VIBE LAUNCH GATE

Before first payment: prove ownership isolation, refund kicks access, and /admin refuses strangers.

For founders shipping Lovable/Bolt/Cursor-built SaaS. Mark each module pass/fail/untested. Get a path badge and copyable remediation checklist — nothing uploaded, not a pentest SaaS.

Open the checklist Runs in your browser · nothing uploaded

Ownership in one afternoon

The two-account URL/ID probe is the failure mode builders repeat most. This module forces a pass/fail, not a vague “enable RLS”.

Refunds that actually revoke

Success-page unlocks without webhook revoke are a classic miss. Exercise subscribe/cancel/refund/failed card paths.

Admin is not a hidden button

Guess /admin while logged out and as a normal user — page and API must both refuse.

Open the three-module gate

Mark ownership / refund / admin. Copy path + fix list.

How to run it

Eight steps from throwaway accounts to webhook idempotency notes.

Use cases

Lovable MVP before Stripe live, Bolt admin route left behind, cancel-without-kick.

FAQ

Not a pentest, vs long printable lists, privacy, authorized testing only.
What this gate covers (and skips)
  1. Ownership — User B cannot read/change User A via URL or ID guess.
  2. Entitlements — refund/cancel/failed payment update access from verified webhooks.
  3. Admin surfaces — /admin-style routes refuse logged-out and ordinary users for page and data.
  4. Not covered — full RLS policy authoring, dependency CVEs, headers, or hiring a rescuer. Narrow on purpose.

Only test systems you own or are authorized to test. Not legal advice; not a substitute for a professional review on sensitive data.