‹ Admin · Security · Reliability · Performance

Security · Reliability · Performance

Live operational view. Measured signals refresh on load; the rest links to the authoritative dashboards. Audit Parts 4–5.

Checking…
pinging /health

💳 Revenue channel …

Checking the live purchase → access path…
…
Synthetic check of the money path, run server-side every load (no CORS limits) via /.netlify/functions/revenue-check. The same endpoint is polled 24/7 by the external uptime monitor and by the 3am daily briefing. Critical items failing = lost sales — investigate immediately.

🔒 Security

Content-Security-PolicyEnforced via netlify.toml — allowlists Supabase/GA4/Meta/fonts/EmailJS/CDN
Enforced
Security headersHSTS · X-Frame-Options DENY · X-Content-Type-Options · Referrer-Policy · Permissions-Policy
On
Row-Level SecurityEvery table keyed to auth.uid(); service-role only in functions
On
Rate limitingPublic functions (quiz-lead, pc-waitlist) — Supabase rate_check, fail-open
Live
CI guardsa11y gate · gitleaks secret scan · npm audit (on every push)
On
Error trackingSentry — browser SDK on all pages + server-side capture from the functions
On
Subresource IntegrityCDN libs version-pinned; SRI deferred to post-launch (decision)
Pinned
Run header scan ↗ Mozilla Observatory ↗
Browsers hide security headers from scripts, so the live header grade comes from the external scanners above (one click). The posture list reflects what's set in the deploy.

📈 Reliability

Site & functionsLive ping to /health
…
Database (Supabase)Reachability via the health endpoint
…
Health round-tripTime for the health endpoint to respond
…
Error events (24h)Best-effort from the events table
…
Targets (SLOs) — documented in Architecture/SLOs.html:
99.9%
Uptime / month
< 2.5s
LCP (p75)
≥ 99%
Checkout success
Netlify dashboard ↗ Supabase dashboard ↗
Continuous uptime + alerting is an external monitor (UptimeRobot / BetterStack) pointed at /.netlify/functions/health — setup steps in Architecture/Monitoring-Setup.html.

⚡ Performance

This page — TTFBTime to first byte (server response)
…
This page — DOM ready
…
This page — fully loaded
…
Authoritative Core Web Vitals (real Google field + lab data) — one click per page:
PageSpeed: Home ↗ PageSpeed: AI-Native course ↗ PageSpeed: Course ↗
Load/stress testing before a big push: qa/load-test.mjs (run against staging). Accessibility + purchase→access flow run automatically in CI (qa/ · blocks on red).

🚀 Delivery snapshot

…
Deploys / week
…
Change-failure rate
…
Mean time to recovery
DORA metrics for our two-person team (Olia + Claude), git-derived — a snapshot, refreshed by npm run metrics. Lead time is push→live ≈ CI + Netlify build (minutes). Incidents logged in qa/INCIDENTS.ndjson; rationale in Architecture/Release-and-Rollback.html.