Handover — Spotlight Security Engineering + 2050planet Launch Prep
**Paste this entire document at the start of the next Claude conversation.**
---
Who I am
I'm Khurram Badar, Dubai-based non-technical founder. I run Spotlight (physical company) and am building ~20 AI platforms using Claude + Claude Code. I work without a dev team, building entirely through Claude guidance and Claude Code in terminal. GitHub: khurrambadar3125.
The problem we solved in the previous chat
I was building platforms but ignoring security. A client (Champion Neon) showed my demo to friends-with-AI who used AI tools to find vulnerabilities, embarrassing me. I needed two things:
1. A **security-first build methodology** so this stops happening on every new platform
2. A **way to retrofit** the 20 platforms already in the field
What was built in the previous chat
Methodology established
**Security-first scaffolding** — flip the order. Instead of building the app and bolting on security, every new project starts with 30 minutes of hardening (threat model + skeleton lockdown + auth) BEFORE any features. Then features get added inside walls that already exist.
**The order on every new platform:**
1. Threat model (5 min) — `THREAT-MODEL.md`
2. Harden the skeleton (25 min) — middleware, headers, rate limit, Zod, RLS-by-default
3. Build auth before features
4. Build features — every route checks auth, every table gets RLS, every input gets Zod
5. Pre-demo gate — Claude Code audit + securityheaders.com + manual incognito test
Artifacts created (downloadable from previous chat)
1. **`spotlight-secure-starter.zip`** — hardened Next.js + Supabase + Vercel template. Every NEW platform copies from here. Contains: middleware.ts, next.config.js with full security headers, lib/auth.ts (requireUser/requireAdmin/requireOwnership), lib/validation.ts (Zod), lib/rate-limit.ts (Upstash), lib/errors.ts, supabase/policies/ with RLS-by-default examples, scripts/security-audit.md (Claude Code prompt), scripts/pre-demo-checklist.md, and HOW-TO-USE-WITH-CLAUDE-CODE.md.
2. **`RETROFIT-PLAYBOOK.md`** — generic 5-phase playbook for retrofitting EXISTING platforms (works for any stack, not just Next.js). Phase 0 prep → Phase 1 audit → Phase 2 fix critical/high → Phase 3 foundation layer → Phase 4 verify → Phase 5 send client proof. Includes a stack-agnostic principles table mapping the same 7 security principles across Next.js+Supabase, Python/FastAPI, static HTML, vanilla Node.
3. **`2050planet-security.zip`** — full hardening package specifically for 2050planet.com (audited the actual codebase I uploaded). Contains:
- `AUDIT-REPORT.md` — found 2 critical, 3 high, 4 medium issues
- `THREAT-MODEL.md` — filled in for 2050planet (UAE PDPL Art. 6 implications for child users noted)
- `PRE-LAUNCH-CHECKLIST.md` — 8 phases, every box tickable
- `LEGAL-PAGES-README.md` — 8 must-do items before publishing legal pages
- `drop-in/next.config.js` — full headers (CSP tuned to Supabase + Google Fonts + Anthropic), `poweredByHeader: false`
- `drop-in/lib/rate-limit.ts` — Upstash limiter (10/min unauthed, 30/min authed, 200/day cost ceiling)
- `drop-in/lib/terra-guards.ts` — three-layer prompt-injection defence (preflight + system prompt + post-flight scan to enforce TERRA brand)
- `drop-in/app/api/terra/route.ts` — replaces existing route with 9 defence layers in order
- `drop-in/app/.well-known/security.txt/route.ts`
- `drop-in/supabase/migrations/0002_security_hardening.sql` — adds free_terra_usage table (hashed IPs, 24h retention, PDPL-friendly), fixes profiles WITH CHECK clause, adds id-immutability trigger
- `drop-in/app/privacy/page.tsx` — UAE PDPL + GDPR compliant Privacy Policy
- `drop-in/app/terms/page.tsx` — UAE governing law Terms of Use, 16+ age gate, AED 500 liability cap
- `drop-in/app/security-policy/page.tsx` — coordinated disclosure with safe harbour
- `drop-in/components/LegalPage.tsx` — shared layout matching existing design tokens
- `drop-in/FOOTER-PATCH.md` — 3-line edit to add Security link to footer
2050planet codebase context
Stack: **Next.js 14.2.18 (App Router) + TypeScript + Tailwind + Supabase (auth + DB) + Anthropic Claude Haiku 4.5 (TERRA AI engine) + Vercel (fra1 region)**
Key facts about the code:
- 107 markdown articles, 205,336 words across 13 sections
- Static-first: all routes statically generated; only `/api/terra` is dynamic
- Generation 2050 sections target ages 2-17 (children's content — has PDPL Art. 6 implications)
- TERRA brand-locked: must NEVER reveal Claude/Anthropic (locked decision #1)
- Goal: governmental adoption, not commercial revenue (locked decision #15)
- Free tier: 3 TERRA messages without sign-in; unlimited with Google OAuth
- The codebase was clean overall — modern Supabase SSR pattern, RLS enabled, errors don't leak — but had two critical gaps:
- **No rate limiting on /api/terra** (Anthropic cost runaway risk)
- **Free-tier limit was trivially bypassable** (server only counted messages in current request payload, localStorage clear = unlimited free TERRA)
- All gaps fixed by the drop-in package
Current state — where we are right now
✅ **Done:**
- Methodology established
- Generic starter template built
- Generic retrofit playbook built
- 2050planet fully audited
- 2050planet hardening package complete
- 2050planet legal pages drafted (privacy, terms, security-policy)
⏳ **Pending — what to do in this new chat:**
Immediate next step (5 min)
Then 2050planet launch sequence (90 min total)
Side tasks pending
Monthly habit (calendar block)
Key principles to keep in mind
1. **TERRA brand discipline** — never let me ship anything that could leak the underlying model. The three-layer guard (preflight regex + system prompt + post-flight scan) is the protection.
2. **Cost control on AI endpoints** — every TERRA-like endpoint needs rate limiting BEFORE launch, not after. Anthropic bills can run away in hours.
3. **RLS-by-default** — every Supabase table gets RLS in the same migration as CREATE TABLE. No exceptions.
4. **Security-first build order** — threat model → harden skeleton → auth → features → audit. Never build features then bolt on security.
5. **Pre-demo gate is mandatory** — never share a URL with a client until securityheaders.com shows A+ and the manual incognito test passes.
My communication style preferences
- Direct, no preamble
- Probability-weighted scenarios where relevant
- Concrete examples (UAE-relevant where possible)
- Don't be overly cautious — push back honestly when I'm wrong
- Files and downloadables when I ask for something to apply
- Mobile-friendly responses (I'm usually on phone in Dubai)
---
Suggested first message in the new chat
> "Read the handover doc above. We're picking up from a security engineering project for 2050planet.com. The next step is the age-gate checkbox on the login page — write that first, then walk me through Phase A of the pre-launch checklist."