Bolt.new launch night: RLS and Stripe webhook gaps
- Tried
- Ship Bolt.new + Supabase app to real users
- Broke
- Second user hit RLS / session timing; Stripe webhooks without signature validation left DB stale
- Fix
- Audit RLS, session refresh after login, verify Stripe signatures