Entity Auditor

A business owner can read their own website and see a clear story. A machine reading the same pages often cannot establish who the business is, what it does, where it operates, or whether the same facts appear consistently across the site. Nothing tells the owner which of those it is, so there is no way to know whether the problem is the content, the markup, or nothing at all.

Turn an invisible problem into a report someone can act on: name the categories, grade each one, and say specifically what is missing or disconnected.

A scanner with a paid report behind it. Enter a URL and it crawls the site, evaluates six categories of publicly observable entity signal, and produces a graded audit: problems, opportunities, root causes, repairs and the evidence for each. The free tier returns the six grades and the counts. The report itself, the entity card, the prose interpretation, the entity graph and every problem title are paid.

The free tier is deliberately the grades and the totals and nothing else: how many problems, never which ones. A count proves the scan really ran without giving away the thing being sold. The gate is enforced on the server, so paid fields are never serialized to the browser at all, and the tests assert on the response payload rather than on the rendered page, because that is where a leak would actually appear. Payment is one $29 Stripe checkout with no account: an unguessable token in the URL is the entitlement, and the link is the receipt.

Eric's own product, built and shipped by him: the crawler, the scoring rubric, the report, the paywall and its server-side gate, the checkout flow and the storage layer. Stripe processes the payment and Upstash Redis stores the audits. The judgement encoded in the rubric, and the decision about where the free tier stops, are the product.

Not the scanner. The failure modes around the money. Two of them only showed up by buying the product with a real card. The store caught every Redis error and returned null, which is the same answer as "no audit with that id", so a dead database looked identical to a missing record: fulfilment gave up quietly, Stripe saw HTTP 200 and never retried, and with no account and no email there was nothing left to recover the report from. Separately, unpaid records expired after 24 hours while a Stripe session lives exactly that long, so a checkout opened late and paid a few hours later landed on a record that had already been deleted along with its token. Both were fixed on 2026-09-22: reads now throw instead of lying, the webhook answers 503 when the store is down so Stripe redelivers, and opening checkout stamps the record and buys it thirty days.

Results from client deployments are shared with permission on a call.

One real paid transaction, on a real card, through live Stripe. That is the whole of the measured outcome and it is stated as one sale rather than rounded up into customers.

A payment path cannot be verified by reading it. Both of those bugs were invisible in the source and obvious the moment a real card went through, which is now the last step before anything with a price on it ships. The narrower lesson: an error handler that returns the same value as "not found" has destroyed the only information the caller needed.

• Next.js
• TypeScript
• Stripe Checkout
• Stripe webhooks
• Upstash Redis
• Vercel

• EricVegas.com Identity And Evidence Infrastructure
• LinkPayHub