What shipping this changed
Access control was the product, so it was designed first.
The membership tier is the permission model
On most membership sites, billing and permissions are separate systems that drift apart — someone cancels and keeps their access for a month because a webhook failed quietly. We made the subscription state the single source of truth for what a member can see, so a lapsed payment closes the door on the next request rather than on the next cron run.
Role-based dashboards, not one dashboard with hidden bits
Hiding a button in the interface is not access control. Every role gets its data assembled server-side for that role, so a member cannot reach an administrator view by editing a URL or replaying an API call — the classic broken-access-control finding, and still the most common one in the OWASP Top 10.
Member data treated as regulated data from day one
A networking platform holds names, employers, phone numbers and meeting history — personal data under the DPDP Act whether or not anyone calls it that. It is encrypted at rest, reads are attributable to a named account, and retention was decided before launch rather than after the first data-subject request.
Built to survive the launch, not just to pass the demo
Membership platforms get their traffic in spikes: a launch, an event, a campaign. The build was load-shaped for that pattern, and the security review happened before the spike rather than in the middle of it.
The path a request takes, and what checks it.
Read top to bottom. The control on each row is the reason that hop exists — take any one of them out and the row above it becomes a suggestion rather than a boundary.
Browser & mobile app
Member, admin or prospect — the interface never decides what they may see.
Next.js server
Every page and API route is rendered for the caller's role, server-side. No client-side gate.
Permission layer
Membership tier resolved from subscription state, not from a cached claim in the token.
Subscription state
The single source of truth for what a member can reach. A lapsed payment closes the door on the next request.
Application database
Queries are scoped to the authenticated principal in the data layer, so an unowned identifier returns nothing.
The same path is exercised in reverse during testing: an authenticated member is given to us at each tier, and we try to reach the row above from the row below. That is the test that catches broken access control, and it is the one a scanner cannot run.
The stack, and why
React and Next.js on the front, a server-rendered permission layer behind it. The stack was chosen because membership state has to be checked on the server for every request — a purely client-side app makes that either impossible or a lie.
Want the same, pointed at your product?
Free discovery call, then a fixed price in writing within 24 hours. No retainer, no surprises at the end.