📋 Observability + Security · Cheat Sheet · Day 5 · pin this tab
See it. Ship it. Secure it.
10 prompts · 5 phases · Sentry + PostHog installed · bug hunter + security audit before every publish · crisis triage saved for when it breaks · 3 bonus rituals to compound.
Workshop stack: Lovable × GitHub × Supabase × Claude Cowork · with Sentry · PostHog · Stripe · Resend MCPs. No terminals · no raw API keys in chat · no Vercel.
🏆 5 golden rules · pin forever
Memorize these.
1 · You can't fix what you can't see. Instrument BEFORE you scale.
2 · 5 events > 50. Track few things well. Add as you grow.
3 · Errors silently kill conversion. Sentry is non-negotiable.
4 · Publish is a gate · not a button. Bug hunter + security audit before every release.
5 · Connect MCPs · don't paste API keys. Every tool wires through the Cowork Connectors UI.
🏗 The 4 layers · 4 free tools · all via MCP
What watches what.
| Layer | What it sees | Tool | Free tier · MCP connected? |
|---|
| 1 · ERRORS | Crashes · exceptions · slow loads · failed API calls · rage clicks | Sentry | 5k errors/mo · 50 replays/mo · via Sentry MCP |
| 2 · PRODUCT | Events · funnels · session replays · heatmaps · A/B tests · feature flags | PostHog | 1M events/mo · 5k replays/mo · via PostHog MCP |
| 3 · DATA + AUTH | DB · RLS · auth · edge functions · logs · security advisors | Supabase | 500MB DB · 50k MAU · via Supabase MCP |
| 4 · REVENUE + EMAIL | MRR · churn · disputes · webhooks + weekly digest email | Stripe + Resend | Free forever + 3k emails/mo · via Stripe/Resend MCPs |
Rule: if a tool has an MCP · connect it in Cowork Settings → Connectors. If it doesn't · use its UI directly. Never paste an API key in chat.
⚡ 10 prompts · workshop kit · in run order
Each has a gold copy button on its card.
⚙ Phase 0 · SETUP · load context once
P00 · Context loader (2 min · required) — reads Project + memory + Supabase MCP + Stripe MCP · outputs 8-line brief · zero re-typing after this.
⭐ Phase 1 · DECIDE what to track
P01 · Your 5 must-watch metrics (3 min) — 5 metrics tailored to YOUR app + stage. Panel: Casey Winters + Lenny Rachitsky + April Dunford.
🛠 Phase 2 · INSTRUMENT · 30 min total
P02 · Sentry · account + MCP + install + alerts (15 min) — sign up · connect Sentry MCP · install via Lovable prompt OR GitHub PR · first test error captured. Panel: David Cramer + Charity Majors + Mitchell Hashimoto.
P03 · PostHog · account + MCP + install + funnels (15 min) — sign up · connect PostHog MCP · install · 5 events firing · first funnel live. Panel: James Hawkins + Casey Winters + Lenny Rachitsky.
🔍 Phase 3 · AUDIT + TRIAGE · the pre-publish gates
P04 · 🐛 Bug hunter · flagship pre-publish audit (20 min) — 6 vectors: static/code · Sentry runtime · PostHog user flow · UX/a11y · adversarial user sim · mobile matrix. Assumes it will find bugs.
P05 · 🔒 Security + DB vulnerability audit ⭐ (25 min) — 8 vectors: secrets grep · Supabase RLS + advisors · auth flows · edge fns · SQL injection · payments · client-side · adversarial pen-test. Any 🔴 CRITICAL = BLOCK PUBLISH.
P06 · 🚨 Crisis triage · "what broke?" (3 min · use when broken) — calm methodical 5-step via Sentry + GitHub + Supabase + PostHog + Stripe MCPs. Save as a Cowork skill.
✦ Additional Bonus Prompts ✦
Three optional add-ons · run when ready.
Not required to ship · but they compound the daily and weekly rituals that separate "I think we're growing" from "here's the exact number."
