Launch Readiness

Final verification, 2026-09-06 evening. The core loop no longer gates launch: a brand-new user was driven from signup to a downloaded book in one real run. Launch is still blocked on the items in sections 5 to 8: no waitlist invite mechanism, open signup (and the Supabase project has email confirmation switched off, so addresses are never verified), waitlist tables readable with the public anon key, an admin API with no authentication, and dead tier enforcement.

Mechanisms updated 2026-09-06 after the fixes landed; see the final verification note below the title.

Verdict

MyStoryFlow still cannot invite a waitlist person today, because no invite mechanism exists: waitlist_entries and Supabase Auth are two disconnected systems, and the only admin action is flipping a status column that sends nothing. Signup itself is still open to anyone with the URL, so a “private beta” is private only by obscurity. What changed today is the dead end that used to sit right after signup: the book wizard is no longer nine steps ending in a mandatory Stripe paywall — it is two screens (who the book is about, then a template), and nothing in first-run asks for money. A confirmed new user now lands on /books/new and can create a book and start a chapter without ever seeing a payment screen (§“What changed on 2026-09-06” below). Nobody has ever paid: 0 rows in subscriptions, 0 profiles with a Stripe customer id — that remains true, and is now true by design rather than by a broken checkout. The good news, unchanged: the core user-content tables — profiles, stories, recordings, books, book_chapters, ai_conversations, export_jobs — all have RLS enabled with policies, and every API route audited here does a server-side ownership check, so a signed-in stranger cannot read another user’s stories. The exposure that remains is exactly what it was: waitlist_entries (276 email addresses) is readable and deletable by anyone holding the public anon key, and the admin app’s 32 API routes have no authentication at all. None of that was in scope for today’s fixes. Free-for-waitlist no longer needs the one-line change this section used to recommend — the paywall it targeted doesn’t exist anymore — but an invite mechanism and the admin-app auth gap are still the fastest honest path to 30 users.

Live numbers

Waitlist signups are still arriving (latest 2026-09-06). The last backup was 2026-08-03; 16 signups have arrived since and are not in backups/. These counts are pre-fix and were not re-queried for this update — none of today’s commits write to waitlist_entries, auth.users, subscriptions, or export_jobs in a way that would move them, aside from the throwaway test rows created and deleted during the book-creation and export re-verification (§ the book-creation and recording-to-story pages).

Waitlist → account → first story

What changed on 2026-09-06

• The wizard’s mandatory paywall is gone, not just made skippable. b05b8e3 deleted SubscriptionStep, PrintOrderStep, GoalsStep, RemindersStep, and ReviewAndStartStep outright, along with the Stripe checkout call the wizard used to make. There is no paidStatuses check left to patch — the step it used to gate doesn’t exist.
• The redirect trap at first login is fixed. onboarding_step='welcome' (the default value on every new profile) no longer counts as wizard progress, so a confirmed new user reaches /books/new instead of being routed to a dashboard that then sends them back into a loop. Fixed in b05b8e3.
• The dashboard no longer fabricates stats. The prior four-tile, stat-heavy dashboard (page/word counts, “Quick Insights,” a duplicate continue-card, Elena promoted three times) is replaced by one next-step card, two ways to add a story, the book, and family — nothing invented. ContinueWhereYouLeftOff.tsx and ReEngagementNudge.tsx were deleted. Fixed in 75a4bcc.
• Fake nav destinations are no longer linked. /billing, /orders, /publishing/kdp, and /family/shared are removed from lib/navigation-config.ts. The pages themselves still exist with their hardcoded fake data (e.g. /billing’s “Renews: March 15, 2025”) — they are unreachable from the UI now, not deleted. /export remains linked. Fixed in b05b8e3 (see “Prior blockers, re-verified” below).
• Owner decision, stated for the record: the first-run paywall is removed by design. It now exists again as code behind a flag that defaults to off, so it can be switched on without another release once Stripe is configured — see the checklist at the end of this page.

Billing

Nobody has paid yet and nobody can: STRIPE_SECRET_KEY in .env.local is still the literal placeholder your_stripe_secret_key…, as are the publishable key and the webhook secret. What changed is that the paywall is now built — real when NEXT_PUBLIC_PAYWALL_MODE=onboarding, absent when it is not — so switching it on is a configuration job rather than a code one.

Free for the waitlist

Nothing to do. NEXT_PUBLIC_PAYWALL_MODE is unset, which means off, which means the wizard is two screens and POST /api/books never checks for a subscription. All 67 existing profiles reach /books/new and create a book without a payment screen. Leaving the flag alone is the free-for-waitlist setting.

