Private drafts. Reviewed publishing. No executable embeds.
The community collects structured learning notes, not arbitrary website code or uploads. Database rules separate private member work from approved public stories.
Access boundaries
Visitors can read current challenges, lessons and approved build stories.
Signed-in members can access only their own profile, progress and unpublished work.
The private founder area can review pending work and record a reason for each decision.
Row-level security protects every community table. Server checks still verify the member and action.
What we do not accept
The build form does not accept files, images, HTML, scripts or executable demos. Public and source links must use HTTPS. React renders member text as text, and external member links are marked as user-generated content.
Secrets and credentials
Database administration and email-delivery keys stay in protected server settings. They are not sent to the browser. Members must not include passwords, API keys, private client material or other credentials in a build story or support request.
Abuse controls
Authentication and public forms use provider limits, server validation, a bot trap and database-backed event records. The review queue switches to draft-only mode if more than 10 submissions are waiting or the oldest has waited over 48 hours.
Free infrastructure limits
The service currently uses free Vercel, Supabase and Resend plans. Those services have usage and availability limits. Community records should be exported regularly, and no member should treat the website as the only copy of important work.
Report a concern
Use the contact form to report public content, appeal a moderation decision or raise a security concern. Include the public URL or moderation reference, but keep sensitive evidence out of the first message.
Open the private contact desk