Free Access

Up-Skill.md:
A Non-Engineer's Guide

Enter your email to access the full presentation with frameworks, market maps, and live demo walkthrough.

By entering your email, you agree to receive occasional updates on AI tools, tips, and resources. Unsubscribe anytime.

Up-Skill.md

Up-Skill.md:
A Non-Engineer's Guide
to Shipping Real Products

Mike Maseda

Head of Sales & Ops, GenHealth  |  AI Consultant, MAMV Ventures

Before We Begin

Three Things I Want You to Leave With

1

Tinker Relentlessly

The AI landscape is changing faster than ever. Push past your comfort zone โ€” whether that means graduating from Excel, moving beyond ChatGPT, or building your first app. The only way to keep up is to keep experimenting.

2

Front-Load the Thinking

The more effort you put into planning and specifying what you want upfront, the better your first result. Great specs can get you to a market-ready MVP without endless iterations.

3

You Can Build This

The tools exist today for non-engineers to ship real products. The barrier isn't technical skill โ€” it's the willingness to try.

The Premise

Who This Talk Is For

๐Ÿ’ก

You have ideas

Business tools, apps, dashboards โ€” things you wish existed.

๐Ÿšซ

You're not an engineer

You don't write code. You never learned. That's fine.

๐Ÿš€

You want to build

Not just prototype โ€” actually ship things people use.

This talk shows you how.

Context

What I've Built with These Tools

I'm not an engineer. I'm a sales and ops guy. But in the last year, I've shipped:

Customer-Facing Products

Full web apps with auth, databases, payment flows โ€” live in production, serving real users.

Internal Tools & Dashboards

Analytics dashboards, CRM integrations, automated reporting โ€” things that would have cost $50K+ to outsource.

AI-Powered Workflows

Voice agents, automated email systems, data processing pipelines โ€” using the same tools I'll show you today.

Content & Marketing Sites

Landing pages, presentation decks, SEO content sites โ€” all built and deployed without writing a line of code from scratch.

Part 1

What You Can Build

Real examples of what non-engineers are shipping today

What's Possible

Real Things Non-Engineers Are Building

๐Ÿ“Š

Internal Dashboards

KPI trackers, sales dashboards, reporting tools โ€” things you'd normally ask engineering to build.

๐Ÿ‘ฅ

Customer-Facing Apps

Client portals, booking systems, self-service tools โ€” with auth, payments, and real data.

โš™๏ธ

Automations

Email workflows, data processing, CRM integrations โ€” things that used to require Zapier + duct tape.

๐ŸŒ

Content Sites

Landing pages, blogs, marketing sites โ€” deployed in minutes, not weeks.

๐Ÿ“ˆ

Data Analysis Tools

Upload a CSV, get insights. Custom analytics without learning Python.

๐ŸŽ™๏ธ

AI-Powered Products

Voice agents, chatbots, content generators โ€” products that weren't possible 18 months ago.

Sound Familiar?

Problems Worth Solving

Before we talk tools, let's talk about what you're actually dealing with. Any of these hit close to home?

๐Ÿ˜ค

"I spend 3 hours a week copy-pasting data between spreadsheets"

→ Build a dashboard that pulls from all your sources automatically

๐Ÿ“ž

"Our clients keep asking the same questions over and over"

→ Build a self-service portal with an AI assistant that handles it 24/7

๐Ÿšซ

"I can't get engineering to build my internal tool — it's always deprioritized"

→ Build it yourself this weekend, without waiting in the queue

๐Ÿ’ธ

"We're paying $2K/month for software that only does 20% of what we actually need"

→ Build the exact tool you need for $20/month

๐Ÿ’ก

"I have a business idea but I can't afford a developer to build it"

→ Ship your MVP this weekend and start getting real feedback

These aren't developer problems. These are your problems. And you can solve them now.

