Protect the login and the admin
Put 2-step login on every account that controls the site, review Supabase's own login protections (password rules, rate limits and what the free plan doesn't include), and build a safe "forgot password" path so Adjoa can reset her password without changing her user ID.
Why this matters
The back office already has strong locks: a 20-character random password, sign-ups switched off, proxy.ts at the door, requireOwner() in the room, RLS on the filing cabinet, and now Turnstile on the login form. A stranger guessing their way into /admin is, honestly, not going to happen.
So where's the real risk? Two places most beginners never think about.
The accounts behind the site. Anyone who gets into your Vercel, Supabase or GitHub account doesn't need Adjoa's password. They can read every key, change the code, or download the whole database. Those accounts are the keys to the building, not only to the office. Each one needs 2-step login.
The day Adjoa forgets her password. Right now, the only fix is to delete her account and create a new one (Lesson 9.2). That gives her a new user ID, which breaks OWNER_USER_ID in two places and the two database policies that name her. On a busy Monday, that's how people end up switching security off "to get it working". A proper reset path keeps her user ID, so nothing else has to change.
In the full lesson
- The idea in plain English
- Do it
- Check it worked
- Understand what AI wrote
- Quick check
- What you can do now
The step-by-step, the prompt to copy, the video and the check-it-worked list, for every lesson in all 15 modules. GHS 399 ($40), paid once by mobile money or card, yours to keep.