Skeleton · T3.1

UseProof

Next.js 16.3 · React 19 · Tailwind v4 · shadcn/ui on Base UI · Drizzle + Postgres RLS. Three surfaces, one tenancy boundary.

Dashboard

live — Supabase Auth behind src/lib/auth/

Low traffic, user-authenticated. Reads only its own org's rows; the boundary is RLS, not the query.

Embed widget

scaffolded — GET /v1/feed?site=sk_…

Hit by every visitor of every customer site. Public site key, CDN-cached, must never break the host page.

Ingest

scaffolded — src/lib/hmac.ts

Signed webhooks and tracking writes. HMAC-SHA256 verify, service role, idempotent on (site_id, event_id).