Part 2

The AI Builder Landscape

Understanding the categories of tools
and when to use each one

Market Map

The AI Builder Landscape

No-Code Builders

Visual, drag-drop, prompt-to-app

B

Bolt

Prompt โ†’ full app

โ™ฅ

Lovable

Design-first builder

R

Replit Agent

Chat โ†’ deployed app

v0

v0 by Vercel

UI components fast

Coding Agents

AI writes code, you guide

C

Claude Code

Terminal-based, powerful

G

GitHub Copilot

IDE autocomplete + agent

Cu

Cursor

AI-native code editor

W

Windsurf

AI-first IDE

O

OpenClaw

Autonomous agent

The LLMs

The brains behind everything

C

Claude (Anthropic)

Best for coding & reasoning

G

GPT-4o (OpenAI)

Multimodal powerhouse

G

Gemini (Google)

Large context window

L

Llama (Meta)

Open source, self-host

โ† Easier to use More power / flexibility โ†’
No-Code Builders Coding Agents Raw LLMs

Decision Framework

When to Use What

โšก

No-Code Builders

Quick prototypes

Landing pages

Simple CRUD apps

MVPs & demos

"I need something working in an hour"

๐Ÿ—๏ธ

Coding Agents

Real products

Custom business logic

Production apps

Complex integrations

"I need something that scales and lasts"

๐Ÿง 

Raw LLMs

Brainstorming

Writing specs

Content & analysis

Strategy & planning

"I need to think through a problem"

Part 3

The Modern Stack

The tools you actually need to go from idea to live product

Market Map

The Modern Stack

Frontend / Deploy

Vercel โญ

Netlify

GitHub Pages

Cloudflare Pages

Backend / Database

Supabase โญ

Firebase

Neon

PlanetScale

Auth

Supabase Auth โญ

Clerk

Auth0

Version Control

Git / GitHub โญ

Your save button.

Undo for everything.

Voice / Audio

ElevenLabs

OpenAI Realtime API

Vapi

LLM APIs

Anthropic (Claude) โญ

OpenAI

Google (Gemini)

Payments

Stripe โญ

Gumroad

Lemon Squeezy

Email / Comms

Resend

SendGrid

Twilio

โญ = Mike's personal picks

Keep It Simple

You Don't Need All of These

The minimal viable stack to build almost anything:

โ–ฒ

Vercel

Deploy

+
โšก

Supabase

Database + Auth

+
๐Ÿค–

Claude Code

Build

+
๐Ÿ™

GitHub

Save & Version

Total cost: $20/mo (Claude Pro) + free tiers for everything else

Architecture

How It All Connects

Here's how the pieces fit together when you're building a real app:

๐Ÿง‘โ€๐Ÿ’ป

You

Describe what you want

๐Ÿค–

Claude Code

Writes & runs code

๐Ÿ™

GitHub

Saves every version

โ–ฒ

Vercel

Hosts your app

โšก

Supabase

Database & login

๐Ÿ‘ฅ

Your Users

Visit & use your app

The flow: You talk to Claude Code โ†’ it pushes to GitHub โ†’ Vercel auto-deploys โ†’ your app is live.

Part 4

The Process

How I actually build things โ€” from idea to deployed product

Workflow

My Process

1

Conversation with Claude

Describe your idea in plain English. Claude helps you turn it into a high-level spec with structure, features, and technical decisions.

2

Feed Spec to Claude Code

Give it the spec. It asks clarifying questions โ€” "What database? What auth? How should this page look?" โ€” then starts building.

3

Let It Build

It writes the code, creates files, installs dependencies. Usually 80-90% right on the first try.

4

Refinement

Iterate with natural language: "Keep the nav bar visible when I scroll." "Add dark mode." "Fix the mobile layout." Repeat until done.

Step 1

The Spec Conversation

โŒ Too vague

You: Build me a CRM โ†’ Where do you even start?

โœ… Good spec prompt

You: I need a CRM for my consulting business. I have about 50 clients. I want to track: - Contact info and company - Last interaction date - Deal stage (lead โ†’ closed) - Notes per client - Simple dashboard with pipeline view Tech: Next.js + Supabase. Auth: magic link login. Just me using it for now.

What Claude does with it

Claude: Great. Let me clarify: 1. Deal stages โ€” do you want custom stages or fixed? 2. Dashboard โ€” pipeline view as kanban or table? 3. Should clients have tags or categories? 4. Do you need email integration or just manual notes? 5. Any specific design reference? โ†’ Turns your idea into a structured spec
๐Ÿ“‹ Download the full SaaS Scoping Framework โ†’

Step 2

The Conversation โ€” A Real Example

๐Ÿ—๏ธ LossRunner โ€” a Workers' Comp loss run app built in 3.5 hours. No code written by hand. Read the full conversation โ†’

๐ŸŽ™๏ธ Phase 1: Discovery Interview

Claude asked 63 questions in 19 minutes โ€” understanding the business model, user types, data flows, and edge cases before writing a single line of code.

๐Ÿ“‹ Phase 2: Spec Generation

Turned answers into a detailed product spec โ€” database schema, API routes, UI components, user roles โ€” and asked for approval before building.

