Loading the live canvas…

This is a sample project. Map your own app in 2 minutes, free, no card.

Not ship-ready2 blockers (critical/high)

CriticalThe Stripe webhook is not verified

security · Stripe → Stripe webhook

The handler reads `type` and `customer` off the JSON body and updates the subscription. Nothing checks the Stripe signature, so anyone who finds the URL can POST a checkout.session.completed and give themselves — or everyone — a paid plan.

Why flagged: Public webhook route writing billing state with no verification step in between.

Fix: Verify the signature with stripe.webhooks.constructEvent against the raw request body and STRIPE_WEBHOOK_SECRET before you read a single field. Reject anything that fails, and re-fetch the object from Stripe rather than trusting the payload.

HighRoutes check that you're signed in, not what you own

security · API routes

Handlers take an id from the URL and load it. Being logged in is enough, so changing /workspaces/12 to /workspaces/13 reads another customer's data. This is the most common bug in multi-tenant starters and it never shows up in testing, because your test account owns everything you click.

Why flagged: Record ids taken from client input with only a session check ahead of the query.

Fix: Scope every query by the caller's org — `where id = $1 and org_id = $2` — in the data layer, not in each handler. One shared helper is harder to forget than a check per route.

MediumOne Postgres primary, no replica

bottleneck · Postgres

Sessions, application reads, writes and any reporting query all land on a single node with no failover. It will hold for a long time, but when it stops, everything stops — and there is nothing to fail over to.

Why flagged: Single database node fanned into by the API, auth and the webhook handler.

Fix: Add a read replica and send reporting and session lookups to it. Even without the load argument, having a second copy is what turns an outage into a failover.

MediumThe cache and the job queue share one Redis

reliability · Redis

Clearing the cache to fix a stale-data bug also deletes every queued job — the welcome emails and exports waiting in it are simply gone, with no error anywhere.

Fix: Separate instances, or at least separate databases on the same instance, so a FLUSHDB can never reach the queue.

LowFailed jobs disappear

reliability · Job queue

After three retries a job is dropped. Nobody is told, so a bad email template looks like nothing happening at all.

Fix: Keep a dead-letter list and log the failures where you would actually see them.

InfoThe bucket keeps everything forever

cost · S3 bucket

No lifecycle rule and versioning left on: deleted uploads still cost money, quietly, for years.

Fix: Add a lifecycle rule that expires old versions and moves cold objects to infrequent access.