Vibe-coded launch gate

Mark each module. Your path and remediation checklist update immediately — local only.

1. Two-account ownership (URL / ID isolation)

Untested — have not run A vs B yet Failed — B saw or changed A’s data Passed — B gets empty/403 on A’s URLs and lists

2. Refund / cancel entitlement kick (test mode)

Untested Failed — access stayed after refund/cancel or unlocked on failed card Passed — unlock and revoke follow verified payment events

3. Admin / debug route refusal

Untested Failed — page or API still returns admin data Passed — logged-out and normal users refused (page + data)

Your path

Copyable notes

Action checklist

Authorized testing only. Not a penetration-testing service. Re-check after every deploy that touches auth, schema, or billing.

Why this checklist exists

Multiple independent r/nocode threads describe the same pre-launch failures: cross-user URL access, refunds that do not revoke, and guessable /admin routes. Long printable essays exist; this page is a three-module interactive pass/fail gate with copyable remediation.