โšก Phase 3: Build & Iterate

47 files generated. Auth, dashboard, PDF parsing, loss run comparison engine โ€” all from the conversation. Tested and refined in real time.

You: Read this SPEC and interview me in detail using AskUserQuestion about literally anything: technical implementation, UI & UX, concerns, tradeoffs, etc. Make sure the questions are not obvious. Be very in-depth and continue interviewing me until it's complete, then write the spec to the file. ๐Ÿ“‹ 63 questions later... h/t @trq212 ๐Ÿ™ Claude: Here's what I'll build: โ€ข Next.js + Supabase + Tailwind โ€ข Multi-tenant auth (broker/carrier) โ€ข PDF upload + AI extraction โ€ข Loss run comparison engine You: "looks good, build it." Claude: Creating files... โœ“ 47 files ยท DB migrations ยท Auth โœ“ PDF pipeline ยท Dashboard 3.5 hours. Zero hand-written code.

Step 3

First Build โ€” 80-90% Right

80-90%

correct on first try

The structure works. The core features work. The design is reasonable.

What to look for:

โœ… Core functionality works

โœ… Data flows correctly

โœ… Auth and security basics

โš ๏ธ Mobile layout may need tweaks

โš ๏ธ Edge cases not handled yet

โš ๏ธ Design polish comes in step 4

Step 4

Refinement โ€” The Iteration Loop

This is where the magic happens. Natural language โ†’ real changes.

You: Keep the nav bar visible when I scroll down Done. Made the header stay at the top as you scroll. You: Add dark mode toggle Done. Added theme context, toggle button, and dark CSS vars. You: The table is too wide on mobile. Make it scroll horizontally. Done. Wrapped in overflow-x container with snap points. You: Add a CSV export button to the dashboard Done. Added export function with date-stamped filename.

The key insight

You don't need to know how to implement something. You just need to describe what you want.

Common refinements:

  • โ†’ "Make it look like [reference]"
  • โ†’ "Show a spinner while it's loading"
  • โ†’ "Show a message when there's no data yet"
  • โ†’ "Add search/filter"
  • โ†’ "Fix the spacing on mobile"
  • โ†’ "Add email notifications"

Watch Out

Common Pitfalls

๐ŸŒซ๏ธ

Being too vague in specs

"Build me an app" โ†’ garbage. Be specific about features, data, and user flows. The more context you give, the better the output.

๐Ÿ’พ

Not using version control

Without Git, one bad change can destroy hours of work. Commit early, commit often. It's your undo button.

๐Ÿ”๏ธ

Trying to build too much at once

Start with the core feature. Get it working. Then add the next thing. Scope creep kills projects.

๐Ÿ“ฑ

Not testing on mobile

60%+ of your users are on phones. Test early. AI-generated layouts often need mobile refinement.

Level Up

Best Practices

๐Ÿง 

Manage Your Context Window

AI models have a fixed memory. Once ~70% is consumed, quality drops fast โ€” hallucinations increase, instructions get ignored. Start fresh sessions for new tasks.

โšก

MCPs: Power vs. Cost

MCP servers give Claude superpowers (databases, APIs, file systems) โ€” but each one injects tool definitions that eat context. Only enable the MCPs you need for the current task.

๐Ÿ”„

Compact Often

Long conversations degrade quality. Use /compact to summarize and reset context when Claude starts losing the thread or repeating itself.

๐ŸŽฏ

One Task Per Session

Don't ask Claude to build your auth system AND redesign the UI in one session. Focused sessions = better output. Spin up parallel sessions for parallel work.

๐Ÿ“‹

Use CLAUDE.md Files

Drop a CLAUDE.md in your project root with key decisions, conventions, and architecture. Claude reads it every session โ€” persistent memory without burning context.

๐Ÿ“

Spec Before Code

Spend 5 minutes writing what you want before asking Claude to build. A clear spec in the first message sets the tone for the entire session. Garbage in = garbage out.

Deep Dive

Claude Code Power Features

The features that make builders fall in love with it

Connect Everything

๐Ÿ”Œ MCP (Model Context Protocol)

Give Claude hands to reach into your world

What It Is

MCP is an open standard that lets Claude connect to external tools and data sources โ€” databases, APIs, file systems, SaaS platforms. Instead of copy-pasting data into chat, Claude can go get it itself.

