Pricing page matches backend enforcement

When the feature list on your pricing page diverges from backend enforcement, users pay for access that doesn't exist or get features they shouldn't have. OWASP A01 (Broken Access Control) and CWE-284 (Improper Access Control) cover the enforcement gaps. Beyond security, pricing-backend mismatches erode customer trust when a paid feature is silently accessible to free users — competitors can exploit this, and paying customers feel deceived when they discover the paywall was optional.

Centralize plan configuration in a single lib/plans.ts that both the pricing page and backend checks import. This eliminates drift between what you advertise and what you enforce.

// lib/plans.ts — single source of truth for both pricing UI and API enforcement
export const PLANS = {
  free: {
    name: 'Free',
    features: ['basic_analytics', 'up_to_3_projects'] as const,
    stripePriceId: null,
  },
  pro: {
    name: 'Pro',
    features: ['advanced_analytics', 'unlimited_projects', 'csv_export'] as const,
    stripePriceId: process.env.STRIPE_PRO_PRICE_ID,
  },
} as const

// In API routes:
// if (!PLANS[user.plan].features.includes('csv_export')) return 402

For each feature listed in the pricing page, verify a server-side check exists by searching for the feature key in app/api/ and middleware.ts.