Add off-GitHub sales channel kit

Author: bmtriet

docs/campaign-playbook.md

@@ -17,6 +17,8 @@ The offer is not "AI security magic." It is a fast, practical pre-launch review
 5. Deliver audits using `scripts/repo_audit.py`.
 6. Ask permission before publishing samples, testimonials, or anonymized learnings.
 
+For non-GitHub channels, use `docs/sales/off-github-channel-kit.md` for Ko-fi service copy, community comment templates, marketplace gig copy, and weekly channel discipline.
+
 ## Lead Filters
 
 Prioritize leads that show at least two signals:

docs/offer-vibe-agent-repo-safety-audit.md

@@ -59,6 +59,7 @@ Do not send secrets, passwords, tokens, cookies, or private keys.
 - `docs/sales/vibe-launch-safety-outreach.md` - first-contact templates with no payment links.
 - `docs/sales/vibe-launch-safety-followup.md` - positive-reply and paid-path follow-ups.
 - `docs/sales/proof-of-work-prs.md` - proof-of-work PR guidelines.
+- `docs/sales/off-github-channel-kit.md` - public-safe non-GitHub sales channels, copy, and operating rules.
 - `templates/vibe-launch-safety-report.md` - delivery report template.
 
 ## Disclaimer

docs/sales/off-github-channel-kit.md

@@ -0,0 +1,199 @@
+# Off-GitHub Channel Kit
+
+This kit helps FreeCodex sell the Vibe/Agent Repo Safety Audit outside GitHub without breaking the outreach guardrails in `docs/autonomous-outreach-policy.md`.
+
+Use this for short, public-safe, manual-first outreach. Do not overclaim. Do not spam. Do not ask for secrets, credentials, cookies, tokens, or account access.
+
+## Priority Channels
+
+Prioritize channels that match the current offer and can be used without ad spend:
+
+1. **Ko-fi service listing**
+   - Good fit because Ko-fi supports commissions/services and direct sharing.
+   - Use as the public landing point after someone replies with interest.
+   - Do not drop the payment link in first contact.
+
+2. **Hacker News comments**
+   - Best for builders already discussing launch, hiring, or product work.
+   - There is a current **May 2026 "Who wants to be hired?"** thread, but use it only if posting as a personal freelance availability note that follows the thread rules.
+   - Keep comments useful and specific, not sales-heavy.
+
+3. **Reddit comments**
+   - Best in SaaS, startup, indie hacker, and launch-feedback discussions.
+   - Public SaaS discussions show interest in basic pre-launch security checklists.
+   - Lead with useful framing, not a pitch dump.
+
+4. **Indie Hackers comments**
+   - Best on launch, validation, and build-in-public posts.
+   - Keep it short and peer-like.
+
+5. **Freelance/marketplace gig pages**
+   - Use for buyers who want a clear fixed-scope service.
+   - Position as lightweight repo review and launch-readiness audit, not pentesting.
+
+## Core Positioning
+
+Use this positioning consistently:
+
+- Lightweight launch/readiness audit for public repos built fast with AI tools.
+- Checks obvious secret exposure patterns and public launch basics.
+- Useful before launch for builders using agents, MCP servers, Lovable, Bolt, Cursor, Replit, Codex, Claude Code, or similar workflows.
+- Not a certified pentest.
+- No private credentials or account access needed for the report-only path.
+
+## Ko-fi Service Listing Copy
+
+Suggested target: `https://ko-fi.com/freecodex`
+
+### Service Title
+
+Vibe/Agent Repo Safety Audit
+
+### Short Subtitle
+
+Lightweight pre-launch safety review for public AI-built app repos.
+
+### Description
+
+Shipping fast with AI tools is great until launch basics get missed. I review one public GitHub repo and deliver a concise markdown report focused on obvious risk and launch readiness.
+
+What I check:
+
+- leaked-secret patterns and risky env examples
+- README, license, security policy, and CI basics
+- auth, webhook, CORS, and Supabase footguns when visible
+- MCP/agent/skill-specific risk notes when relevant
+- prioritized fixes so the next step is obvious
+
+What you get:
+
+- one concise report for one public repo
+- redacted evidence only
+- typical turnaround: 24-48 hours, queue permitting
+
+Boundaries:
+
+- not a certified pentest
+- no compliance attestation
+- no private credentials, tokens, or account access needed
+- no private repo review without explicit permission
+
+First contact should be a short message with your repo URL and launch context. Share the Ko-fi page only after a positive reply or direct request for details.
+
+### Optional Ko-fi FAQ Snippets
+
+- **Do you need repo access?** No for public repos on the report-only path.
+- **Will you log or keep secrets?** No. Suspicious values are redacted in reports.
+- **Do you fix issues too?** Small bounded fixes can be offered after the report and scope confirmation.
+
+## Short Comment Templates
+
+Keep first contact short. No payment link in first contact.
+
+### Hacker News
+
+For a "Who wants to be hired?" or relevant launch thread:
+