What’s left of the old “leave billing off” risk analysis still applies to the pages, not the wizard: /billing still renders the hardcoded “Renews: March 15, 2025” and /orders, /publishing/kdp, /family/shared still render invented data if reached directly by URL — they’re only unlinked from navigation now (see “What changed” above), not deleted. /export remains linked and is a real stub with a TODO, not fake data.

Safety for strangers

Advisors, 2026-09-06. Security: 3 ERROR categories, 6 WARN, 1 INFO — 10 categories over 258 findings. Performance: 3 WARN, 2 INFO over 1,277 findings (269 auth_rls_initplan, 529 multiple_permissive_policies, 381 unused indexes, 83 unindexed FKs, 15 duplicate indexes). Performance is noise at 30 users; ignore it for this launch.

Security findings that matter:

The core user-content tables are protected. profiles (4 policies), stories (3), recordings (2), books (13), book_chapters (4), ai_conversations (4), export_jobs (4) and subscriptions (2) all have relrowsecurity = true.

User-content tables with RLS off, from the 53:

waitlist_entries, waitlist_events, waitlist_settings, family_groups, family_members, family_book_permissions, gifts, audit_logs, anonymous_sessions, user_story_timeline, user_writing_patterns, user_ai_interactions, story_characters, story_elements, conversation_turns, conversation_summaries, conversation_contexts, conversation_analytics, voice_conversations, voice_conversation_turns, voice_anonymous_sessions, tools_pdf_flipbooks, experiment_participants.

The anon-key exposure, plainly. Every one of those tables carries SELECT, INSERT, UPDATE, DELETE, TRUNCATE grants for both the anon and authenticated roles (verified via information_schema.role_table_grants). With RLS off, PostgREST applies no further restriction. The anon key ships in every browser bundle by design. Therefore anyone who opens the site can read all 276 waitlist email addresses, names, phone numbers and IP addresses — and can delete or overwrite them with a single request to /rest/v1/waitlist_entries. The same is true of family_groups/family_members/gifts despite their policies, and of audit_logs. This is a live PII exposure today, before any invite is sent, and it grows with every new signup.

The API layer compensates for the tables that matter. Every audited route re-checks ownership server-side, so RLS is not the only line of defence for stories, books and recordings:

Secrets. No 'use client' file references SUPABASE_SERVICE_ROLE_KEY, and no NEXT_PUBLIC_* variable carries it — 45 server-side files use it, none client-side. Live Backblaze B2 credentials remain in tracked files (CLAUDE.md, docs/blog-article-pipeline.md, .claude/skills/blog-publisher.md) and are therefore in git history; they need rotating regardless of what else is fixed.

Rate limiting: none. Zero matches for rateLimit|rate_limit|Ratelimit|upstash in apps/web-app/lib or apps/web-app/app. /api/transcribe and /api/stories/convert have no limiter. The trial endpoints are not the cost bomb they were: /api/trial/generate-story requires an authenticated user and verifies job ownership (app/api/trial/generate-story/route.ts:11-26), and although /api/trial/start:38 calls signInAnonymously() for anyone, auth.users holds 0 anonymous users and trial_sessions holds 1 row, so anonymous sign-in is not producing sessions in practice. The unmetered surface that does matter is the unauthenticated AI and upload routes in the blocker table below. At 30 invited users, a per-IP and per-user limiter on the AI and upload routes is sufficient; a global spend alarm on the OpenAI account is the cheaper backstop.

Sequencing. The owner decided on 2026-08-02 that features come before database hardening (Phase 4 in docs/IMPLEMENTATION_PLAN.md), and that decision stands here. This section states exposure as fact so it can be priced, not to reopen the ordering. One carve-out is worth making anyway, because it is small and self-contained: waitlist_entries is the one table where the exposed data is the launch asset itself, and revoking anon grants on the three waitlist_* tables does not touch app code.

Operations

Prior blockers, re-verified

30-user private beta checklist

Ordered. Sizes: S ≈ under an hour, M ≈ half a day, L ≈ multiple days.

