That App - Building Tech-Enabled Businesses

Is legacy code a liability, or just software that “succeeded long enough to get old”?

In the debut of “Aaron Loves On...,” a new point-counterpoint format on SaaS That App, Aaron Marchbanks makes the case for old, stable code that keeps doing its job. His examples are a motor test system built in the 1970s and a COBOL inventory and fulfillment system that a profitable e-commerce business relied on for more than 20 years. Justin Edwards pushes back on sacred cow code nobody will touch, close-your-eyes deployments, and letting Amazon or Apple decide when you modernize. 

What You’ll Learn:

• Why legacy code isn’t automatically bad code
• Why developers instinctively want to rewrite
• How old systems store undocumented business logic
• Why untouchable code becomes a business risk
• When modernization is worth the investment
• Why code quality beats code age
  
  

Aaron Marchbanks is the Head of Engineering at Delta Systems and co-host of SaaS That App. He has spent nearly two decades helping startups and established businesses alike bring their software products to life. Since joining Delta in 2006, Aaron has played a key role in launching and scaling dozens of B2B SaaS products across various industries, including logistics, healthcare, and professional services.

Justin Edwards is the CIO at Delta Systems, where he helps businesses turn messy ideas into working software, and the co-host of SaaS That App. Before joining Delta in 2022, Justin ran Iterative Consulting, a custom software shop, and later co-founded Strive DB, a SaaS company serving victim-service organizations. Across those roles, he’s gone from wiring up early-stage prototypes to steering large-scale digital rebuilds, and everything in between.

This podcast is brought to you by Delta Systems, your one-stop shop for front-end, back-end, and full-stack software development. At Delta, Justin and Aaron share the same philosophy when it comes to clients: they treat people like colleagues, not just customers. Maybe that’s why Delta typically spends years working with the same companies: how many software engineering firms can you say that about? So, if you’ve got a big SaaS project in mind but have no idea where to start, come and get a free scope and estimate from Delta Systems at: https://deltasystems.com/ 

Got a burning idea for an episode, or a SaaS question you absolutely must know the answer to? Leave us a voice memo: https://www.speakpipe.com/SaasThatApp. 

#LegacyCode #SoftwareModernization #TechnicalDebt

Highlights:

• [00:57] Aaron Loves On…A New Point-Counterpoint Format
• [01:44] What Actually Counts as Legacy Code?
• [05:32] Why Developers Always Want to Rewrite
• [08:08] Hard-Won Lessons You Don’t Want to Learn Twice
• [10:27] A Profitable E-Commerce Business Running on COBOL
• [12:38] Are Legacy Systems Slowing Down Banking and Airlines?
• [14:25] Code Quality vs. Code Age
• [15:41] The Final Verdict

Episode Resources:

• Aaron Marchbanks on LinkedIn
• Justin Edwards on LinkedIn
• Delta Systems Website

Saas That App is handcrafted by our friends over at: fame.so 
Check out our three most downloaded episodes:

• AI-Assisted Development: Expectations vs. Reality with Richardson Dackam
• How to Price SaaS for Maximum Growth with Dan Balcauski
• You're Shipping Constantly - So Why Aren't You Growing? With Daniel Layfield

We’d love your feedback. Please take a moment to fill out our audience questionnaire:

https://forms.gle/DN8hWFDcE9jwvNKo6

Your input helps us shape future episodes and continue bringing you practical, real-world insights into building B2B web applications.

 AI agents, agentic commerce, and conversational AI are changing how people shop, plan, and get everyday tasks done, and they don’t always need an app to do it.

Dmitri Love, Co-founder and CEO of Served, is betting that the next great consumer AI product will live in your text messages.

In this episode of SaaS That App, Dmitri joins Aaron Marchbanks and Justin Edwards to share how Served answers the daily “what’s for dinner?” question by planning meals, finding recipes, and shopping across grocery and delivery platforms over text.

Dmitri explains why he skipped the app store, how human-in-the-loop design builds trust before full automation, and why so many AI super agents struggle when they try to do everything at once. He also shares what he learned leading conversational AI at Walmart, pitching on Shark Tank at age 22, and building a fintech company at exactly the wrong time.

