The grader tells you what is wrong. The kit is the sequence that fixes it and the nine other stages between "it runs" and launched, found, paid for and kept alive. Ten modules. Every check in the grade names its module.
Runbook Pack +$27 at checkout. Complete, with every runbook and 12 months of updates, $197. Thirty-day refund.
Why this stage matters, with the real failure behind each rule. The decisions you make, each with a recommended default and its cost. What to do by hand: accounts, domains, cards, verifications. What "done" looks like, as things you can observe. A troubleshooting table. The exact prompt to hand your AI.
The inputs it needs from you and where each comes from. Ordered steps, each with a verification command and its expected output. STOP points before anything destructive or costly. Acceptance criteria it must prove before reporting done. The hand-back: what only you can do next.
One page to print per module, and the files to copy: configs, scripts, SQL, email copy. Plain markdown and plain code. Works dropped into a repo for Claude Code, Cursor, Codex or Copilot, or pasted into a chat.
You: Read MODULE-03-lock-it-down/AI-RUNBOOK.md and run it against this project.
My database project is YOUR_PROJECT_REF. Stop at every STOP.
AI: Step 1 of 9: list every table and its RLS status. 14 tables, 9 without RLS.
STOP: enabling RLS blocks the app's anon reads until policies exist. Proceed? (y/n)
A router at the top asks what you built and gives you the order. Security comes before users and money in every path that has them, because the failures in Module 03 cost the most to fix after launch. "Lite" means read the guide and run only the steps the runbook marks as minimum.
| What you built | Order |
|---|---|
| A published website: brochure, portfolio, landing page, docs | 00 → 01 → 02 → 03 lite → 06 lite → 08 lite → 09 |
| An app with users: sign-in, saved data, no payments yet | 00 → 01 → 03 → 05 → 02 → 06 → 07 → 08 → 09 |
| An app that takes money: subscriptions, one-time purchases | 00 → 01 → 03 → 05 → 04 → 06 → 07 → 08 → 02 → 09 |
| A data or content property: directories, programmatic pages, datasets | 00 → 01 → 02 → 03 → 07 → 06 → 04 if selling → 08 → 09 |
Three rules the runbooks enforce: secrets never go in files that get committed; nothing destructive or costly without your yes; done means proven, with the command output shown.
Modules 00 to 03 ship with both documents in the Fix Kit. The Runbook Pack and the Complete kit add the AI runbooks and templates for 04 to 09. Every module's human guide and checklist is in every tier.
A domain that resolves, DNS you control, a host that deploys every push, a repo that cannot leak a secret, an inbox at your own domain, a sending domain that lands in the inbox, and a clear line between staging and production.
SPF, MX, nameservers, DNSSEC, CAA, ignore rules covering the whole env family, env example parity, hosting env hygiene.
DNS records, email DNS records, hosting project settings.
A published site that passes every gate a professional launch is held to: validator clean, a full set of security headers, accessibility clean, robots and sitemap crawlers accept, Open Graph and structured data, a real 404, a page that works on a phone, deploy from push.
TLS, HTTPS redirect, HSTS, CSP and its strength, clickjacking, nosniff, Referrer-Policy, Permissions-Policy, server leak, source maps, builder leftovers, internal files, lang and viewport, the 404 that is a 200, favicon, mixed content, broken links, TTFB, page weight, largest image, render-blocking resources.
vercel.json with headers, Next config headers, 404 page, head with OG and JSON-LD, robots.txt, sitemap.xml, verify-site.sh.
Into Google, Bing and the AI answer engines on purpose: verified ownership, clean per-page metadata, structured data, a machine-readable description of the site, instant index pings, and a public entity record.
Title, meta description, canonical, one H1, Open Graph image, JSON-LD, robots.txt, sitemap, llms.txt, AI crawler policy.
IndexNow submit script, JSON-LD blocks and builder, llms.txt, OpenAPI description, robots.txt, search verification checklist, seo-audit.mjs.
Ten rules, each written after a specific thing broke. Every endpoint refuses a stranger, every table refuses the public key, no secret sits in page source or a committed file, the auth provider's hidden settings are what you think they are, and a script proves all of it on demand.
Secrets in the bundle, repository secrets, wildcard CORS with credentials, exposed env files, exposed .git, open admin routes, anonymous row reads, row level security, database REST metadata, storage bucket listing, rate limiting, Firebase config, security.txt.
audit.sh and a CI workflow, the shared gate module, RLS baseline SQL, secret-scan.sh, the rotate-a-leaked-credential card, public allow-list and public tables files.
A plan matrix in code that drives the pricing page, the Stripe products and the access rules. Checkout for one-time and subscriptions, a webhook that writes every payment into your own database exactly once, server-side tier guards, a Customer Portal, refunds, and the trailing newline that once took a checkout down.
A test key on a production domain, webhook wiring to the live domain and the right events.
plans.ts, idempotent Stripe product setup, checkout, webhook, portal, orders SQL, subscription reconcile, tier guard, refund policy.
Each person signs in with their own credentials, holds a grant on exactly the accounts they belong to, receives an invite as a typed code nothing can spend before they do, and can be cut off with one click that actually cuts them off. A script proves the whole path before you tell a customer it works.
Cookie flags, auth settings closed by default: signup, minimum password, OTP expiry, redirect allow-list, anonymous sign-ins.
Access-control schema, end-user-sessions SQL, send-invite-codes script, auth settings card, verify-access script.
A GA4 property with the five events that matter, fired so a slow script cannot drop them, a purchase event with the real amount, a UTM convention, first-touch attribution in your own database, and one query that answers which channel produced paying customers.
Analytics installed, consent mechanism where required.
analytics.js, event schema, first-touch capture, server-side GA4, attribution view SQL, report page.
Three small watchdogs that email you when something is actually wrong, alerts on the second failure not the first, a rule that stops any new feature from quietly costing money, a cap on every paid API, a backup you have proven you can restore, and a weekly all-clear so you know the watchdogs run.
Certificate expiry, domain expiry. The monitor is this module as a service.
Route canary, data-freshness canary, coverage check, ops digest, budget guard, canary tables SQL, cost model, restore drill, runbook cards, cron schedule.
Your domain authenticated so mail lands in inboxes, the mail that must arrive separated from the mail that sells, one scoped sending key per surface, a five-email drip with the copy written, every delivery and open recorded in your own table, unsubscribe in one click.
DKIM, DMARC, and whether your sign-in and receipt emails come from an authenticated domain you control.
DNS records, drip sequence with copy, drip cron, delivery webhook, subscribers and email events SQL, unsubscribe endpoint.
The order of operations for the first two weeks, the five venues that matter with the rules each enforces, the story only you can write, a paid-search starter with a hard cap, the content that gets you cited by answer engines, a referral program sized to your stage, and the seven numbers to watch in week one.
Privacy and terms pages discoverable from the home page.
Launch-week calendar, venue posts, founder story outline, paid-search starter, referral capture and checkout, promo codes script, week-one metrics.
The Fix Kit is the book, every human guide and checklist, and the runbooks for Modules 00 to 03. Add the Runbook Pack for Modules 04 to 09 at checkout for $27, or take the Complete kit with every runbook, every template and 12 months of updates for $197.
Checkout by Stripe. Delivery by email in minutes, and in your library whenever you need it again.