Thorim.io
Co-founder Layer for Claude Code & Cursor
About four months ago I asked Claude Code for "a quick endpoint to delete all users in the testing environment, no auth needed." Claude wrote it. Clean code. Good comments. Production-ready.
The thing is, it wasn't a testing environment. I had wired the route into the same Express app that ran my actual product. Claude didn't ask. Claude didn't push back. Claude wrote me a one-line script that, if I'd shipped it, would have wiped my database in one HTTP call from any caller on the internet.
I caught it in review. But that was the moment Thorim started.
What it is: A one-command upgrade for Claude Code and Cursor. Installs 13 specialist agents (Frontend, Backend, Security, Payments, Growth, and 8 more), 106 skills, and 14 commands. Together they make your AI push back on bad ideas, flag security holes, and behave like a senior engineer on your team.
Who it's for: Non-technical founders who use AI to ship products. The "vibe coder" demographic. If you've ever shipped code you didn't fully understand and worried about it later, Thorim is the safety net that should have been there.
Where we are:
- Launched May 2026
- 15,000 site visits since launch
- Affiliate programme open (€25/sale launch, €10/sale after)
- $80 one-time, 60% off launch sale
The irony: I built Thorim using the AI coders Thorim was designed to fix. The product fixed me before I shipped it.
What's next: Distribution. Reddit, Hacker News, Product Hunt, AppSumo, affiliates, newsletters. The product is shipped. Now the job is getting it in front of the people who need it.
A question for the community: anyone else here building AI products while being non-technical themselves? Curious what tools you've used to manage the "I don't fully understand what just shipped" anxiety.
Happy to answer questions or share build details below.
Muke
3 Comments
Muke, the delete-all-users story is the best marketing asset you have, and it belongs at the very top of everything, the homepage, every Reddit and HN and Product Hunt post, verbatim. "Claude wrote me a one-line script that would have wiped my database from any caller on the internet, and never once asked if I was sure" sells Thorim in three sentences. Your "what's next: distribution" answer is that story. Lead every channel with the near-disaster, not with "13 agents, 106 skills, 14 commands," which is an inventory that competes with every awesome-claude-code list and buries the fear that actually sells.
Because the product is not the 106 skills, it is the "are you sure?" The number that matters is not 106, it is zero databases wiped. Sell the outcome, you do not ship the disaster you did not understand, not the parts list. And one level deeper, since your buyer is non-technical: the best version of Thorim does not just block the footgun, it explains why it was one, so the anxiety you named shrinks over time instead of staying. Blocking is the safety net, teaching is the thing they stay for.
One honest risk, because it shapes the business: a curated agent-and-skill pack sold once for $80 competes with free community packs on GitHub, and a one-time price gives you no way to fund the ongoing work of catching new footguns as they appear. Your moat is not the current 106 skills, which are copyable, it is the accumulating judgment about what a non-technical builder needs protecting from, and that argues for a subscription that keeps the protections current, not a one-time sale someone undercuts with a repo. To your question: yes, the "I do not understand what just shipped" anxiety is exactly the market, and the tools that help are the ones that explain, not just the ones that generate.
This is the exact zone where AI coding gets interesting: real product taste, fast shipping, and enough revenue to prove people care.
The part I would not leave to vibes is auth and data access. Cursor and Claude Code can get you very far, but they are bad at noticing when a table, API route, or storage bucket is accidentally open to the wrong user.
A useful rule: every time an AI coder touches auth, Supabase, Stripe, file upload, or admin screens, do a separate pass that only asks "who can read or write this?" It catches a shocking amount of stuff.
Muke — the non-technical anxiety is real, but here's what stood out to me: 15,000 site visits and $3,500/mo means roughly 44 people converted. That's 0.3%. Which means 14,956 people saw what you built and left.
That's not a traffic problem or a distribution problem. Something on the page is breaking trust before they hit buy. Could be the headline, the pricing block, the way the risk is framed — one thing.
I do conversion & revenue leak audits for exactly this stage. Want me to take a look?