Must land before the first invite

1. S — Revoke anon/authenticated grants on waitlist_entries, waitlist_events, waitlist_settings. No app code reads them through the anon key; the marketing route uses the service role. This closes the 276-address leak without touching the RLS sequencing decision.
2. S — Back up the waitlist. Run scripts/backup/export-waitlist.js; the current artefact is 34 days and 16 signups stale, and step 1 should not be the first thing you do to a table you have no fresh copy of.
3. S — Take the paywall out of first-run. Done 2026-09-06 (b05b8e3). The wizard step was deleted, not bypassed.
4. Partly done 2026-09-06 (b05b8e3) — hide the fake surfaces. /billing, /orders, /publishing/kdp, /family/shared are removed from lib/navigation-config.ts. Still open: the pages themselves still exist and still render fake data if reached directly, and /export is still linked (it’s a real stub, not fake data, so lower priority).
5. M — Build the invite. The smallest honest version: an admin action that generates a single-use token, stores it against the waitlist_entries row, emails a signup link, and makes invitationToken required at app/api/auth/signup/route.ts:53 when a beta flag is on. Without the required half, “private beta” means “anyone with the URL”.
6. S — Put the admin app behind auth, or take it off the internet. 32 unauthenticated service-role routes, one of which grants admin on an unauthenticated PATCH. If a real guard is too slow, restrict the deployment to an allowlisted IP or take it down for the beta.
7. S — Ship account deletion, or remove the button. The UI promises deletion and calls a route that does not exist. A stub route that soft-deletes and emails you is acceptable; a button that lies is not.
8. S — Point RESEND_FROM_EMAIL at a domain you control for this product, and confirm SPF/DKIM in the Resend dashboard before sending to 276 addresses at once. Invites from workbeehive.com will land in spam and burn the list.

Can follow within the first week

9. S — Fix profiles.eq('user_id') → .eq('id') at subscription-service.ts:47, and reconcile trial_end vs trial_ends_at. Nothing is enforced until this is right, so it is not urgent while everything is free — but it is a one-character fix that unblocks all tier work.
10. S — Add error monitoring. With 3 active users a month, no monitoring meant nobody noticed; with 30 it means you learn about breakage from an email. Sentry, or a console.error drain from Vercel logs.
11. M — Re-send verification to the 106 entries that never got an OTP, using the working-tree resend path, after step 8. These are people who tried to join and were silently dropped.
12. M — Rate-limit the unauthenticated AI and upload routes, and set a hard monthly spend cap on the OpenAI account as a backstop.
13. S — Add authentication to the three upload endpoints (upload/backblaze, upload-url, upload/delete); upload-url is a read-SSRF and upload/delete can destroy an unrelated customer recording.
14. S — Strip the SOC 2 / ISO 27001 claims from apps/docs-app/content/security.mdx:19-20 before the docs site has an audience.
15. S — Rotate the B2 credentials committed to CLAUDE.md and two other tracked files.
16. M — Link Privacy and Terms from the signup form, and drop the mock-notification fallback at app/notifications/page.tsx:102.
17. M — Reconcile the two cron schedules and add an export_jobs reaper before exports carry real load.

Stripe and sign-in setup checklist for the owner

Everything below is dashboard work. No code change is needed for any of it.

1. Stripe: create the products and prices

In the Stripe Dashboard → Product catalogue, create three products, each with two recurring prices (USD):

Copy each price id (price_…) into apps/web-app/.env.local and into Vercel’s environment variables:

STRIPE_PRICE_STARTER_MONTHLY, STRIPE_PRICE_STARTER_ANNUAL, STRIPE_PRICE_FAMILY_MONTHLY, STRIPE_PRICE_FAMILY_ANNUAL, STRIPE_PRICE_PREMIUM_MONTHLY, STRIPE_PRICE_PREMIUM_ANNUAL

Also set STRIPE_SECRET_KEY and NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY. All eight are placeholders today.

2. Stripe: the webhook

Developers → Webhooks → Add endpoint: https://<your-domain>/api/subscriptions/webhook

Subscribe to: checkout.session.completed, customer.subscription.created, customer.subscription.updated, customer.subscription.deleted, invoice.payment_succeeded, invoice.payment_failed. Paste the signing secret into STRIPE_WEBHOOK_SECRET.

To test locally: stripe listen --forward-to localhost:3000/api/subscriptions/webhook and use the whsec_… it prints as STRIPE_WEBHOOK_SECRET.

3. The two flags

Both are NEXT_PUBLIC_, so they are baked in at build time — changing one needs a redeploy, not a restart. Do not set NEXT_PUBLIC_PAYWALL_MODE=onboarding before step 1 is done, or signup dead-ends at the plan step.

4. Supabase: send auth email through Resend

Dashboard → Authentication → Emails → SMTP Settings → enable custom SMTP:

• Host smtp.resend.com, port 465
• Username resend, password = your Resend API key
• Sender = an address on a domain verified in Resend (today RESEND_FROM_EMAIL is on workbeehive.com, not mystoryflow.com — verify the domain you actually want to send from)

Then Authentication → Emails → Templates → Magic Link: the body must contain {{ .Token }}, which is the six-digit code. The default template only has {{ .ConfirmationURL }}, and with only that, the code screen has no code to show.

Finally, Authentication → Rate Limits: raise “Emails per hour” from the built-in default (a handful per hour for the whole project — fine for one tester, not for 30 people). The limit is the reason NEXT_PUBLIC_EMAIL_CODE_SIGNIN ships off.

Leave email auto-confirm as it is. The code path signs people in directly and does not depend on it.