What You’ll Learn:

• Why messaging may replace many consumer apps
• How to build trust in AI agents that spend money
• Why AI products should master one thing first
• When AI is worth the cost, and when it isn’t
• What startups and enterprises each do best
• Why great ideas can still fail on timing
  
  

Dmitri Love is a serial entrepreneur, product leader, and Co-founder of Served, an AI kitchen assistant that plans meals, finds recipes, and shops for groceries over text. He first made his name at 22 on Shark Tank, where his round-up investing app, Bundil, landed a deal with Kevin O'Leary. Over 13 years, Dmitri has built four companies, including Peas, an agentic joint bank account for couples, roommates, and business partners. At Walmart, he led product for Sparky, the company's conversational AI assistant, including work on voice and multimodal experiences, before leaving to build Served full-time.

This podcast is brought to you by Delta Systems, your one-stop shop for front-end, back-end, and full-stack software development. At Delta, Justin and Aaron share the same philosophy when it comes to clients: they treat people like colleagues, not just customers. Maybe that’s why Delta typically spends years working with the same companies: how many software engineering firms can you say that about? So, if you’ve got a big SaaS project in mind but have no idea where to start, come and get a free scope and estimate from Delta Systems at: https://deltasystems.com/ 

Got a burning idea for an episode, or a SaaS question you absolutely must know the answer to? Leave us a voice memo: https://www.speakpipe.com/SaasThatApp. 

#AgenticCommerce #AIAgents #ConversationalAI #FoodTech

Highlights:

• [01:02] From Shark Tank at 22 to Serial Founder
• [03:15] The Kitchen Camera Idea Customers Didn’t Want
• [06:19] Inside Served: An AI Kitchen Assistant Over Text
• [12:19] The 30% App Store Fee and Meeting Users Where They Are
• [20:12] Startup vs. Enterprise: Pros and Cons for Product Builders
• [22:52] Does Your Product Actually Need AI?
• [27:04] How AI Agents Will Talk to Each Other
• [29:40] The Real Risk of AI Comes From Humans
• [32:22] Peas: The Agentic Joint bank Account with Bad Timing
• [38:04] The Rise of Voice Interfaces
• [41:27] What Really Happens Behind the Scenes of Shark Tank
  
  

Episode Resources:

• Dmitri Love on LinkedIn
• Dmitri Love Website/Profile
• Served AI Website
• Aaron Marchbanks on LinkedIn
• Justin Edwards on LinkedIn
• Delta Systems Website

 Saas That App is handcrafted by our friends over at: fame.so 
Check out our three most downloaded episodes:

• AI-Assisted Development: Expectations vs. Reality with Richardson Dackam
• How to Price SaaS for Maximum Growth with Dan Balcauski
• You're Shipping Constantly - So Why Aren't You Growing? With Daniel Layfield

We’d love your feedback. Please take a moment to fill out our audience questionnaire:

https://forms.gle/DN8hWFDcE9jwvNKo6

Your input helps us shape future episodes and continue bringing you practical, real-world insights into building B2B web applications.

PHP runs a huge share of the web. So when two 9.2-rated remote code execution vulnerabilities, dubbed PHP2Shell, were disclosed in PHP core, the clock started immediately. Exploit attempts climbed from tens of thousands in the first hour to millions within a few hours.
Byron DeLaMatre, Director of Operations & Senior Full-Stack Developer at Delta Systems, led the response. In this episode of SaaS That App, he joins Aaron Marchbanks to share what that response looked like: prepping the night before, patching everything else ahead of the drop, and feeding the CVE into Claude to generate infrastructure-as-code mitigations while patching. They also dig into AI-powered vulnerability discovery, rapid security patching, defense-in-depth security, and why patch management gets harder the longer technical debt sits.

What You’ll Learn:

• Why severe CVEs can move from disclosure to mass exploitation within hours
• What unauthenticated remote code execution actually puts at risk
• Why WAFs and other mitigations can buy time but don’t replace patching
• How defense in depth reduces reliance on any single security tool
• How Delta used Claude and infrastructure-as-code during the response
• Why outdated PHP versions make emergency patching much harder
• How AI can also help teams work through targeted legacy upgrades
• Why technical debt is easier to pay down before your “hair is on fire”
  
  

Byron DeLaMatre is a Director Of Operations & Senior Full-Stack Developer at Delta Systems with nearly 20 years of experience working with PHP development and infrastructure. His work spans systems administration, security vulnerabilities, patch deployment, legacy infrastructure, and the day-to-day reality of keeping production systems current when high-severity CVEs land.

