Lock Checklist (v1.0-locked)

Do not tag until every box is green. Goal: frozen verbs, just-works binary.

P0 — money + data

• Single Stripe webhook truth via access.js, dedupe on providerPaymentRef (unique everywhere), 4xx on bad sig, 500 on failure for retry.
• Checkout price from product row only; priceId/mode allowlisted; redirect URLs relative same-origin.
• Cancel binds subscription → order buyer/customer or admin (403 else).
• Claim-repo session-bound + username regex; githubUsername persists on all DBs.
• Order pricingType + unique refs on all three; SQLite/Supabase/Mongo smoke-passing.
• Dockerfile boots from clean build; /db volume + SQLITE_PATH verified; backups include analytics.sqlite.

P1 — auth + abuse + rendering

• Stale sessions → /auth without loops; admin fail-closed in prod.
• In-app rate limits on auth/lead/vote/track/webhooks (nginx is not enough alone).
• Markdown HTML sanitized + CSP; no fake SEO ratings/prices.
• Lead validation + idempotent 200s; vote race handled gracefully.

P2 — hygiene

• images.remotePatterns, deps upgraded (npm audit clean on high/critical), next lint replaced/pinned.
• Thin-route (≤40) and table-name docs match code, or docs amended once.
• scripts/test-matrix.sh: sqlite → supabase → mongo + webhook replay, all green.

Tag

git add data/docs && git commit -m "docs: boring guides v1" && git tag v1.0-locked

After the tag: verbs frozen. New capability = new provider file + one registry line + parity test. No new pages, no new top-level folders.
Zero-Lockin Engine