๐Ÿ“ฆ Popular MCP Servers

  • โ€ข GitHub โ€” read repos, create PRs, manage issues
  • โ€ข Postgres/Supabase โ€” query your database directly
  • โ€ข Slack โ€” read channels, send messages
  • โ€ข File System โ€” read/write files on your machine
  • โ€ข Brave Search โ€” web search from within Claude

โš ๏ธ Context Cost

Each MCP server injects tool definitions into Claude's context window. 5 MCP servers can eat 10-15% of your context before you type a message.

Rule of thumb: Only enable the MCPs you need right now. Disable the rest.

Think of MCPs like browser extensions โ€” powerful individually, but too many slows everything down.

Secret Weapon

๐Ÿ’ป CLIs โ€” Why LLMs Love the Command Line

LLMs Are Incredibly Good at CLI Tools

Command-line interfaces are text in, text out โ€” exactly what LLMs are built for. Unlike GUIs that require clicking and navigating, CLIs let Claude read documentation, run commands, and parse output natively. It's the difference between describing a screenshot vs. reading a manual.

Why CLIs > GUIs for AI

  • โ€ข Deterministic โ€” same command = same result
  • โ€ข Composable โ€” pipe tools together for complex workflows
  • โ€ข Documentable โ€” --help gives Claude everything it needs
  • โ€ข Scriptable โ€” Claude can chain 10 commands in seconds
  • โ€ข No UI parsing โ€” no screenshots, no pixel coordinates

Tools You Should Know About

  • โ€ข gh โ€” GitHub from the terminal (PRs, issues, repos)
  • โ€ข vercel โ€” deploy with one command
  • โ€ข supabase โ€” manage your database locally
  • โ€ข npx/bunx โ€” run any package without installing
  • โ€ข curl/jq โ€” hit any API, parse any JSON

Pro tip: If a service has a CLI, tell Claude to use it. It'll be faster and more reliable than any API integration.

Persistent Memory

๐Ÿ“ CLAUDE.md & Project Skills

The Problem

Every new Claude session starts with zero memory. You'd have to re-explain your tech stack, coding conventions, file structure, and preferences every single time.

The Solution

Drop a CLAUDE.md file in your project root. Claude reads it automatically at the start of every session. It's like onboarding a new developer โ€” except it happens in milliseconds.

What to Put in It

  • โ€ข Tech stack & framework versions
  • โ€ข Coding conventions & style rules
  • โ€ข File/folder structure overview
  • โ€ข Deployment process & common commands
  • โ€ข Known gotchas & edge cases

Pro Tips

  • โ€ข Keep it under 500 lines โ€” it eats context too
  • โ€ข Nest CLAUDE.md in subdirs for specific areas
  • โ€ข Update it as your project evolves
  • โ€ข Have Claude write it for you after a session

Scale Yourself

๐Ÿ”€ Multi-Session Workflows

One Claude = One Developer. Multiple Claudes = A Team.

Run multiple Claude Code sessions in parallel, each working on a different part of your project. They all see the same codebase โ€” just like real developers on a team.

How It Works

  • โ€ข Open multiple terminal tabs/windows
  • โ€ข Run claude in each one
  • โ€ข Give each a focused task
  • โ€ข They work simultaneously on the same repo

Example Workflow

  • ๐Ÿ–ฅ๏ธ Session 1: "Build the API endpoints"
  • ๐ŸŽจ Session 2: "Style the landing page"
  • ๐Ÿงช Session 3: "Write tests for auth flow"
  • ๐Ÿ“ Session 4: "Update the README"

This is the unlock. You're not waiting for one thing to finish before starting the next.

Safety Net

๐Ÿงฉ Git-Native Workflow

Why This Matters for Non-Technical Builders

Git is how professional teams track changes, undo mistakes, and collaborate. It's also intimidating for beginners. Claude Code handles it for you.

What Claude Does Automatically

  • โ€ข Reads git history to understand what changed
  • โ€ข Creates branches for new features
  • โ€ข Writes descriptive commit messages
  • โ€ข Opens pull requests on GitHub
  • โ€ข Resolves merge conflicts

Your Safety Net

If Claude breaks something, you can always go back. Just say:

"Undo the last change"

"Go back to how it was yesterday"

Claude handles the git commands. You speak English.

Trust Controls

๐Ÿ›ก๏ธ Permission & Safety Controls

You're Always in Control

Claude Code asks before doing anything potentially destructive โ€” deleting files, running shell commands, pushing to production. You approve or deny each action.