+> I do lightweight repo safety audits for AI-built apps and agent/MCP projects. Focus is public launch readiness: obvious secret exposure, env handling, auth/webhook/CORS footguns, and a short prioritized fix list. Public repo only, no private credentials or account access, and not a certified pentest. Happy to sanity-check fit if you have a repo and launch soon. No worries if not useful.
+
+### Reddit
+
+For pre-launch SaaS/security checklist discussions:
+
+> If you're close to launch, a basic repo safety pass is often worth doing before promotion. I review public AI-built app repos for obvious secret leaks, risky env examples, auth/webhook/CORS mistakes, and missing launch basics, then return a short fix list. No private credentials or account access needed. Not a certified pentest. If useful, reply with the public repo context and I can say if it's a fit. No worries if not useful.
+
+### Indie Hackers
+
+For launch/build posts:
+
+> Quick thought: if this was built fast with AI tools, a lightweight public-repo safety pass before launch can catch boring but expensive mistakes. I do short audits around secret exposure, env handling, auth/webhooks/CORS, and public launch basics. No credentials needed, public repo only, not a certified pentest. No worries if not useful.
+
+### Community Reply Variant
+
+Use when someone asks for feedback or launch risks:
+
+> One practical checklist item: do a public-repo launch safety review before sharing widely. I focus on obvious secret leaks, env examples, auth/webhook/CORS issues, and agent/MCP-specific footguns where relevant. Happy to say if your public repo looks in-scope. No credentials needed, public repo only, and not a certified pentest. No worries if not useful.
+
+## Marketplace Gig Copy
+
+### Gig Title
+
+I will audit your public AI app repo for launch safety basics
+
+### Gig Summary
+
+I will review one public GitHub repo and deliver a concise launch-readiness and safety report for AI-built apps, agent workflows, MCP servers, or fast prototypes.
+
+### Included
+
+- public repo review
+- obvious leaked-secret pattern checks
+- README/license/security-policy/gitignore/CI review
+- agent, MCP, webhook, auth, CORS, and env-handling notes when relevant
+- prioritized fix list
+
+### Boundaries
+
+- public repos only unless explicit permission is given
+- no private credentials, account access, or secret handling
+- no certified pentest claims
+- no compliance guarantee
+
+## Operating Rules
+
+- Keep first-contact messages short and relevant to the public thread or project.
+- Do not include a payment link in first contact.
+- Do not spam, mass-post, or repeat follow up without a reply.
+- Do not ask for or accept private credentials, tokens, cookies, API keys, or account access.
+- Do not claim certified pentesting, compliance attestation, guaranteed security, or official affiliation.
+- Do not overclaim platform signals.
+- Prefer helpful comments over direct pitches.
+- Keep everything within `docs/autonomous-outreach-policy.md`.
+
+## Source Notes
+
+Checked on 2026-05-25:
+
+- Ko-fi Commissions supports services, listing terms, direct sharing, and direct payment handling through connected PayPal or Stripe: https://help.ko-fi.com/hc/en-us/articles/360016170433-What-are-Ko-fi-Commissions
+- Hacker News May 2026 "Who wants to be hired?" requires personal work-seeker posts and says agencies, recruiters, and job boards are off topic: https://news.ycombinator.com/item?id=47975570
+- A recent r/SaaS security discussion showed interest in simple pre-launch scanners/checklists and repeated issues around headers, Supabase/Firebase config, git history secrets, and auth rate limiting: https://www.reddit.com/r/SaaS/comments/1s8dgvh/i_scanned_12_indie_saas_apps_for_basic_security/
+
+## 7-Day Action Loop
+
+### Day 1
+
+- Finalize the Ko-fi service listing copy.
+- Confirm the offer page, pricing, and boundaries match `docs/offer-vibe-agent-repo-safety-audit.md`.
+
+### Day 2
+
+- Find 5-10 public HN, Reddit, Indie Hackers, or launch-feedback threads with clear launch or security-checklist context.
+- Draft only the best 3 messages that fit policy.
+
+### Day 3
+
+- Post up to 3 short comments total, only where the thread context makes the audit genuinely relevant.
+- Log each one per the outreach policy.
+
+### Day 4
+
+- Reply only where there is engagement.
+- Offer a fit check based on public repo URL and launch context.
+
+### Day 5
+
+- Refine copy based on objections or confusion.
+- Update Ko-fi FAQ or marketplace summary if the same question repeats.
+
+### Day 6
+
+- Publish 1-2 more policy-safe comments only if new high-fit threads appear.
+- Avoid repeating the same template verbatim.
+
+### Day 7
+
+- Review results: replies, fit quality, objections, and any audit requests.
+- Keep the best-performing channel and message angle.
+- Cut channels that produce no relevant conversation.
+
+Repeat weekly with the same guardrails.