This podcast is brought to you by Delta Systems, your one-stop shop for front-end, back-end, and full-stack software development. At Delta, Justin and Aaron share the same philosophy when it comes to clients: they treat people like colleagues, not just customers. Maybe that’s why Delta typically spends years working with the same companies: how many software engineering firms can you say that about? So, if you’ve got a big SaaS project in mind but have no idea where to start, come and get a free scope and estimate from Delta Systems at: https://go.fame.so/J1TUtvR2

Got a burning idea for an episode, or a SaaS question you absolutely must know the answer to? Leave us a voice memo: https://www.speakpipe.com/SaasThatApp. 

#Cybersecurity #CVE #PHP #PatchManagement #SaaS #PHP2Shell #AIinSecurity #ClaudeAI #IncidentResponse #DevSecOps


Highlights:

• [02:42] Meet the 9.2 PHP2Shell CVEs
• [04:01] The CVE That Gave a Warning
• [06:22] Hidden in PHP for 13 Years
• [07:36] AI Just Changed the Security Clock
• [08:13] The Five-Hour Exploit Window
• [10:17] Patch First and Mitigate Second.
• [13:03] The Open-Source Bottleneck
• [17:00] Why One Security Layer Isn’t Enough
• [19:56] Can Claude Fix Legacy PHP?
• [20:41] Tech Debt Always Sends the Bill
• [21:35] Patch Often and Patch Fast
  
  

Episode Resources:

• Byron DeLaMatre on LinkedIn
• Aaron Marchbanks on LinkedIn
• Delta Systems Website

Saas That App is handcrafted by our friends over at: fame.so 
Check out our three most downloaded episodes:

• AI-Assisted Development: Expectations vs. Reality with Richardson Dackam
• How to Price SaaS for Maximum Growth with Dan Balcauski
• You're Shipping Constantly - So Why Aren't You Growing? With Daniel Layfield

We’d love your feedback. Please take a moment to fill out our audience questionnaire:

https://forms.gle/DN8hWFDcE9jwvNKo6

Your input helps us shape future episodes and continue bringing you practical, real-world insights into building B2B web applications.

Bootstrapped SaaS growth, fixed-price AI subscriptions, AI-powered software testing, and the coming SaaS apocalypse all come together in this episode.

Adam Sandman, the Founder and CEO of Inflectra Corporation, joins Aaron Marchbanks and Justin Edwards to share what two decades of building without venture capital looks like. Adam breaks down why he chose a mature market instead of trying to define a new category, and why he’d rather fight 20 competitors for 100% of a market than 100 competitors for 20% of it.

He explains how Inflectra bundles generative AI into a flat-rate subscription on Amazon Bedrock, using model routing, open-weight models, and guardrails to keep token costs predictable. Adam also walks through a self-healing test automation approach that uses AI only when something changes, then plays tests back deterministically.
The big lesson: AI is making it easier to build more, but the hard part is now deciding whether you’re building the right thing, and evolving yourself as a CEO so you don’t become the bottleneck.

What You’ll Learn:

• When bootstrapping makes more sense than raising venture capital
• Why selling into a less crowded market beats fighting for scraps
• How to land with your lowest-friction product, then cross-sell
• How to offer fixed-price AI without losing your margins
• Why AI should do the adaptive work and deterministic code should do the rest
• Where AI is moving the bottleneck in software development
  
  

Adam Sandman is the Founder and CEO of Inflectra Corporation, a bootstrapped software lifecycle management and quality assurance company. He started programming at 10, studied physics at Oxford, and spent eight years in digital transformation at Sapient before going out on his own. Under his leadership, Inflectra has grown from roughly $1M to over $20M in self-reported revenue, with sales teams across North America, EMEA, LATAM, and APAC, and is now moving into AI assurance.

This podcast is brought to you by Delta Systems, your one-stop shop for front-end, back-end, and full-stack software development. At Delta, Justin and Aaron share the same philosophy when it comes to clients: they treat people like colleagues, not just customers. Maybe that’s why Delta typically spends years working with the same companies: how many software engineering firms can you say that about? So, if you’ve got a big SaaS project in mind but have no idea where to start, come and get a free scope and estimate from Delta Systems at: https://deltasystems.com/ 

Got a burning idea for an episode, or a SaaS question you absolutely must know the answer to? Leave us a voice memo: https://www.speakpipe.com/SaasThatApp. 

