Free tier limits are enforced

A pricing page that advertises a 3-project limit is a business promise — if the API enforces no such limit, every free user can exploit the gap indefinitely. OWASP A01 (Broken Access Control) and CWE-284 (Improper Access Control) apply directly. This is also a revenue integrity issue: without enforcement, free tier users have no incentive to upgrade, which directly undermines the conversion funnel. Display-based limits (showing only the last 5 records in the UI while the API returns all) fail this check — the limit must exist at the query or API layer.

Add usage count checks to every resource creation endpoint before allowing the write. Read the limit from your central plan configuration so pricing page and API always agree.

// app/api/projects/route.ts
export async function POST(req: Request) {
  const session = await getServerSession()
  const user = await db.user.findUnique({
    where: { id: session.userId },
    include: { _count: { select: { projects: true } } }
  })

  const limit = PLANS[user.plan ?? 'free'].limits.projects // e.g. 3 for free, Infinity for pro
  if (user._count.projects >= limit) {
    return Response.json(
      { error: `Project limit reached (${limit}). Upgrade to create more.` },
      { status: 402 }
    )
  }

  // proceed with creation
}

For display-based limits ("show last N submissions"), enforce the limit in the SQL query with LIMIT N — not in the UI render layer.