🎁 Phase 4 · BONUS · revenue + rituals
P07 · 💳 Stripe alerts via connected MCPs (10 min) — 5 events (win · churn · declined · disputed · paid) → Slack/Resend/Discord MCP. Panel: Patrick Collison + Justin Welsh + Will Larson.
P08 · 📊 Morning dashboard (auto from MCPs) (10 min) — single Lovable /dashboard route · 6 cards · pulls live via Sentry + PostHog + Stripe MCPs. Panel: Edward Tufte + Stephen Few + Justin Welsh.
P09 · ✉ Weekly digest via Resend MCP (10 min) — Sunday 9am · Supabase pg_cron · WIN / WORRY / FIX · sent via Resend MCP · no API keys in chat. Panel: Lenny Rachitsky + Justin Welsh + Stephen Few.
🐛 P04 · Bug hunter · 6 vectors
Every publish. Find them first.
1 · Static / Code
GitHub MCP · null checks · promise rejections · race conditions · missing states · N+1
2 · Runtime
Sentry MCP · all errors 14d · grouped by root cause · ranked by users
3 · User Flow
PostHog MCP · funnel drops >40% · rage clicks · dead clicks · frustrated closes
4 · UX / a11y
Loading states · brand-voiced errors · empty state CTA · sticky buttons · focus rings
5 · Adversarial
5 hostile users: fat-fingers · slow net · screen reader · emoji · dup signup
6 · Mobile matrix
iPhone SE 375×667 · Safari input 16px · Firefox date-picker · slow 3G skeleton
Output: ranked P0–P3 table · repro steps · root cause · fix diff as paste-ready Lovable prompt.
🔒 P05 · Security audit · 8 vectors · the publish gate
🔴 Any critical = block publish.
1 · Secrets
Grep repo + git history · Sentry payloads · rotate anything found · block publish
2 · Supabase RLS
Every table has RLS · auth.uid() = user_id · get_advisors via MCP
3 · Auth flows
Reset tokens single-use · magic links <15min · OAuth CSRF · JWT alg pinned
4 · Edge fns
auth.getUser() · rate limits · input validation · CORS not * · sig verify
5 · SQL injection
No raw concat · parameterized · tsquery escaped · every query has user_id WHERE
6 · Payments
Stripe sig verified · paywall not spoofable · prices from Stripe · idempotency keys
7 · Client-side
No secrets in window · no JWTs in localStorage · XSS sanitized · CSP · HSTS
8 · Adversarial
5 attackers: competitor · stuffer · impersonator · insider · refunder — all blocked?
Publish gate: ANY 🔴 CRITICAL → do NOT publish. Fix · re-run · then publish. Save to Project-Plan.md → Security audits. Include a REGRESSION TEST for every critical.
☀ P08 · Morning dashboard · 6 numbers in 5 min
Tomorrow 9am. Every day.
1 · Visitors today
PostHog MCP · pageviews last 24h · up or down vs yesterday?
2 · Signups today
PostHog MCP · event = signup_completed
3 · Activation 7d
PostHog MCP · funnel · % who hit your aha moment
4 · New MRR today
Stripe MCP · subs created · how much $ added?
5 · New errors 24h
Sentry MCP · new issues · anything BROKEN?
6 · Latest replay
PostHog MCP · session recording embed · daily UX gut-check
Deploy: Lovable /dashboard route · Supabase auth allowlist (only you) · add to phone home screen. The morning ritual investors love to see.