#BootstrappedStartup #AIPricing #SoftwareTesting #SaaSPricing #AgenticAI

Highlights:

• [02:00] From Coding Games at 10 to Founding Inflectra
• [05:30] Should You Bootstrap or Go VC?
• [10:00] How Google AdWords and SEO Worked for SaaS in 2006
• [11:35] What Inflectra Does and Its Land-and-Expand Sales Strategy
• [16:00] How AI Changed Inflectra's Product
• [20:30] Why Fixed-Price AI Subscriptions Work for SaaS
• [23:00] Guardrails and Fair Use Policies for AI Subscriptions
• [25:30] How AI Redacts Sensitive Data in Software Testing
• [32:00] Does Software Development Need a New Agile?
• [34:30] How Inflectra Grew From Lifestyle Business to Growth Company
• [40:00] Evolving as a CEO So You Don’t Become the Bottleneck

Episode Resources:

• Adam Sandman on LinkedIn
• Inflectra Corporation Website
• Aaron Marchbanks on LinkedIn
• Justin Edwards on LinkedIn
• Delta Systems Website

Saas That App is handcrafted by our friends over at: fame.so 
Check out our three most downloaded episodes:

• AI-Assisted Development: Expectations vs. Reality with Richardson Dackam
• How to Price SaaS for Maximum Growth with Dan Balcauski
• You're Shipping Constantly - So Why Aren't You Growing? With Daniel Layfield

We’d love your feedback. Please take a moment to fill out our audience questionnaire:

https://forms.gle/DN8hWFDcE9jwvNKo6

Your input helps us shape future episodes and continue bringing you practical, real-world insights into building B2B web applications.

Boilerplate privacy policies, data inventories, consent banners, accountability, AI governance, and one especially tricky question: when you put company or client data into ChatGPT or Claude, have you disclosed it to a third party? 

That’s what we’re tackling in this episode. Lindsay Vogel, Partner at Scale LLP, joins Aaron Marchbanks and Justin Edwards to talk about the privacy decisions founders and engineering teams tend to postpone until somebody forces the issue. Lindsay argues that privacy works better when legal, engineering and founders are in the room together early, rather than calling legal after the product has already shipped. 

The big lesson: A privacy policy copied from another SaaS company might look convincing but the problem starts when an actual customer asks what data you hold on them and nobody knows.

What You’ll Learn:

• Why legal, engineering, and founders work better as collaborators
• Why copy-pasting a privacy policy can leave you exposed later
• The simplest way to start mapping the data your company actually holds
• Why somebody needs to “hold the pen” on data and AI decisions
• How “reject all” can sometimes create a better consent experience
• Why AI governance starts with many of the same questions as data governance
• What SaaS teams should know before sending sensitive data into an LLM
  
  

Lindsay Vogel is a Partner at Scale LLP with around 15 years of experience in privacy. Her career has included work at the Department of Homeland Security and FDIC, as well as serving as lead privacy counsel and interim global head of privacy at Bumble. Before joining Scale LLP, she founded Gamut Privacy, where she worked with small and emerging technology companies on privacy and AI governance programs.

This podcast is brought to you by Delta Systems, your one-stop shop for front-end, back-end, and full-stack software development. At Delta, Justin and Aaron share the same philosophy when it comes to clients: they treat people like colleagues, not just customers. Maybe that’s why Delta typically spends years working with the same companies: how many software engineering firms can you say that about? So, if you’ve got a big SaaS project in mind but have no idea where to start, come and get a free scope and estimate from Delta Systems at: https://deltasystems.com/ 

Got a burning idea for an episode, or a SaaS question you absolutely must know the answer to? Leave us a voice memo: https://www.speakpipe.com/SaasThatApp. 

