Work2026
A finance-content platform, in production
Marketing site, newsletter and news feed, with a members area behind Stripe billing. Postgres under default-deny row-level security, passwordless auth, and a news-ingestion pipeline feeding the published feed. The security model is covered by a SQL test suite that runs against a throwaway database.
- Stack
- Next.js 16SupabaseStripeResendVercel
- Live
- nadia-sv.com
Three products sharing one database: a public marketing site, a newsletter, and a news feed that publishes curated items. Behind them sits a members area gated by Stripe billing.
Security model
Postgres runs deny-by-default. No table is readable until a policy says so. Access that has to cross a boundary goes through security-definer functions rather than by loosening a policy. Authentication is passwordless.
The model is covered by a SQL test suite that runs against a throwaway Postgres instance and asserts what each role can and cannot see. A security model that has only been read is not a security model that has been verified.
Content pipeline
A scheduled ingestion job pulls from wire and regulatory sources, normalises what it finds, and stores it for review before anything reaches the feed. Newsletter delivery runs through Resend.
Operations
Deployed on Vercel with auto-deploy from main, DNS and email routing on Cloudflare, and accessibility audits kept alongside the contrast calculations that produced them.