Tested NoteNest (our local demo app)

In this Lovable project: A customer paid successfully in Stripe but the paid features stayed locked ('charged but still locked'). Unlock access only from a server-side source of truth: handle the Stripe webhook events checkout.session.completed and customer.subscription.updated, verify the webhook signature, look the user up by client_reference_id (not by email alone), and save their subscription status and current_period_end. On every page load, read access from that saved status on the server. After the change, a paying user must see paid features after a refresh and after logging out and back in. If the app uses Supabase, put the check in a Supabase Edge Function or a row-level-security policy, not in the React component. Show me the changes before applying them, then keep everything else working.

In this Lovable project: Paid content can be reached without paying (for example by opening the paid page while logged out, with a free account, or by visiting the success URL directly). Protect every paid route and every paid data query on the SERVER: check that the user is logged in and has an active paid status saved from Stripe webhooks before returning anything. Hiding things in the UI is not enough. Never unlock because of a URL parameter like ?success=true. If the app uses Supabase, put the check in a Supabase Edge Function or a row-level-security policy, not in the React component. Show me the changes before applying them, then keep everything else working.