#SaaSBusiness #ProductStrategy #TechFounders #StartupPodcast #SoftwareStartup #B2BStartups 

Highlights:

• [02:22] How Lindsay Fell Into Privacy
• [04:08] Why Privacy Feels Like a Blocker
• [07:24] The Copy-Paste Privacy Trap
• [10:02] When Legal Meets Engineering
• [11:29] Who Actually Owns Privacy?
• [12:25] 6 Questions Your Policy Must Answer
• [13:00] The Case for “Reject All”
• [18:20] Do You Need Multiple Privacy Policies?
• [19:50] Can You Just Change Your Terms?
• [20:21] Is ChatGPT Sharing Your Data?
• [24:47] What AI Governance Actually Needs
• [27:16] Why Regulation Can’t Keep Up

Episode Resources:

• Lindsay Vogel on LinkedIn
• Scale LLP Website
• Aaron Marchbanks on LinkedIn
• Justin Edwards on LinkedIn
• Delta Systems Website

Saas That App is handcrafted by our friends over at: fame.so 
Check out our three most downloaded episodes:

• AI-Assisted Development: Expectations vs. Reality with Richardson Dackam
• How to Price SaaS for Maximum Growth with Dan Balcauski
• You're Shipping Constantly - So Why Aren't You Growing? With Daniel Layfield

We’d love your feedback. Please take a moment to fill out our audience questionnaire:

https://forms.gle/DN8hWFDcE9jwvNKo6

Your input helps us shape future episodes and continue bringing you practical, real-world insights into building B2B web applications.

Before AI can run your business, your business needs something for AI to run on. Isaac Harmon, founder of Harmon Digital and Unstack, joins Aaron Marchbanks and Justin Edwards to talk about where automation hits its limits. They cover the signals that a company has outgrown its systems, why tools like CRMs have lost their moat, and when businesses should import and customize existing software rather than build from scratch. They also dig into how the bottleneck is shifting from the people doing the work to the people checking it, and what that means for anyone relying on orchestration agents.

What You’ll Learn:

• How to spot when a business actually needs foundational systems
• Why private equity is leaning hard into AI employees
• How to think about buy vs. build in an era of no-moat software
• Why Isaac believes the future of SaaS is custom, dynamic software
• How agencies can white-label AI-powered platforms
  
  

Isaac Harmon is the Founder of Harmon Digital, a software development agency that builds custom software, AI agents, and automations to help businesses eliminate repetitive work and scale without adding headcount. He's also the Founder of Unstack, a SaaS platform with a marketplace aimed at replacing fragmented software stacks with custom software built around how businesses actually operate. Isaac got his start in web design when ChatGPT first launched and pivoted fully into AI, and today his work spans clients from London ice cream shops to private equity portfolio companies looking to lever up their human capital with AI employees.

This podcast is brought to you by Delta Systems, your one-stop shop for front-end, back-end, and full-stack software development. At Delta, Justin and Aaron share the same philosophy when it comes to clients: they treat people like colleagues, not just customers. Maybe that’s why Delta typically spends years working with the same companies: how many software engineering firms can you say that about? So, if you’ve got a big SaaS project in mind but have no idea where to start, come and get a free scope and estimate from Delta Systems at: https://deltasystems.com/ 

Got a burning idea for an episode, or a SaaS question you absolutely must know the answer to? Leave us a voice memo: https://www.speakpipe.com/SaasThatApp 

Highlights:

• [02:15] Building Systems That Let a Business Run Itself
• [03:36] The Telltale Signs a Business Has Outgrown Its Operations
• [04:40] Isaac’s Discovery Process and Why Private Equity Is the Sweet Spot
• [06:36] Where Zapier, Lovable, and Base44 Fit in the Stack
• [08:30] “I Need AI” Is Almost Never the Actual Answer
• [10:44] The Limits of Full Automation and the “AI Slop” Problem
• [12:37] Case study: Happy Endings Ice Cream Distribution
• [14:47] The One That Didn’t Work: An AI Fencing Quote System
• [17:54] Unstack's Thesis: A SaaS Platform with a Marketplace for Custom Software
• [22:28] White-Labeling Unstack for Agencies
  
  

Episode Resources:

• Isaac Harmon on LinkedIn
• Harmon Digital Website
• Unstack Website
• Aaron Marchbanks on LinkedIn
• Justin Edwards on LinkedIn
• Delta Systems Website

Saas That App is handcrafted by our friends over at: fame.so 
Check out our three most downloaded episodes:

• AI-Assisted Development: Expectations vs. Reality with Richardson Dackam
• How to Price SaaS for Maximum Growth with Dan Balcauski
• You're Shipping Constantly - So Why Aren't You Growing? With Daniel Layfield

We’d love your feedback. Please take a moment to fill out our audience questionnaire:

https://forms.gle/DN8hWFDcE9jwvNKo6

Your input helps us shape future episodes and continue bringing you practical, real-world insights into building B2B web applications.

