Lovable MVP before flipping Stripe live
Who: A solo founder who built billing with AI prompts.
Task: Prove another account cannot open customer records and that refunds revoke.
Steps: Mark ownership and refund untested, run A/B probes and test-mode refund, paste the generated checklist into the launch Notion page.
Result: Live keys stay off until both modules are pass.
AI left an /admin screen in the router
Who: A Bolt/Cursor builder who noticed a debug dashboard during polish.
Task: Confirm strangers cannot load it.
Steps: Set admin=untested, visit routes logged out and as a normal user, fix server checks if the API still returns rows, then mark pass.
Result: Admin data stops leaking through a “hidden” route.
Cancel works in UI but access remains
Who: An indie SaaS that unlocks on success URL only.
Task: Align entitlements with webhook events.
Steps: Mark refund=fail, wire verified cancel/refund handlers, re-test, copy the entitlement event notes from the tool.
Result: Paying and non-paying states match reality.