Get Past the Prototype

Every check your app makes, read off in three no-judgement observations — what it guards, whose computer it runs on, what it decides from — routing each to ENFORCED / TRUSTS THE BROWSER / FINE IN THE BROWSER. A server-side check that reads a browser-sent value still reads exposed. Rolls up to LINE HOLDS / LINE LEAKS / NO LINE and names the row to fix first. One .xlsx; grades the build, never a person.

Row-level security read off one row per table and per operation — because “RLS enabled” is a badge, not an answer. A policy that admits everyone still reads OPEN TABLE; a browser-reachable service-role key rewrites the whole matrix to PROJECT OPEN. Rolls up to TABLES LOCKED / GAPS IN THE POLICIES / PROJECT OPEN and names the row to fix first. One .xlsx; grades the config, never a person.

A login says who you are, never whether this record is yours — two different questions. One row per route, four observations, routing to AUTHORIZED / MEMBERSHIP IS ENOUGH / LOGGED-IN ONLY / NOBODY IS CHECKING. A signed-in-only route taking the record id from the request drops to the floor. Rolls up to PERMISSIONS HOLD / SIGNED IN IS DOING TOO MUCH / ANYONE CAN WALK IN. One .xlsx; grades the build, never a person.

Your checkout page working is not your money path working. One row per step — does money change hands, does the processor’s webhook trigger it or the browser landing on a page, where’s the amount from, would running it twice matter. Routes CONFIRMED / DISPLAY ONLY / TAKEN ON TRUST / NOT HANDLED. Rolls up to MONEY PATH HOLDS / PATH CAN BE FORGED / PATH BREAKS. One .xlsx; grades the flow, never a person.

Some keys are meant to ship in the page; some must never leave your server, and nothing about the string tells you which. One row per key: which kind, where it lives, whether it’s ever been reachable, whether it’s been rotated. Relocation is not remediation — a once-exposed secret reads ROTATE NOW wherever it now sits. Rolls up to KEYS HELD / KEYS MISPLACED / KEYS BURNED. One .xlsx; never asks for a key value.

Almost everything an app plugs into has a sandbox and a real one, and nobody wires them all in one sitting — so they drift. One row per service: which mode your work reaches, which your live app reaches, whether they share an account. Routes SEPARATED / NO SEPARATE MODES / PROD ON TEST / DEV ON LIVE. Rolls up to LINES SEPARATE / POINTING AT THE SANDBOX / WIRES CROSSED. One .xlsx; grades the wiring, never a person.

Every table holds rules — rows belong to someone, an email is unique, a price is money — and the only question is who enforces them, the table or you. One row per table read straight off your table editor. A records table with no owner column reads NOTHING TO ENFORCE AGAINST however clean the rest. Rolls up to MODEL HOLDS / YOU ARE THE CONSTRAINT / NOTHING TO BUILD ON. One .xlsx; sees no rows, grades the shape.

For the moment an AI tool hands you a change and the only button is Accept. It never judges the code — it asks the question you can answer: if this is wrong, can you get back? One row per pending change; on a schema or money change a restorable copy is required. Routes SAFE TO ACCEPT / NOTHING AT RISK / CHECKPOINT FIRST / DO NOT ACCEPT YET, rolling up to YOU CAN GET BACK / SAVE BEFORE YOU ACCEPT / ONE-WAY DOOR. One .xlsx.

The day you added a login you started holding things that belong to other people. This is an inventory of what you ended up with — it names no law and makes no legal determination. One row per field: is it a person’s information, does a feature use it, do uncontrolled copies exist, could you delete it. Deleting the row isn’t getting rid of the value if it’s also in a log. Rolls up to YOU CAN ACCOUNT FOR IT / MORE THAN YOU NEED TO HOLD / HOLDING IT FOREVER. One .xlsx; not legal advice.

Nine areas of a small app, two questions each: can you name it, and have you seen it yourself. It ranks GOING ON BELIEF below CANNOT EXPLAIN IT — a gap you admit is already on your list; a belief you never checked is the one you skip. Routes YOU CAN EXPLAIN IT / DOES NOT APPLY / CANNOT EXPLAIN IT / GOING ON BELIEF, rolling up to YOU KNOW YOUR OWN APP / YOU KNOW WHAT YOU DO NOT KNOW / GOING ON BELIEF. The line’s map — names no product. One .xlsx.