Each stage ends with its own short list. This page joins them, so you can find a doc again without remembering which stage it was in. A resource that two stages use is listed once, under the first stage, with a chip for each stage that uses it.
108 resources
Stage 1: Lock down your data
- Supabase: Row Level SecurityDocsFree Stage 1
How RLS works on Supabase, with policy examples and the grant warning for older projects.
- Supabase changelog: tables not exposed automaticallyDocsFree Stage 1 Stage 11
The grant change and its dates, in Supabase's own words.
- Supabase: API keysDocsFree Stage 1
Which keys may be public and which must stay on the server.
- PostgreSQL: Row Security PoliciesDocsFree Stage 1
The source for default-deny and how policies combine.
- Firebase: Avoid insecure rulesDocsFree Stage 1
The Firebase rules that look safe and are not, with better versions.
- OWASP Top 10:2025 A01 Broken Access ControlGuidanceFree Stage 1
Why access control is the top web risk, with prevention steps.
- OWASP Secrets Management Cheat SheetGuidanceFree Stage 1
How to store, rotate and remove secrets.
- Wiz: the Moltbook database exposureResearchFree Stage 1
A full case of a public key plus missing RLS.
- Matt Palmer: statement on CVE-2025-48757ResearchFree Stage 1
The Lovable scan, its method and its timeline.
- GitGuardian: State of Secrets Sprawl 2026ResearchFree Stage 1
How many secrets leak into public code each year.
- Privacy Rights Clearinghouse: breach notification laws, 2026ResearchFree Stage 1 Stage 11
A state-by-state survey of breach-notice deadlines.
- GitHub: About push protectionDocsFree Stage 1
How to stop a secret before it reaches your repo.
Stage 2: Third parties and dependencies
- GDPR Art. 28: Processor (copy of the official text)LawFree Stage 2
The contract and subprocessor rules behind every vendor DPA.
- Munich Regional Court, 3 O 17493/20 (Google Fonts)LawFree Stage 2
The official database entry for the Google Fonts ruling, in German.
- MIT LicenseDocsFree Stage 2
The full MIT text: short, and the one condition is clear.
- GNU GPL FAQGuidanceFree Stage 2
When the GPL does and does not require you to publish your changes.
- GNU AGPL v3DocsFree Stage 2
Read section 13 if any package in your web app uses this license.
- CISA: npm supply chain compromiseGuidanceFree Stage 2
What Shai-Hulud did and the steps CISA advises.
- GitHub: our plan for a more secure npm supply chainArticleFree Stage 2
GitHub's account of the attack and what it changed.
- Wiz: Shai-Hulud 2.0ResearchFree Stage 2
The second wave, from a security vendor that tracked it.
- Package hallucination study (arXiv 2406.10279)ResearchFree Stage 2
The study that measured how often AI models invent package names.
- npm auditDocsFree Stage 2
How to scan a project and fail a build on a severity level.
- OSV-ScannerToolFree Stage 2
A free scanner that checks your dependencies against the OSV.dev database.
- GitHub: About Dependabot alertsDocsFree Stage 2
How GitHub warns you about vulnerable packages you use.
- OWASP Top 10:2025GuidanceFree Stage 2
The current list of top web risks, with Software Supply Chain Failures at number three.
Stage 3: The paperwork
- General Legal: legal-templatesTemplateFree Stage 3
12 attorney-drafted templates under CC0, including a US privacy policy, a GDPR privacy policy, Terms of Use and a cookie notice; last updated 2026-09-22.
- Basecamp: policiesTemplateFree Stage 3
Real terms and privacy policies under CC BY 4.0; archived, so check for outdated parts and keep the credit.
- Automattic: LegalmatticTemplateFree Stage 3
WordPress.com's legal documents under CC BY-SA 4.0; share-alike applies to your changes.
- CalOPPA, Cal. Bus. & Prof. Code Sec. 22575 (copy)LawFree Stage 3
The six things a California privacy policy must contain.
- GDPR Art. 13 (copy of the official text)LawFree Stage 3
The full list of what an EU privacy notice must tell people.
- IAPP: US State Privacy Legislation TrackerResearchFree Stage 3
Which states have their own privacy law and when each takes effect.
- Apple: App Review GuidelinesDocsFree Stage 3 Stage 7 Stage 9
Read 5.1.1 and 5.1.2 for the privacy policy, deletion and AI-sharing rules.
- Google Play: User Data policyDocsFree Stage 3
What your Play privacy policy must cover and where to link it.
- Google Cloud: OAuth app verificationDocsFree Stage 3
Homepage and privacy policy rules for apps that use Google sign-in.
