How I ship eight products on nights and weekends
I have a full-time job running cloud and FinOps for a large government program. On my own time I’ve built and launched eight products: an insurance platform, a private memorial service, a course site, two e-commerce stores, and a few local-business sites. They all run in production, cost little, and rarely need me.
That’s possible because nearly everything is the same stack and the same habits. Here’s the playbook.
1. Static first
Most pages don’t need a server. My default is a Next.js static export on S3 behind CloudFront:
- Nothing to patch, nothing to scale, nothing to wake me up.
- It costs pennies a month for typical traffic.
- It’s fast everywhere, which is also an SEO advantage.
When a product handles sensitive data, static helps privacy too. On Everkinly (private family memorials), private data is never in HTML or build output. It loads in the browser after sign-in, so a misconfigured cache can’t leak it.
2. Serverless only where there’s a reason
Forms, payments, and privileged actions go to small AWS Lambdas: a lead handler, a quote handler, a Stripe webhook. Each has one job and its own validation, and the form handlers come with a local test server and a fake email outbox, so I can test them without touching AWS.
Only one product, PolicyChecked, runs on a server, because it uses React Server Components heavily. Even there the server is locked down: it accepts traffic only from CloudFront, deploys go through SSM with no SSH, and everything is defined in one CloudFormation stack.
3. Put security in the database
For apps with accounts I use Postgres row-level security (via Supabase) on every table, with column-level grants and security-definer functions for sensitive changes. The rule I follow: hiding a button is never access control. If the database won’t allow it, a UI bug can’t expose it.
I prove it rather than trust it: a check applies every migration to an in-memory Postgres and fails if any table lacks RLS.
4. One source of truth for facts
Every business site has a single typed config holding the phone number, service area, prices, credentials, and social links. Anything unverified is null and simply doesn’t render. That one habit prevents a whole class of embarrassing mistakes, like a placeholder email going live.
5. Audits run before every deploy
Before deploying, each site runs a script that checks for:
- broken links and images
- missing titles, descriptions, canonicals, and alt text
- invalid structured data (JSON-LD)
- risky claims in marketing copy (“guaranteed”, “best”, unverifiable numbers)
- secrets accidentally committed
If any check fails, it doesn’t ship. Production stays clean even when I only have an hour.
6. FinOps from day one
Products get budget alerts, sensible defaults (Graviton instances, gp3 disks, no idle NAT gateways), and a monthly look at cost by usage type. Most of my products cost a few dollars a month. The most complex one runs for about $15.
The real secret
None of this is clever. It’s the same decisions, made once and reused eight times. A boring, proven stack frees all my energy for the product itself.