🚨 P07 · Stripe events that wake you up
5 events · 5 alerts.
| Event | What it means | Action | Priority |
|---|
| checkout.session.completed | 🎉 New customer subscribed | Celebrate. Welcome email via Resend MCP. | HIGH |
| customer.subscription.deleted | 😱 Customer churned | Email today via Resend MCP. Ask why. | HIGH |
| invoice.payment_failed | ⚠ Card declined | Warm email within 1hr. Stripe retries auto. | MEDIUM |
| charge.dispute.created | 🚨 Chargeback initiated | Respond via Stripe Dashboard within 7 days. | HIGH |
| invoice.paid | 💚 Recurring payment landed | Quiet log. Update MRR. Optional thank-you. | LOW |
Ship tonight: Stripe MCP wires the webhook → Supabase edge fn (deployed via Supabase MCP · not CLI) → Resend/Slack/Discord MCP for the ping. Test via Stripe Dashboard → Webhooks → Send test event.
🆘 P06 · When something breaks · 5-step triage
Save P06. Paste in panic.
- 1SENTRY MCP · query "new error types last 24h" · matches symptom? Top stack frame · suggest fix.
- 2DEPLOY HISTORY · GitHub MCP (last 10 commits) + Lovable version history · anything in the symptom window? 1-click rollback candidate.
- 3SUPABASE MCP · get_logs · RLS errors · DB timeouts · auth failures? Identify query · suggest fix.
- 4POSTHOG MCP · funnel drop spike in same window? Which step? Which user segment?
- 5STRIPE MCP · payment failures · webhook delivery issues? Which event · what error · retry?
You'll catch 90% in 90 seconds. The other 10% are slow leaks the weekly digest catches. If revenue is affected · stop the bleed BEFORE finding root cause.
💰 Free tier limits · when to upgrade
When you'll graduate.
| Tool | Free tier | Upgrade trigger | Next tier $ |
|---|
| Sentry | 5k errors/mo · 50 replays/mo · 1 user | ~$5k MRR or teammates | $26/mo (Team) |
| PostHog | 1M events/mo · 5k recordings · 100 flags | ~$10–20k MRR (many never upgrade) | ~$0.00031/event PAYG |
| Supabase | 500MB DB · 1GB storage · 50k MAU | ~500 active users | $25/mo (Pro) |
| Stripe | Free forever · webhooks free | n/a | 2.9% + 30¢ per transaction |
| Resend | 3k emails/mo · 100/day · 1 domain | ~1k active users | $20/mo (Pro · 50k emails) |
| Lovable + Cowork | Per your existing plan | Feature access · not usage | Existing subscription |
For the 10-Day Sprint: all free tiers cover you well past Sellathlon (Day 8). Total stack observability + email cost by Demo Day: $0/mo.
📋 Post-workshop checklist · do TONIGHT
Before Sunday's rest day.
- P00 context loader run · Cowork knows my app · no re-typing
- P01 · 5 metrics picked · saved in Project-Plan.md
- Sentry account + MCP + install · first test error captured · alert rule enabled
- PostHog account + MCP + install · 5 events firing · 1 funnel live
- P04 bug hunter run · top-3 fixes shipped via Lovable prompts
- P05 security audit run · zero 🔴 CRITICAL findings · audit saved to Project-Plan.md
- P06 crisis triage saved as a Cowork skill · ready for the 11 PM moment
- Bonus: P07 Stripe alerts wired (🎉 + 😱 pings) · P08 dashboard live · P09 weekly digest cron deployed via Supabase MCP
- Posted to pod thread · before/after screenshot from P04 or P05 · tag @meganmartinsone · #10DaystoShip
By Day 8 Sellathlon: walk in with REAL numbers pulled live via MCPs — "Users X · activation Y% · MRR Z · errors 0 in last 24h". That's the flex.
🌴 Sunday Jul 12 · rest day · you earned it
Then Monday we build in public.
📅 Today
Sat Jul 11 · S3 4pm
User testing session — real humans test what you polished
🌴 Sunday
Jul 12 · REST
Rest day. Sleep. Beach. Come back Monday fresh
🚀 Monday
Day 6 · Jul 13
Week 2 kicks off · Build in Public + Pricing + Deploy Day
The compounding play: P07 + P08 + P09 wired tonight = every morning you wake up to a dashboard · every Sunday you get a WIN/WORRY/FIX email. Rituals that outlast the workshop.