saascode
saascode

Academy

Lessons from real builds, in the order they make sense. Each path ends with something you can do.

5 paths · 15 lessons

Building an interface that survives real use

You can build a task-focused interface that remains useful with empty or late data, on small screens, and under real interaction lifecycles.

2 of 11
  1. 01Specify UI sections with layout, data, and behaviorsoon
  2. 02Replace generic recent activity with the next useful actionsoon
  3. 03Keep primary navigation focused on frequent product worksoon
  4. 04Define what an empty curated shelf should dosoon
  5. 05Use representative media in seed data before visual QAsoon
  6. 06Key list-page fetching by the resolved requestsoon
  7. 07React Strict Mode reruns effects to expose missing cleanupReact Strict Mode runs an extra setup and cleanup cycle in development. Make effects reversible and requests deduplicated instead of hiding the signal.working
  8. 08Hiding desktop navigation requires an equivalent mobile pathsoon
  9. 09Prevent iOS Safari from zooming small form fieldsiOS Safari may zoom when a field's computed font is below 16px. Fix the field size, preserve user zoom, and give touch controls enough room.entry
  10. 10Do not use a surface color token as body textsoon
  11. 11Give post-build product polish its own review passsoon

Securing a multi-tenant SaaS

You can put a multi-tenant application online without trusting the wrong session, role, route, actor, or row boundary.

3 of 9
  1. 01Declare the tenancy model before designing the dashboardsoon
  2. 02Separate platform operators from tenant administratorssoon
  3. 03Make route authorization an exhaustive matrixsoon
  4. 04Keep database lookups out of the navigation hot pathsoon
  5. 05Never invent helper functions inside RLS policiessoon
  6. 06Authentication is not authorization: protect every role boundaryA logged-in user can still be the wrong user for an endpoint. Learn how route guards, negative tests, and RLS protect role boundaries in a SaaS.deep
  7. 07An audit event does not always have a userCron jobs and webhooks have no user session. Model audit actors explicitly so background work stays attributable without inventing a user ID.deep
  8. 08Debug Supabase Realtime from publication to browserA connected Supabase channel can still deliver nothing. Check publication membership, RLS, event requirements, and the browser subscription lifecycle.deep
  9. 09Resolve webhook events to a tenant without a user sessionsoon

Rebuilding a live environment from zero

You can reconstruct application state from zero and promote it without accidental schema, migration, identity, credential, or infrastructure dependencies.

1 of 9
  1. 01Supabase project API keys are not CLI access tokenssoon
  2. 02Supabase db reset is local by default—and destructive when linkedSupabase db reset is safe for disposable local data. With --linked or --db-url it targets a remote database, so production needs a hard guardrail.working
  3. 03Use exact database columns at every code boundarysoon
  4. 04Make reconciliation migrations safe before seed data existssoon
  5. 05Seed Supabase Auth differently in local and hosted environmentssoon
  6. 06Generate code from the applied schema, not remembered namessoon
  7. 07Provision Supabase Storage without swallowing createBucket errorssoon
  8. 08Debug Supabase pooler errors by verifying the whole connectionsoon
  9. 09Turn deployment prerequisites into ordered gatessoon

Shipping a public surface beyond the app shell

You can expose a stable public or embedded surface with an intentional audience, canonical identity, narrow data access, cross-origin behavior, mobile equivalence, and release evidence.

1 of 8
  1. 01Make route authorization an exhaustive matrixsoon
  2. 02Keep the Next.js root layout minimal for embeddable routessoon
  3. 03Keep provider IDs out of public resource URLssoon
  4. 04Build copied links from the origin they are meant to opensoon
  5. 05Give public Supabase pages a narrow anonymous data contractsoon
  6. 06CORS is part of an embeddable widget's API contractAn embeddable widget always calls home from another origin. Define CORS once, handle preflights, and keep authorization separate from browser access.working
  7. 07Hiding desktop navigation requires an equivalent mobile pathsoon
  8. 08Turn deployment prerequisites into ordered gatessoon

Operating an AI workload in production

You can select from a changing hosted-model catalog, deploy a reproducible worker, and preserve long-running work through durable execution and explicit status contracts.

2 of 7
  1. 01Build model selectors from a live, validated catalogsoon
  2. 02Pin Python when a dependency has an interpreter ceilingsoon
  3. 03Resolve pip conflicts from declared dependency constraintssoon
  4. 04Long AI batches need durable jobs, not one HTTP requestA batch that loops over slow model calls will outlive an HTTP request. Split it into resumable units with idempotency, progress, and bounded concurrency.deep
  5. 05Keep worker status transitions and database constraints alignedsoon
  6. 06An audit event does not always have a userCron jobs and webhooks have no user session. Model audit actors explicitly so background work stays attributable without inventing a user ID.deep
  7. 07Turn deployment prerequisites into ordered gatessoon

Being written

Paths whose lessons are drafted but not published yet. Listed so the shape of the academy is visible, not to suggest they can be read.

  • Verifying a product flow

    You can turn product scope into testable critical flows, carry exact constraints through parallel implementation, and close the work with real-state QA.

    8 drafted

  • Shipping live configuration without drift

    You can design operator-controlled settings with explicit schema and absence semantics, propagate them to rendering, invalidate caches, and verify deployed behavior.

    8 drafted

  • Reproducing a trustworthy web release

    You can reproduce a web release on a clean machine, make its gates fail honestly, ship every declared artifact, and prove the identity and version of what reached production.

    8 drafted

Standalone

Lessons that stand on their own — no path required.

Make empty dnd-kit columns explicit drop targetsSortable cards are drop targets, but an empty lane has no card to collide with. Register the column itself and handle container IDs explicitly.workingDo not pass raw query strings into PostgREST .or()Supabase .or() accepts PostgREST filter grammar, not a harmless search string. Build filters from allowed fields, operators, and typed values instead.deepTreat every user-supplied URL as a network requestA valid-looking URL can resolve or redirect into a private network. Protect outbound fetches with DNS checks, redirect controls, timeouts, and limits.deepSanitize rich-text HTML where it becomes executableStored rich text becomes executable when React renders it as raw HTML. Use a narrow allowlist at the render boundary and test hostile attributes.workingPostgreSQL LIKE treats underscore as a wildcardIn PostgreSQL LIKE, underscore matches any one character. Learn how an innocent prefix filter can exclude every row and how to escape it safely.workingPaginate Supabase reads before the table reaches its row capA Supabase response can stop at the configured API row limit without looking broken. Paginate with a stable order so large dictionaries load completely.workingA client-side login check does not protect a Next.js routeRoutes outside a Next.js Proxy matcher can render before auth runs. Keep route coverage testable, then enforce authorization again near the data.working