Serial SaaS Founder Joseph Lee, CEO of Supademo, on agentic AI, interactive product demos, and building an AI-native SaaS company. In this episode of SaaS That App, he joins host Aaron Marchbanks to discuss how SaaS founders can navigate rapid technological shifts, build products that survive market disruption, and think strategically about agentic AI without chasing trends blindly.

Joseph shares the story of how a demand-driven seafood marketplace nearly collapsed during COVID and pivoted into what eventually became Supademo. He and Aaron explore why product-market fit has become perishable, why customer expectations have made “ship it while you're embarrassed” obsolete, and how the compressed reinvention cycle has become an unfair advantage for operations that can move fast.

What You’ll Learn:

• The hard-won lessons from building two SaaS companies past $3M ARR
• Why “the market trumps the founder”
• How the traditional “book a demo” model is broken
• Supademo’s evolution from a lightweight PLG tool to an AI-powered platform to a fully agentic system
• The practical realities of going AI-native
• How founders at established SaaS companies should start thinking about breaking their product into units of work that agents can call
  
  

Joseph Lee is the serial founder of several startups. He was the Founder of Coastline Market, his first startup, before co-founding Supademo, where he serves as CEO. Joseph helped Supademo cross $3M ARR, building the company through three distinct product eras: a self-serve interactive demo tool, an AI-powered platform, and, as of June 2026, a fully agentic demo platform with an always-on AI Demo Agent. He is a frequent writer and speaker on go-to-market strategy, lean AI-native team building, and the practical mechanics of adopting agentic AI in SaaS.

This podcast is brought to you by Delta Systems, your one-stop shop for front-end, back-end, and full-stack software development. At Delta, Justin and Aaron share the same philosophy when it comes to clients: they treat people like colleagues, not just customers. Maybe that’s why Delta typically spends years working with the same companies: how many software engineering firms can you say that about? So, if you’ve got a big SaaS project in mind but have no idea where to start, come and get a free scope and estimate from Delta Systems at: https://deltasystems.com/ 

Got a burning idea for an episode, or a SaaS question you absolutely must know the answer to? Leave us a voice memo: https://www.speakpipe.com/SaasThatApp 

Highlights:

• [00:52] The Naivety vs. Pragmatism Balance
• [03:02] From Seafood Marketplace to SaaS Pivot
• [06:00] Three Eras in Three Years: PLG - AI-Powered - Agentic
• [11:35] Product-Market Fit Is Now Perishable
• [13:16] What’s Actually Broken About “Book a Demo”
• [17:09] Where the Human Line Sits
• [20:31] Inside a 15-Person AI-Native Team
• [25:35] Guardrails, Read-Only Access, and Anonymization
• [26:59] Trusting an Agent to Represent Your Company
• [29:03] The “Unit of Work” Framework for Going Agentic
• [32:10] Advice to His Younger Self
• [36:10] The One Agent Joseph Wishes Existed
  
  

Episode Resources:

• Joseph Lee on LinkedIn
• Supademo Website
• Aaron Marchbanks on LinkedIn
• Justin Edwards on LinkedIn
• Delta Systems Website

Saas That App is handcrafted by our friends over at: fame.so 
Check out our three most downloaded episodes:

• AI-Assisted Development: Expectations vs. Reality with Richardson Dackam
• How to Price SaaS for Maximum Growth with Dan Balcauski
• You're Shipping Constantly - So Why Aren't You Growing? With Daniel Layfield

We’d love your feedback. Please take a moment to fill out our audience questionnaire:

https://forms.gle/DN8hWFDcE9jwvNKo6

Your input helps us shape future episodes and continue bringing you practical, real-world insights into building B2B web applications.

A file-upload vulnerability in Rails Active Storage just scored a 9.5 out of 10 on the severity scale, high enough that, as Justin Edwards puts it: "Everybody stop what you're working on and get this patched." In this episode of SaaS That App, Aaron Marchbanks and Justin break down what made this one so dangerous (anonymous, unprivileged file uploads were enough to compromise a server), why it took two separate patches to actually close the hole, and how they decided which client projects needed a full credential rotation and which didn't.

