Silktrace is a live SEO research platform. Sign in, connect your own DataForSEO account and investigate any domain’s traffic, keywords, technical health, links and AI search presence in one private workspace. I designed it, built it and run it, from the interface to the threat model.
A multi-tenant web app for SEO research: domain overview, organic keywords, page reports, technical audits, backlinks, dead-link opportunities, competitors, SERPs and AI search evidence, all in one workspace.
The product design, a Next.js app with 41 API routes and 24 pages, a PostgreSQL data model, sign-in, encrypted per-workspace provider credentials, durable task and quota accounting, and a procedural WebGL public site.
It is built for hostile traffic and real money: a written threat model, an authorization class for every route, restore drills and deletion ledgers. Solo-built software with the operating discipline of a team product.
The public site, captured 4 October 2026. The silk surface is procedural WebGL; it responds to motion preferences and pauses when hidden.
Counted from the repository on 4 October 2026.
A demo can stop at the interface. Silktrace has accounts, private data, paid third-party calls and an operations layer, because real people sign up and spend real money through it.
The threat model starts from one line: low expected traffic does not mean trusted users. Every boundary that matters has a control in the code and a test or drill behind it.
| Risk | Control in the code | Checked by |
|---|---|---|
| One customer reads another customer’s research | The server resolves the workspace from the session; PostgreSQL relationships enforce ownership; the app connects as a restricted database role. | Two-workspace integration test against the real database |
| A leaked or reused provider key | One encrypted credential per workspace with a versioned envelope; caches keyed by workspace and credential version; a key re-wrap script for rotation. | Unit tests and an operations script |
| Surprise spend on paid research | Signed approval bound to the exact request at $0.05 or more, atomic quotas and idempotent task keys. | Spending, quota and duplicate-request tests |
| Sign-in abuse and open redirects | Strict OAuth callback and redirect allowlist; public routes have no private or provider access. | Playwright OAuth negative-case matrix |
| A route quietly skips authorization | Every route is classified, from public-static to authenticated-write, with origin checks and idempotency where writes can retry. | Route authorization matrix and edge isolation suite |
| Data loss or a bad deploy | Documented restore runbook, restore verification and drill scripts, a deletion ledger and a release security scan. | Runbook drills |
From the source, tests and operations documents.
A report earns its place by pointing at the next thing to inspect. Three views from the same regional topic show how the hierarchy keeps evidence one step away from every claim.
Step 1 · Read the overview
Saved Palisades report, Silktrace 0.1.48.
Step 2 · Check what the data is
Detail from the same saved Palisades capture.
Step 3 · Ask the next question
A saved keyword investigation in the same topic.
The iteration that shaped it. An early overview led with written assessment, and people had to read before they could scan. I moved the chart and page table back to the main view and put interpretation in Insights. Evidence within reach first; help reading it second.
Every new provider request costs real money. The architecture treats spending as something a person approves, the server accounts for and an interruption can never silently repeat.
The latest run and the last saved audit are stored separately. If a refresh fails, the interface can say so while the earlier findings stay visible, instead of a failed request looking like vanished data.
Coverage also names what the provider did not establish, including Google-selected canonicals and real-user Core Web Vitals. Missing evidence is never quietly turned into zero.
Request new research
Other paths
Simplified from the implementation.
Tests cover cross-workspace access, altered spending approvals, duplicate requests, quota limits and abandoned-task reconciliation.
Next.js and TypeScript, PostgreSQL with Drizzle migrations, DataForSEO, Playwright. Deployed on Vercel behind Cloudflare, with GitHub Actions.
Turning research into a useful product? Start a conversation
All projects ↗Available for select projects and opportunities
Let’s work together. Have a project in mind or a role you’re hiring for? I’d like to hear about it.
Nothing opened? Use Copy address and paste it into your email app.