I put a public graffiti wall o... Note

I put a public graffiti wall on my SaaS homepage

Most SaaS homepages feature a static product screenshot to showcase their offering. However, this product's homepage uses an embedded, functional guestbook called "Owners Were Here" instead. This guestbook, built with a widget builder, demonstrates the product's invisible backend by showcasing real, live submissions. The guestbook serves as a proof of concept, highlighting functionality that screenshots cannot convey. A primary reason for this choice is that forms are difficult to convincingly fake in marketing materials. The embedded guestbook aims to provide immediate, compounding social proof through user contributions. This approach leverages a "graffiti wall" aesthetic that fills organically. When exposing a public endpoint, robust security measures are crucial. These include bot detection via Cloudflare Turnstile, rate limiting, schema validation, and size caps to prevent exploitation. Rendering untrusted user input necessitates careful handling to avoid security vulnerabilities like cross-site scripting. Properly sanitizing text using textContent instead of innerHTML is essential for displaying user-generated content safely. A growing guestbook can negatively impact homepage layout and load times. Implementing a viewport with a maximum height and internal scrolling prevents the guestbook from overwhelming the page. While some junk entries are expected, the core security and functionality of the embedded widget are protected by these design choices.