Scaling Apps Beyond the Chat Window: Part 2, Online, Secure and AI-Powered

What's inside

1. Level 1: How the Web Reaches Your AppFree
   Follow a visit from a typed address to a running app, step by step: domain, DNS lookup, HTTPS connection, front-end code that runs in the browser, and server-side code that runs on a computer you control.
2. Level 2: Meet the Example App, Its Services and Free TiersFree
   Meet the small sign-in app with an AI feature that the course builds from your Part 1 GitHub repository, learn what Vercel, Supabase, Cloudflare and OpenRouter each do and which alternatives exist, and create your accounts after comparing the current free-tier limits and writing down the date you checked them.
3. Level 3: Connect GitHub to Vercel: Automatic and Preview Deploys
   Import your GitHub repository into Vercel so that every push to the main branch publishes the live site and every other branch or pull request gets its own preview address.
4. Level 4: Environment Variables, Build Logs and Failed Deploys
   Store settings in Vercel environment variables for each environment, then read a build log line by line to find and fix the cause of a failed deploy, with an AI assistant suggesting fixes that you check before you accept them.
5. Level 5: Cloudflare: Your Domain, DNS and Protection
   Register or move a domain to Cloudflare, add the DNS records that point it at your Vercel app, turn on HTTPS and basic protection settings, and decide when Cloudflare Workers or R2 storage would be worth adding.
6. Level 6: Supabase Basics: Tables and Relationships
   Learn why an app needs a hosted database, then design the example app's tables, columns, primary keys and foreign-key relationships in a Supabase project.
7. Level 7: The Data API: Explicit Grants and Row-Level Security
   Learn how the app reaches tables through the Data API. Under Supabase's change that applied to all projects on 30 October 2026, a new table in the public schema is unreachable until you grant it to the anon, authenticated and service_role roles, and row-level security policies then decide which rows each user can see.
8. Level 8: Migrations: Database Changes You Can Repeat
   Record every database change as a migration file in your repository. Each migration that creates a table also grants it and enables row-level security in the same file, so a fresh local stack, a preview branch or a database reset matches production.
9. Level 9: User Sign-In and Sessions with Supabase Auth
   Add email sign-up and sign-in with Supabase Auth, learn what a session is and how the app knows who is signed in, and link each user's rows to their user ID so that your policies apply.
10. Level 10: File Storage: Buckets, Policies and Safe Uploads
    Store user files in Supabase Storage, choose between public and private buckets, and write storage policies that limit uploads by owner, file type and size.
11. Level 11: Keys, Tokens and Secrets: Public Versus Secret
    Tell apart API keys, access tokens and sessions, sort every key in the app into public or secret, and see why anything sent to the browser can be read by anyone.
12. Level 12: Server-Side Functions and Key Rotation
    Move every call that needs a secret into a server-side function on Vercel, check who the user is inside that function, and practise rotating a key when it leaks or on a schedule.
13. Level 13: Security Checklist for AI-Written Code
    Check an AI-written app against a security checklist (exposed keys, missing grants or row-level security, trusting the client, input validation, rate limits, safe error messages, dependency updates), and use an AI security review as one input that you confirm yourself.
14. Level 14: Calling AI Models Through OpenRouter
    Add an AI feature by calling models through OpenRouter from a server-side function, using one key to reach many models, choosing a model by quality, speed and current price, and streaming the reply to the user.
15. Level 15: Controlling AI Cost: Limits, Caps and Fallbacks
    Keep AI spending predictable by working out the cost per user, storing per-user usage limits in the database, setting spending caps on the provider account, and adding fallback models for when a model fails or is too expensive.
16. Level 16: Final Challenge: Ship a Secure AI App to the World Exam
    Bring together the whole course: ship a public app with sign-in, a Supabase database whose migrations include grants and row-level security, and an AI feature called from the server, on your own domain, and pass the full security checklist.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →