Build & Ship a Production Full-Stack App in 7 Days
Without Hiring a Developer.

### 🛡️ UNIVERSAL PRODUCTION SECURITY & ANTI-HACK MASTER DIRECTIVE
Apply a zero-trust, bank-grade production hardening pass across our entire codebase.
Audit and enforce the following 8 non-negotiable security protocols:

1. DATABASE & ROW LEVEL SECURITY (RLS) AUDIT:
   - Verify every table in our database has Row Level Security ENABLED (ALTER TABLE ... ENABLE ROW LEVEL SECURITY).
   - Enforce deny-by-default: write explicit policies so authenticated users can ONLY SELECT, INSERT, UPDATE, and DELETE rows where user_id === auth.uid().
   - Strictly forbid any client-side access to the Supabase service_role key.

2. SECRET ISOLATION & ZERO CLIENT LEAKS:
   - Audit all environment variables. Ensure NO private secrets (Stripe Secret Key, Razorpay Secret, Supabase Service Role, OpenAI API Key) are prefixed with NEXT_PUBLIC_ or VITE_.
   - Ensure all private API keys are strictly accessed inside server-only files (/api, Server Components, or serverless functions).

3. AUTHORIZATION & IDOR PREVENTION:
   - On every backend route and server action, never trust the ID passed in the request body or URL params.
   - Always verify the session on the server first, and verify that the requested resource belongs to the authenticated user (e.g., WHERE id = :id AND user_id = :session_user_id).
   - If user is not authorized, immediately return a typed 401 Unauthorized or 403 Forbidden.

4. SERVER-SIDE PAYMENT & WEBHOOK TAMPER PROOFING:
   - Never accept item prices, discounts, or subscription tiers from the frontend request body.
   - Look up the exact price on the server or in the Stripe/Razorpay product catalog.
   - On payment webhook handlers (/api/webhooks), verify the cryptographic signature (Stripe constructEvent or Razorpay HMAC-SHA256 signature) before granting credits or updating user roles to 'pro'.
   - Reject any webhook request with an invalid signature with a 400 Bad Request.

5. AI ENDPOINT RATE-LIMITING & CREDIT DRAIN SHIELD:
   - Guard all expensive routes (AI generation, PDF creation, email dispatch) behind authentication.
   - Implement an atomic credit check and deduction before calling external APIs.
   - Add rate-limiting (maximum requests per minute per IP/user) to prevent bot draining.

6. ATOMIC BALANCE & RACE CONDITION DEFENSE:
   - Replace read-then-write credit logic with atomic SQL transactions (UPDATE user_credits SET balance = balance - 1 WHERE user_id = :id AND balance >= 1).
   - Never allow credit balances to drop below zero during parallel requests.

7. INPUT SANITIZATION & SAFE DOM RENDERING:
   - Strip malicious HTML and script injections from all user inputs.
   - Never use dangerouslySetInnerHTML unless the payload is sanitized with DOMPurify.
   - Ensure all database queries use parameterized statements or ORM binding (zero raw string concatenation).

8. ERROR SANITIZATION & PRODUCTION LOGGING:
   - In production, catch all 500 errors and return clean, user-friendly messages ("An unexpected error occurred").
   - Never leak database stack traces, SQL syntax errors, or server file paths to the client browser.

Produce a clean, targeted diff that hardens our application without breaking existing working features.