What You'll Learn:

• Why this CVE was "as bad as it gets;" vulnerable by default, exploitable by anyone with file upload access, and one step away from full remote code execution
• The real difference between patching a vulnerability and actually remediating it (hint: rolling every API key and secret your app touches)
• How Justin used two real client situations,  a three-person beta test vs. a consumer app with thousands of users, to decide when "assume breach" is overkill and when it's non-negotiable
• The concentric circles (and Swiss cheese) framework for layering security so no single failure becomes catastrophic
• Why AI hasn't triggered the predicted vulnerability apocalypse, and might actually be helping more than hurting
• The homeownership metaphor for why "done building" doesn't mean "done maintaining"
  
  

This podcast is brought to you by Delta Systems, your one-stop shop for front-end, back-end, and full-stack software development. At Delta, Justin and Aaron share the same philosophy when it comes to clients: they treat people like colleagues, not just customers. Maybe that’s why Delta typically spends years working with the same companies: how many software engineering firms can you say that about? So, if you’ve got a big SaaS project in mind but have no idea where to start, come and get a free scope and estimate from Delta Systems at: https://deltasystems.com/ 

Got a burning idea for an episode, or a SaaS question you absolutely must know the answer to? Leave us a voice memo: https://www.speakpipe.com/SaasThatApp 
Highlights:

• [01:28] What Is a CVE, Anyway?
• [03:19] The Rails Active Storage Vulnerability Explained
• [06:35] The Race Between Disclosure and Exploitation
• [09:43] When to Roll and When to Accept Risk
• [11:31] Why Environment Isolation Saves You in a Crisis
• [13:52] Is AI Going to Cause a Vulnerability Explosion?
• [14:35] Concentric Circles and Swiss Cheese
• [17:26] Why Every SaaS Founder Needs to Budget as Homeowners
• [19:29] The One Thing Every Team Should Automate

Episode Resources:

• Aaron Marchbanks on LinkedIn
• Justin Edwards on LinkedIn
• CVE Record
• Rails Security Advisory
• Delta Systems Website

Saas That App is handcrafted by our friends over at: fame.so 
Check out our three most downloaded episodes:

• AI-Assisted Development: Expectations vs. Reality with Richardson Dackam
• How to Price SaaS for Maximum Growth with Dan Balcauski
• You're Shipping Constantly - So Why Aren't You Growing? With Daniel Layfield

We’d love your feedback. Please take a moment to fill out our audience questionnaire:

https://forms.gle/DN8hWFDcE9jwvNKo6

Your input helps us shape future episodes and continue bringing you practical, real-world insights into building B2B web applications.

AI-powered SOC 2 compliance for SaaS startups is transforming how early-stage founders tackle audit readiness, and Varun Jain is leading the charge. The co-founder and CEO of ComplyJet joins hosts Aaron Marchbanks and Justin Edwards in this episode of SaaS That App to break down why compliance doesn’t have to be the terrifying, expensive nightmare most early-stage founders assume it is.

What You’ll Learn:

• How ComplyJet uses AI to slash the cost and complexity of SOC 2, HIPAA, and other certifications for companies under 200 people
• Why the security industry has profited from fear-based selling for too long
• What founders should actually be doing from day one to avoid racking up compliance debt
• When to pursue your first certification
• The critical difference between security and compliance
• How non-human AI agent identities are becoming one of the hottest issues in cybersecurity
  
  

Varun Jain is the Co-founder and CEO of ComplyJet, an AI-powered compliance platform that helps early-stage SaaS companies get audit-ready for SOC 2, HIPAA, and other frameworks without the traditional cost or complexity. Born and raised in India with an engineering undergrad and a Stanford MBA, Varun spent roughly fifteen years building products across fintech, ecommerce, and enterprise AI.

After watching founders repeatedly panic over compliance questionnaires and paying high six figures himself for basic security reviews, he cold-called 70 people to validate a better approach and launched ComplyJet about two years ago. Today, his deliberately small team serves SaaS companies with fewer than 200 people across more than 25 countries, built on a philosophy of staying in one lane, delivering founder-led customer support, and using AI to reinvent compliance workflows rather than automate broken ones.

