shiptestedThe course · $29
The payment path no scanner checks

Ship the last 20% before you charge for it

The day you turn on payments is the day a bug costs real money — a key that leaked to the browser, a webhook that grants twice, a success URL anyone can type. Automated scanners flag generic issues but never check your payment logic. This is the pre-flight for the money path: six failures — the checkout ones first, plus the data leaks that lose customers — that pass a demo and fail the first real customer. You run each test against your own app and watch red turn green. We don't tell you it's secure; you see it for yourself.

Get the course — $29 Verify first — start free

One-time · lifetime access · 14-day no-questions refund · built for Next.js + Supabase

Working ≠ sellable

Three of the six — the ones that hide worst

AI tools write the happy path. These are the paths they skip — each one reproduced in the course’s runnable reference repo, each one caught by a test.

RLS

Any logged-in user can read every user’s rows

The UI filters by user. The database doesn’t. One crafted request and user B is reading user A’s data.

PAYMENT

A typed success URL grants access

A redirect proves a browser reached a URL — not that anyone paid. Type it, share it, and access turns on.

WEBHOOKS

One purchase, five lifetime licenses

Retries are normal. If your handler isn’t idempotent, every retry hands out access again.

What’s inside

Eight lessons. Every money-path failure comes with a test you run.

Not a course you read — one you run. Clone the repo, watch red turn green, then run the same check against your own app and keep the evidence.

$ git clone … && npm test

✔ RLS policy model: user B receives zero rows owned by user A
✔ success-page visit creates no entitlement
✔ invalid signature is rejected before state changes
✔ same signed order webhook five times grants exactly once
✔ signed event for an unexpected variant grants nothing

tests 5 · pass 5 · fail 0 — red turned green in under a second

That's the reference repo, live. No dependencies, Node 20+. Run it yourself →

0The money path & how to use thisStart
1Test Supabase RLS with two usersData isolation
2The service-role key that skips your RLSData isolation
3What your build ships to the browserSecrets
4A success URL is not a receiptPayment
5Verify the webhook signaturePayment
6One purchase, one entitlementPayment
7The launch checklist — your go / no-goPre-flight
  • ✓Eight lessons — six money-path failures, each with a test you run against your own app, plus an intro and a go/no-go checklist.
  • ✓The reference repo — deliberately vulnerable and fixed versions with red/green tests. No dependencies.
  • ✓The launch-readiness workbook — a fillable pre-flight; per item pass/fail plus an evidence box, ending in a go/no-go.
  • ✓Free v1.x updates — new money-path failure modes as they're added, yours at no extra cost.
One price

Buy it once. Run it before every launch.

$29 USD
one-time · lifetime access + updates
  • ✓8 lessons + reference repo + workbook
  • ✓Every check is runnable against your own app
  • ✓Free updates as new failure modes are added
Get the course — $29

14-day, no-questions refund. Run the lessons against your app. If it doesn’t earn its price, email us within 14 days and we’ll refund you — no forms, no friction.

Who it’s for: AI-assisted Next.js + Supabase apps taking payments with Lemon Squeezy (the webhook checks are provider-neutral and transfer to Stripe, but the worked examples are Lemon Squeezy). Different stack? It won’t fit — please don’t buy it. That’s the honest version.

Proof over promises

Why you can trust this

✓Every claim is a test you run yourself. Nothing here rests on our word — you watch red turn green and run it against your own app.
✓Honest about what green means. Each lesson states exactly what a passing check does and does not prove. No “secure,” no certification.
✓Built with AI, verified by running it. We use AI heavily to produce the material and verify the technical examples by executing them. No fake testimonials, no guaranteed outcomes.
Straight answers

Questions worth asking before you buy

Isn't this just what's in the Supabase and Lemon Squeezy docs?
The docs explain how RLS and webhook signatures work. What they don't hand you is a two-account test to run against your own app, or the failing version next to the fixed one. This is the pre-flight built around those docs — the specific tests that catch the gap, not a re-explanation of the API.
I'm careful and experienced. Do I actually need it?
If you can already run a two-user RLS test, replay a signed webhook five times and still grant access exactly once, and prove access comes from a verified event and not a redirect — you don't, and you shouldn't buy it. It's for when the app looks right and you want to prove it before real money moves. A checklist you run, not a lecture.
What exactly do I get for $29?
Eight lessons across the money path: six failures — RLS data isolation, the service-role bypass, client-bundle secrets, checkout proof, and webhook signature + idempotency — each with a test you run against your own app, plus an intro and a go/no-go launch-readiness workbook. And the reference repo — the same public repo you can clone free below; the lessons are built around it. One self-contained file, yours to keep, with free updates as they're added.
Is this for Stripe or Lemon Squeezy?
The worked examples are Lemon Squeezy. The webhook invariants — verify the raw body, allowlist the payload, dedupe the event — are provider-neutral and transfer to Stripe. But if you want copy-paste Stripe code today, this isn't that yet. The honest version: it's built around Lemon Squeezy.
Is the course itself AI-generated?
Yes, heavily — and that's exactly why every claim ships as a test you run instead of a sentence you trust. The technical examples are verified by executing them. No fake testimonials, no guaranteed outcomes.
Will this make my app "secure"?
No, and it never claims to. It tests one specific, high-blast-radius path — the money path — and shows you how to fix what fails; each lesson states exactly what a passing check does and doesn't prove. It isn't a security audit or a certification.
What if it turns out not to fit my app?
It's for AI-assisted Next.js + Supabase apps taking payments. Different stack and it won't fit — please don't buy it. If you do buy and it's wrong for you, the 14-day, no-questions refund is one reply away: no forms, no friction.
Don't take our word for it

Verify first, then decide

The whole point is that you check, not trust. Three free ways to see the value before you pay a cent. The free repo and Lesson 1 prove the tests are real; the paid course is the other five failures — each with the step-by-step to close it in your app — plus the go/no-go launch workbook.

Free repo

Run the public example

Clone it, break it, run it. Vulnerable and fixed versions of the money path with the tests that tell them apart. No sign-up.

Open on GitHub → Free lesson

Read a full lesson

Lesson 1, complete — the two-user RLS test, the apply-to-your-app walkthrough, and the workbook. The exact paid format.

Read Lesson 1 →
Free checklist

Get the launch checklist

The pre-flight list, free. If it shows you a gap, the course is the fix.