- Stripe: website checklistDocsFree Stage 3
What Stripe asks your public site to show: contact details, refund and cancellation terms, and more.
- FTC: action against Match and OkCupidArticleFree Stage 3 Stage 11
A 2026 case about a privacy policy that did not match what the company did.
Stage 4: Consent before tracking
- EDPB: Cookie Banner Taskforce reportGuidanceFree Stage 4
What EU regulators agree a banner must and must not do.
- EDPB: Guidelines 2/2023 on Art. 5(3) ePrivacyGuidanceFree Stage 4
Why pixels and tracking links count, not only cookies.
- CNIL: Google fined 325 million eurosArticleFree Stage 4
A 2025 fine where refusing cookies was harder than accepting.
- California 11 CCR 7025: opt-out preference signalsLawFree Stage 4
The rule that makes a browser signal a valid opt-out.
- California AG: Healthline settlementArticleFree Stage 4 Stage 11
A cookie banner that did not stop tracking, and what it cost.
- California AG: Disney settlementArticleFree Stage 4
Why an opt-out must reach the account, not only the device.
- Baker Donelson: SB 690 signed into lawArticleFree Stage 4
What SB 690 removes, what it keeps, and the fight over old cases.
- WilmerHale: CIPA reform signed into lawArticleFree Stage 4
A second summary of SB 690 from a law firm.
- PostHog: Data collection and consentDocsFree Stage 4
How to start PostHog opted out and opt in on consent.
- PostHog: Session replay privacy controlsDocsFree Stage 4
What PostHog masks by default and how to mask more.
- Microsoft Clarity: Consent modeDocsFree Stage 4
The consent signal Clarity needs for EEA, UK and Swiss visits.
- Microsoft Clarity: MaskingDocsFree Stage 4
The masking modes and how to change them per element.
Stage 5: Sensitive data: health and kids
- FTC: Health Breach Notification Rule changesGuidanceFree Stage 5 Stage 11
What changed in 2024 and why health apps outside HIPAA are covered.
- FTC: the GoodRx caseGuidanceFree Stage 5
The first case under the rule, with the list of what was shared.
- FTC: the BetterHelp caseGuidanceFree Stage 5
How intake answers reached ad platforms.
- Meta 10-Q, June 2026ResearchFree Stage 5
Meta's own account of the Flo verdict and what the plaintiffs seek.
- Washington RCW 19.373.090LawFree Stage 5
How the My Health My Data Act is enforced.
- FTC: COPPA six-step compliance planGuidanceFree Stage 5 Stage 11
The best first read on whether COPPA covers you.
- FTC: Complying with COPPA, FAQGuidanceFree Stage 5
Staff answers on age gates, actual knowledge and general-audience apps.
- Federal Register: 2025 COPPA RuleLawFree Stage 5
The amended rule, its dates and the new duties.
- FTC: the Epic Games settlementGuidanceFree Stage 5
Why chat that is on by default became a children's privacy problem.
Stage 6: Accessibility
- W3C: WCAG 2.2GuidanceFree Stage 6
The current standard, with every rule and its level.
- W3C: How to Meet WCAG (quick reference)GuidanceFree Stage 6
Every rule with plain techniques and examples, filterable by level.
- W3C: WCAG 2.1GuidanceFree Stage 6
The version the DOJ rule and many contracts name.
- Seyfarth Shaw: 2025 federal website accessibility filingsResearchFree Stage 6
The 3,117 count, its trend and its limits.
- ADA.gov: first steps for the web ruleGuidanceFree Stage 6
The DOJ rule for public bodies and its current deadlines.
- European Accessibility Act, Article 4LawFree Stage 6
The requirements and the microenterprise exemption for services.
- European Commission: European Accessibility ActGuidanceFree Stage 6
Which products and services the Act covers.
- axe DevToolsToolFree Stage 6
A browser extension that scans a page for accessibility rule breaks.
- WAVEToolFree Stage 6
Shows accessibility problems drawn on top of your page.
- LighthouseToolFree Stage 6
Chrome's built-in audit, including an accessibility score.
Stage 7: AI features
- EU AI Act Article 50 (unofficial mirror)LawFree Stage 7
The transparency duties, in readable form, with links to the rest of the Act.
- Cuatrecasas: the Digital Omnibus on AI is publishedArticleFree Stage 7
What the 2026 change package moved, and the Article 50 marking grace period.
- Hunton: Digital Omnibus on AI enters into forceArticleFree Stage 7
A second law-firm reading of the same dates.