Permission Levels

  • ๐ŸŸข Auto-approve: Reading files, searching code โ€” safe stuff
  • ๐ŸŸก Ask first: Writing files, running commands โ€” needs your OK
  • ๐Ÿ”ด Never auto: Destructive ops, network calls โ€” always asks

Customizable Trust

As you get comfortable, expand what Claude does autonomously. Start locked down, loosen over time.

Most builders end up on "auto-approve file edits, ask for shell commands" โ€” the sweet spot.

โšก

Full Autopilot Mode

Run claude --dangerously-skip-permissions to let Claude run without asking for approval on every action. It'll read, write, execute, and deploy without stopping. Use with caution โ€” great for experienced builders who trust the process, but start with permissions on until you're comfortable.

Investment

๐Ÿ’ฐ Pricing: Max Plan

$200/month

Heavy usage of Claude Code without watching API bills

Why Flat Rate Wins

  • โ€ข API pricing is confusing and unpredictable
  • โ€ข A busy coding session can burn $20-50+ on API
  • โ€ข Max Plan = build without cost anxiety
  • โ€ข Includes Opus model access (the smartest one)

The Math

If you'd spend 10+ hours/month coding with Claude, Max Plan pays for itself vs. API pricing.

Non-technical builders have longer conversations, more back-and-forth, more iteration. That eats tokens fast. Flat rate wins.

*Fair use limits apply. Pro plan ($20/mo) works for lighter usage. Free tier available to try it.

Beyond the Terminal

๐Ÿพ OpenClaw โ€” Claude Code as Your 24/7 Assistant

What If Claude Code Never Stopped Running?

OpenClaw wraps Claude Code in a persistent runtime โ€” connected to your messaging apps, calendar, email, smart home, and more. It's not just a coding tool anymore. It's an always-on AI agent that lives on your machine.

What It Can Do

  • ๐Ÿ’ฌ Chat via iMessage, Slack, Telegram, Discord
  • ๐Ÿ“… Check your calendar & send email
  • โฐ Run cron jobs & scheduled automations
  • ๐Ÿค– Spawn sub-agents for parallel work
  • ๐ŸŒ Browse the web & control your browser
  • ๐Ÿ“ฑ Pair with your phone for camera, location, notifications

Why It Matters for Builders

  • โ€ข Your AI keeps working while you sleep
  • โ€ข Text it from your phone โ€” it runs code on your machine
  • โ€ข Skills system = teach it new capabilities
  • โ€ข Memory files = it remembers across sessions
  • โ€ข Open source โ€” customize everything

docs.openclaw.ai ยท github.com/openclaw/openclaw ยท discord.com/invite/clawd

Action Items

Getting Started Today

1

Sign up for Claude Pro โ€” $20/mo

claude.ai โ€” This is your primary AI partner for specs, code, and iteration.

2

Install Claude Code (free with Pro)

Terminal-based coding agent. This is what actually builds your projects.

3

Pick ONE thing to build

An internal tool. A personal dashboard. A landing page. Something small and useful.

4

Start with the spec conversation

Open Claude. Describe what you want. Let it ask questions. Get to a spec. Then build.

Work Smarter

AI Productivity Tools for Builders

Tools that make the building process faster and smoother

๐ŸŽ™๏ธ

Wispr Flow

Voice-to-text that works everywhere โ€” your terminal, IDE, browser. Dictate to Claude Code instead of typing.

wispr.flow
๐Ÿง 

Granola

AI meeting notes that actually work. Records your calls, generates structured summaries โ€” perfect for capturing specs from client conversations.

granola.ai
โšก

Cursor

AI-native code editor. VS Code fork with built-in AI โ€” autocomplete, multi-file editing, chat. The visual alternative to Claude Code.

cursor.com

Pro tip: Combine these โ€” Granola captures the spec from a call, Wispr lets you dictate it into Claude Code or Cursor, and you ship without typing a line.

Learn More

Resources & Links

๐Ÿ”ง Tools to Start With

  • Claude Pro โ†’ claude.ai
  • Claude Code โ†’ docs.anthropic.com
  • Vercel โ†’ vercel.com
  • Supabase โ†’ supabase.com
  • GitHub โ†’ github.com

๐Ÿ“š Learning Resources

  • Anthropic Docs โ†’ Best practices for prompting
  • Vercel Templates โ†’ Pre-built starting points
  • Supabase Tutorials โ†’ Database & auth guides
  • YouTube โ†’ "Claude Code tutorial" / "Cursor tutorial"

๐Ÿ’ฌ Connect with me

Mike Maseda โ€” mike@mamv.co โ€” Happy to chat about your project ideas.

