Chart Chic

A production e-commerce site selling digital cross-stitch patterns for a small business. Digital goods make the delivery problem the whole problem: once a file leaves the server, nothing can un-send it.

Stripe Checkout with webhook-driven order fulfilment, and downloads gated behind signed URLs issued only against a fulfilled order. The webhook is the source of truth for whether an order is paid — never the browser's return trip, which a customer can close, refresh or forge.

An admin CMS covers product, category and review management, and reviews are restricted to verified purchasers so the ratings mean something.

During the build I found a live Row-Level Security bypass in a Postgres view. Views do not automatically inherit the policies of the tables beneath them, which is the sort of detail that is obvious once you have been bitten and invisible until then.

It was caught before launch because I went looking for it rather than waiting for it. That is the whole argument for treating security as part of schema design instead of a pass at the end.

SEO implemented end to end: structured data, a generated sitemap, and dynamic Open Graph images. For a small shop, the difference between existing and being found is most of the business.