This product was not featured by Product Hunt yet. It will not be visible on their landing page and won't be ranked (cannot win product of the day regardless of upvotes).
PayRekha
Stops attackers moving money with your own payout API
PayRekha is an open-source payout firewall. Every outbound payout (loan disbursal, settlement, refund, crypto withdrawal) must match a signed business reason, or it doesn't move, even if attackers hold your keys. Runs in your cloud. No telemetry.
What caught my eye: it doesn't break the payment rails. It gets inside (an exposed staging server, a rebuilt mobile app, a leaked token) & then calls the company's own payout API, with the company's own keys. It sends ₹1 to test the route, then the real amount. Timed for holidays.
I spent 5 years building lending products in India. Almost every control we had asked "who is calling?" That question stops working once the attacker looks exactly like you.
PayRekha asks a different question: why is this money leaving?
🔑 Two keys to move money. The system that approves money (loan system, settlement engine) signs a short intent: amount, account, single use. The payout service can't create one, and neither can an attacker who only stole its key. No matching intent, no payout.
🪙 Knows a penny drop from a probe. Lenders send ₹1 all day to verify accounts; attackers copy the trick. PayRekha tells them apart.
🪔 Tightens on holidays, and plants decoy accounts only an attacker would pay. One touch puts every payout on high alert.
🧪 Safe to try: replay last month's payouts on a laptop, run it in watch-only mode, enforce when you trust it. It's open source (Apache-2.0), runs in your own cloud, has no telemetry, and makes a decision in about 100 µs. It's an alpha, so the thresholds are illustrative and I'd love your toughest feedback.
The name: in the Ramayana, the Lakshman Rekha is a line drawn to protect a home. The demon Ravana couldn't cross it, even in disguise. This is that line, for money.
If you work in payments, fraud or security anywhere, not just India: how does your company check why money leaves, not just who asked?
No comment highlights available yet. Please check back later!
About PayRekha on Product Hunt
“Stops attackers moving money with your own payout API”
PayRekha was submitted on Product Hunt and earned 2 upvotes and 1 comments, placing #137 on the daily leaderboard. PayRekha is an open-source payout firewall. Every outbound payout (loan disbursal, settlement, refund, crypto withdrawal) must match a signed business reason, or it doesn't move, even if attackers hold your keys. Runs in your cloud. No telemetry.
PayRekha was featured in Open Source (69k followers), Fintech (47.7k followers), GitHub (41.5k followers) and Security (3k followers) on Product Hunt. Together, these topics include over 80.5k products, making this a competitive space to launch in.
Who hunted PayRekha?
PayRekha was hunted by Kapil Pawar. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
Want to see how PayRekha stacked up against nearby launches in real time? Check out the live launch dashboard for upvote speed charts, proximity comparisons, and more analytics.
Kapil Pawar
Hey Hunters 👋 I'm Kapil.
On 4 November, India's national cyber agency, CERT-In, issued a critical advisory about an AI-driven attacker hitting lenders, payment companies & crypto exchanges.
What caught my eye:
it doesn't break the payment rails. It gets inside (an exposed staging server, a rebuilt mobile app, a leaked token) & then calls the company's own payout API, with the company's own keys. It sends ₹1 to test the route, then the real amount. Timed for holidays.
I spent 5 years building lending products in India. Almost every control we had asked "who is calling?" That question stops working once the attacker looks exactly like you.
🔑 Two keys to move money.
The system that approves money (loan system, settlement engine) signs a short intent: amount, account, single use. The payout service can't create one, and neither can an attacker who only stole its key. No matching intent, no payout.
🪙 Knows a penny drop from a probe.
Lenders send ₹1 all day to verify accounts; attackers copy the trick. PayRekha tells them apart.
🪔 Tightens on holidays, and plants decoy accounts only an attacker would pay. One touch puts every payout on high alert.
🧪 Safe to try:
replay last month's payouts on a laptop, run it in watch-only mode, enforce when you trust it. It's open source (Apache-2.0), runs in your own cloud, has no telemetry, and makes a decision in about 100 µs. It's an alpha, so the thresholds are illustrative and I'd love your toughest feedback.
👉 Try it in your browser (no install): https://peopleofproduct.github.io/payrekha/
If you work in payments, fraud or security anywhere, not just India:
how does your company check why money leaves, not just who asked?
Follow our work on Linkedin: https://www.linkedin.com/showcase/payrekha/