Battle Plan: a live subscription SaaS with AI marking and paying users.

What it is

A revision platform that does more than store past papers. Students get a planned schedule, progress analytics, AI-assisted marking of their own written work, and predicted grade tracking against their targets.

The parts that were genuinely hard

Payments and access control

Subscription billing through Stripe, with entitlement enforced on the server rather than in the interface. Access is derived from verified payment state, so a user cannot grant themselves a paid tier by editing what the browser sends. Database permissions and row-level security back this up, so the rule holds even if application code has a bug.

AI marking with real cost control

Students upload their own written work and get structured feedback. Running a language model against user uploads costs money per request, so usage is quota-limited per tier, and marking output is stored while the large uploads are not. That keeps storage cost flat as usage grows.

Multi-tenant school accounts

Schools hold classes of students with teacher oversight, which means one user's data must never leak into another's. Access is enforced at the database with row-level security and verified by testing against impersonated roles, which caught two authorisation bugs that reading the code alone did not.

What this demonstrates

It is a complete commercial product rather than a demo: billing, tiers, permissions, abuse limits and the unglamorous operational parts that decide whether software survives contact with real users.

The security work is the part most relevant to business clients. Anyone can build a system that works when used correctly. Making it hold up when someone tries to bend it is the difference.