Monthly health card, sample
Month 3 on the plan. Healthy.
The app was up and working for all but 11 minutes this month. That outage happened at night, was handled the same night, and is explained below. Three small fixes shipped, the backup restored cleanly, and there is one decision waiting for you.
This is an illustrative sample. It is a composite example built from patterns seen across AI built apps. It is not a real customer and not a real app. The app described is a subscription app built with Lovable and Supabase, with Stripe billing, and every figure on this card is sample data made up for the example.
What we checked
The same six groups as the free audit, re-run this month against the live app.
- Pass01 Data access and row level security
Policies re-tested with two accounts. Each account still sees only its own records, including the new table added this month.
- Pass02 Keys and secrets
The live bundle holds only the public anon key. No new secrets appeared in the code or the build.
- Pass03 Auth flows
Full walk with a fresh account. Password reset was broken earlier in the month and is fixed, see below.
- Attention04 Payments and webhooks
Working correctly today. A Stripe change ahead affects this app, covered under platform watch.
- Pass05 Transport and headers
HTTPS and security headers unchanged. The certificate renews automatically in 61 days.
- Attention06 Operations and recovery
Backup restore passed. The one outage this month traced back to a database limit, which is the decision below.
What we fixed this month
All three shipped under the rules you set when you joined the plan, so none of them waited on a fresh approval.
- A security update for a library the app depends on. A security notice was published for a package the app uses to display formatted text. We updated it to the patched version and sent the change as a pull request. The build passed, we checked the pages that use it, and it was merged under your rule that patch level security updates can ship without waiting.
- A broken password reset link. When the account pages moved to a new address earlier in the month, password reset emails kept sending people to the old one, which showed a page not found. We pointed the reset link at the new page and then ran a reset with a fresh account from start to finish to confirm it works.
- A cleanup of expired trials. Nine accounts whose free trial had ended still had trial features switched on, because the app only checked the trial end date when someone logged in. Under your rule that trial flags can be corrected once you have seen the list, we sent you the list, heard no objection within two business days, and moved those accounts to the free tier. Nobody was charged and no data was deleted.
Backup restore test
On the first Tuesday of the month, as we do every month, we restored the latest nightly backup into a separate throwaway copy, never over the live app. It worked. The restore took 7 minutes. The main tables matched their expected row counts as of the backup time, and a test login worked against the copy. We deleted the copy afterwards.
In plain terms: if the live database were lost tomorrow, you could expect the app back in under half an hour, missing at most the changes made since the previous night's backup.
Monitoring summary
Uptime is sample data, like every figure on this card. Of the three new error types, two were fixed as part of the work above and the third came from a browser extension on one visitor's machine and needs nothing from you.
The one incident
The app was down for 11 minutes in the middle of the night. The uptime alert reached us within two minutes and we were working on it the same night. The cause was the nightly email digest: it opened a separate database connection for every user, and as the user count has grown it now hits the connection limit on your database plan. While it ran, the app's own requests were turned away. Pausing scheduled jobs is one of your pre-authorized rules, so we paused the digest, confirmed the app was back, and sent the digest the next morning in small batches. Nobody received a duplicate email. The permanent fix needs your call, below.
Platform watch
Stripe has announced the retirement of the API version this app's billing code is pinned to, with a deadline about ten weeks away. After that date, the way some payment events are described changes, and the code that reads them would start missing details it relies on.
What we are doing about it: we are moving the app to the current version in Stripe's test mode first, replaying every event the app depends on, and checking that sign-ups, renewals, and cancellations still land correctly. The change will arrive as a pull request for you to merge at least two weeks before the deadline, so there is time to spare if anything needs another look.
One thing to decide
How should the nightly digest stop knocking the app over?
This falls outside your pre-authorized rules because it changes how a customer facing email is sent, so it waits for you.
- Send the digest in batches. Change the job to share one connection and send in groups of 50. This fixes the cause, adds no monthly cost, and takes about two hours, including a test against a throwaway copy.
- Upgrade the database plan. A larger plan raises the connection limit. This works the same day, but it adds a monthly cost and only buys time until the user count catches up again.
- Leave it as it is. We keep watching and pause the job when it happens. The outage will get longer and more frequent as you grow.
Our recommendation is the first option. It removes the problem instead of postponing it. Reply yes and it ships next week as a pull request.
Next month
- Ship the Stripe API version update as a pull request, well ahead of the deadline.
- Ship the digest batching change, if you approve it.
- Move the trial end check to a nightly job so expired trials close on time instead of on next login.
- Run the monthly backup restore test and the full checklist again.
This card is the monthly deliverable on the $99 Ground Crew plan. Every member gets one, written against the same checklist as the free audit, along with tested backups, monitoring read by a person, and small fixes under rules you set. Everything starts with the free audit.
Request a free audit