This podcast is brought to you by Delta Systems, your one-stop shop for front-end, back-end, and full-stack software development. At Delta, Justin and Aaron share the same philosophy when it comes to clients: they treat people like colleagues, not just customers. Maybe that’s why Delta typically spends years working with the same companies: how many software engineering firms can you say that about? So, if you’ve got a big SaaS project in mind but have no idea where to start, come and get a free scope and estimate from Delta Systems at: https://deltasystems.com/ 

Got a burning idea for an episode, or a SaaS question you absolutely must know the answer to? Leave us a voice memo: https://www.speakpipe.com/SaasThatApp 

Highlights:

• [02:40] From India to Silicon Valley to Compliance
• [04:42] Why the Least Glamorous Category Is Perfect for AI-Based Tooling
• [07:07] Cold-Calling 70 Founders to Validate the Idea
• [10:38] Mid-roll: Delta Systems
• [11:27] Winning on Customer Service
• [14:31] When Should Founders Start Thinking About Compliance?
• [18:28] Debunking the “I Have the Certificate, I'm Safe” Mindset
• [25:13] The New AI Compliance Frontier
• [29:18] Compliance Debt: What Founders Should Do From Day One
• [30:50] Varun’s Contrarian Take
• [33:26] Why Varun Left Enterprise AI for Something That Felt Less Ambitious
  
  

Episode Resources:

• Varun Jain on LinkedIn
• ComplyJet Website
• Aaron Marchbanks on LinkedIn
• Justin Edwards on LinkedIn
• Delta Systems Website

Saas That App is handcrafted by our friends over at: fame.so 
Check out our three most downloaded episodes:

• AI-Assisted Development: Expectations vs. Reality with Richardson Dackam
• How to Price SaaS for Maximum Growth with Dan Balcauski
• You're Shipping Constantly - So Why Aren't You Growing? With Daniel Layfield

We’d love your feedback. Please take a moment to fill out our audience questionnaire:

https://forms.gle/DN8hWFDcE9jwvNKo6

Your input helps us shape future episodes and continue bringing you practical, real-world insights into building B2B web applications.

Justin Edwards had a hyper-specific problem: he wanted a better way to drill German grammar, but the tool he wanted didn’t exist. So he described it to Claude and, roughly eight hours later, had a working app. In this episode of SaaS That App, Aaron Marchbanks and Justin use Schleifer as a real-world experiment in what happens when AI makes small, niche software ideas cheap and fast enough to build yourself. They get into why this could put pressure on micro-SaaS products, why trust and expertise may become the new moat, where vibe coding stops being safe, and why the same technology could turn thousands of people who never considered themselves founders into software entrepreneurs. 

What You’ll Learn:

• Why AI makes software ideas that were previously too niche or commercially impractical worth building
• Why relationships, trust, and expertise may become stronger competitive moats as software itself gets easier to create
• Why handling personally identifiable information changes the security equation for AI-built applications
• How a product built for "five other people" could uncover a much larger underserved community
  
  

This podcast is brought to you by Delta Systems, your one-stop shop for front-end, back-end, and full-stack software development. At Delta, Justin and Aaron share the same philosophy when it comes to clients: they treat people like colleagues, not just customers. Maybe that’s why Delta typically spends years working with the same companies: how many software engineering firms can you say that about? So, if you’ve got a big SaaS project in mind but have no idea where to start, come and get a free scope and estimate from Delta Systems at: https://deltasystems.com/ 

Got a burning idea for an episode, or a SaaS question you absolutely must know the answer to? Leave us a voice memo: https://www.speakpipe.com/SaasThatApp 

Highlights:

[00:02:55] Why Justin Built His Own German Learning Tool

[00:08:38] What It’s Actually Like Building With Claude

[00:12:53] Do You Still Need To Be An Engineer To Build Software?

[00:15:11] If Anyone Can Build Software, What Becomes The Moat?

[00:19:48] Drawing A Hard Line For Vibe Coding 

[00:22:26] An Exciting Future: The New Wave Of Entrepreneurs

Episode Resources:

• Aaron Marchbanks on LinkedIn
• Justin Edwards on LinkedIn
• Supabase Website
• Resend Website
• Delta Systems Website

Saas That App is handcrafted by our friends over at: fame.so 
Check out our three most downloaded episodes:

• AI-Assisted Development: Expectations vs. Reality with Richardson Dackam
• How to Price SaaS for Maximum Growth with Dan Balcauski
• You're Shipping Constantly - So Why Aren't You Growing? With Daniel Layfield

We’d love your feedback. Please take a moment to fill out our audience questionnaire:

https://forms.gle/DN8hWFDcE9jwvNKo6

Your input helps us shape future episodes and continue bringing you practical, real-world insights into building B2B web applications.