Questions?

Let's talk about what you want to build.

Mike Maseda

mike@mamv.co

Head of Sales & Ops, GenHealth  |  AI Consultant, MAMV Ventures

Remember: the hardest part is starting.
Pick one thing. Build it this week.

Appendix

Software Engineering 101

Security, authentication, and environment variables — reference material for when you're ready to go deeper

Great for your second or third project, once the basics are solid.

Software Engineering 101

๐Ÿ” Security Basics for Non-Engineers

You don't need a CS degree to ship secure software. But you do need to know a few rules. These apply whether you wrote the code or Claude did.

Environment Variables & Secrets

API keys, database passwords, and tokens go in a .env.local file โ€” never in your code. This file is ignored by Git so it never gets uploaded to GitHub.

DATABASE_URL=postgres://...
STRIPE_SECRET_KEY=sk_live_...
NEXTAUTH_SECRET=random_string

If you accidentally push a key to GitHub, consider it compromised. Rotate it immediately. Also watch for TypeScript's process.env.KEY! โ€” the ! suppresses the "might be undefined" warning but crashes at runtime if the var isn't set.

Row-Level Security (RLS)

If you use Supabase, RLS is your most important security layer. It ensures users can only read/write their own data โ€” enforced at the database level, not just your UI.

  • โ€ข Always enable RLS on every table
  • โ€ข Write policies that check auth.uid()
  • โ€ข Test by trying to access another user's data
  • โ€ข Service role keys bypass RLS โ€” keep them server-side only

โš ๏ธ Real-world gotcha: Cron jobs & background tasks use the service role, where auth.uid() is NULL. Your RLS policies will silently block them unless you add a policy for auth.role() = 'service_role'.

HTTPS & Deployment

If you deploy with Vercel, Netlify, or Cloudflare Pages โ€” HTTPS is automatic. Never deploy over plain HTTP. Set environment variables in your hosting dashboard, not in code.

The .gitignore File

This file tells Git what to never upload. Your .env.local, node_modules/, and any credentials should be listed here. Claude usually creates this for you โ€” but always double-check.

Deep dive: codingformarketers.com โ€” "Environment Variables & API Keys" section

Software Engineering 101

๐Ÿ”‘ Authentication & Access Control

If your app has user accounts, you need auth. Don't build it from scratch โ€” use a proven service. Here's the minimum you need to get right.

Use a Managed Auth Provider

Never roll your own login system. Use Supabase Auth, Clerk, or Auth0. They handle password hashing, session tokens, email verification, and OAuth โ€” things that are easy to get wrong and dangerous when you do.

  • ๐ŸŸข Supabase Auth โ€” Free tier, pairs with your database
  • ๐ŸŸข Clerk โ€” Beautiful drop-in UI components
  • ๐ŸŸข Auth0 โ€” Enterprise-grade, complex setups

Server vs. Client: Know the Difference

Your app has two sides. The client (browser) is visible to everyone โ€” never trust it with secrets. The server is private โ€” this is where sensitive operations happen.

  • โ€ข Anon key โ†’ safe for the browser (limited access)
  • โ€ข Service role key โ†’ server only (full access, bypasses RLS)
  • โ€ข API routes / server actions = your secure backend
  • โ€ข Middleware โ‰  server โ€” Supabase middleware clients use the anon key, not the service role. RLS still applies!

The Auth Checklist

  • โœ… Login + sign-up pages exist
  • โœ… Protected routes redirect unauthenticated users
  • โœ… RLS policies filter data by auth.uid()
  • โœ… Service role key is only used in server-side code
  • โœ… OAuth callback URLs configured in provider dashboard
  • โœ… Password reset flow works end-to-end

Common Auth Mistakes

These are real bugs found across multiple projects:

  • โŒ Hiding UI buttons instead of enforcing access server-side
  • โŒ Using the service role key in browser code
  • โŒ Querying "first user in database" instead of the actual authenticated user โ€” a critical security bug that lets User A act as User B
  • โŒ Assuming middleware runs with service role permissions โ€” it uses the anon key, so RLS still applies
  • โŒ No RLS policies โ€” any user can read all data
  • โŒ Self-referencing RLS policies (e.g., checking is_admin on the same table being queried) โ€” causes silent circular failures
  • โŒ Not testing what happens when a logged-out user hits a protected page

Learn more: codingformarketers.com โ€” covers the full software stack, auth, environment variables, and debugging