- California SB 243, chaptered text (law-firm copy)LawFree Stage 7
The full companion chatbot law, short enough to read in one sitting.
- Utah SB 226, enrolled textLawFree Stage 7
Utah's AI disclosure rules and the safe harbor.
- Colorado SB 26-189LawFree Stage 7
The bill page for Colorado's automated decision-making law.
- FTC: Operation AI ComplyGuidanceFree Stage 7
Five cases that show which AI claims the FTC treats as deceptive.
- Anthropic Usage PolicyDocsFree Stage 7
AI disclosure and high-risk use rules for apps built on Claude.
- OpenAI usage policiesDocsFree Stage 7
The equivalent rules for apps built on OpenAI models.
Stage 8: User content
- Copyright Office: DMCA Designated Agent DirectoryToolPaid Stage 8
Where you register, renew and search agents; each filing costs $6.
- Copyright Office: online service provider FAQGuidanceFree Stage 8
Plain answers on registration, expiry and renewal.
- 17 U.S.C. 512LawFree Stage 8
The safe harbor conditions, including the repeat infringer policy.
- 17 U.S.C. 504LawFree Stage 8
Statutory damages for copyright infringement.
- 37 CFR 201.38LawFree Stage 8
The rule that a designation expires after three years.
- 47 U.S.C. 230LawFree Stage 8
The platform shield and its exceptions, in the law's own words.
- TAKE IT DOWN Act, Public Law 119-12LawFree Stage 8
The 48-hour removal duty and what a valid request contains.
- FTC: TAKE IT DOWN Act business guidanceGuidanceFree Stage 8
How the FTC expects platforms to run requests, with hash-matching tips.
- European Commission: the Digital Services ActGuidanceFree Stage 8
The official overview, including lighter rules for small companies.
- DSA Article 16 (unofficial mirror)LawFree Stage 8
What the EU notice-and-action form must do.
Stage 9: Subscriptions and cancellation
- 15 U.S.C. 8403 (ROSCA)LawFree Stage 9
The three duties in the statute's own words.
- FTC: the Amazon Prime settlementGuidanceFree Stage 9
The largest case so far on sign-up and cancel design.
- Eighth Circuit: Custom Communications v. FTCLawFree Stage 9
The opinion that vacated the click-to-cancel rule.
- Federal Register: the 2026 advance noticeLawFree Stage 9
Where the FTC's new rulemaking starts.
- California Bus. and Prof. Code 17602 (mirror)LawFree Stage 9
California's disclosure, cancel and reminder duties.
- Minnesota Statutes 325G.57LawFree Stage 9
Minnesota's trial and yearly notice rules.
- Skadden: New York City's click-to-cancel ruleArticleFree Stage 9
A law firm summary of the NYC rule and the state count.
- Stripe: customer managementDocsFree Stage 9
What the customer portal can and cannot do.
- Google Play: subscriptions policyDocsFree Stage 9
Google's rules for trials, pricing and cancel paths.
Stage 10: Email and texts
- FTC: CAN-SPAM Act compliance guideGuidanceFree Stage 10
The duties, the penalty, and the business email and vendor rules in plain words.
- 15 U.S.C. 7704LawFree Stage 10
The CAN-SPAM requirements in the statute.
- 16 CFR 316.3LawFree Stage 10
The primary purpose test for commercial and transactional email.
- Google: Email sender guidelinesDocsFree Stage 10
What Gmail requires from every sender and from bulk senders.
- Yahoo: Sender best practicesDocsFree Stage 10
Yahoo's authentication, unsubscribe and complaint rules.
- Microsoft: Outlook.com postmaster policiesDocsFree Stage 10
The high-volume sender rule for Outlook.com.
- ePrivacy Directive Art. 13 (UK-hosted copy)LawFree Stage 10
The EU consent rule and the soft opt-in.
- CASL, Justice LawsLawFree Stage 10
Canada's anti-spam law, starting with the consent section.
- 47 CFR 64.1200LawFree Stage 10
The FCC rule on consent for calls and texts, and how people revoke it.
- 47 U.S.C. 227LawFree Stage 10
The TCPA, including the damages for each violation.
Stage 11: Make your agents remember
- PostHog: control which sessions you recordDocsFree Stage 11
How to keep replay off in code and start it only after consent.
- CPPA: Tractor Supply decisionArticleFree Stage 11
A fine that came with an order to scan and inventory tracking tools.
- The Orchestrator CourseCourseFree Stage 11
How I set up instruction files so several coding agents read the same rules.
Talk to Claude instead of typing to it.
Ducktate turns what you say into clean text, on your Mac, and pastes it anywhere.
Get early access