Anything test data

The Fitting Room brief was pasted word for word (1,689 characters) into a new project's chat at 16:11 UTC on 26 October 2026. The clock stops when the app is live and the checks pass: 25 of 30 on the full scale, applied here as 20 of the 24 checks that need no keys of mine.

The agent started at once, with no question and no plan to approve. The first build had finished by 16:37, when I looked, so within 26 minutes; I did not catch the exact minute. It then asked in a form for an admin email and an email key.

The first publish failed after 203 seconds: the checkout code created a Stripe connection without a key during the build. I pressed Anything's own Fix with AI button, typed nothing, and it fixed that fault and two others. The second publish went live at 16:57, 46 minutes after the brief, after two prompts. The app needed no further prompt before the checks I ran by hand, which passed 23 of 24. By hand I added the admin email as a secret, because the form would not save without the email key.

• The exact minute the first build finished was not caught; the checks themselves were run after the app was live.

The checks were run against the live app, by hand, with a note per check. The six checks that need your own Stripe and email keys (C24 to C29) are left out, so the thresholds are applied to the 24 that remain: 5 needs 93% or more (23 or more), 4 needs 80% (20), 3 needs 60% (15), 2 needs 33% (8) and 1 is below that.

23 of 24 checks passed, which is 95.8%. Passing: sign-up and log-in (C01, C02), the role screens (C04), the three seeded classes (C05), instructor, capacity and places booked (C06), booking, My bookings and cancelling with the place freed (C07 to C09), the full-class rule, shown as Class full (C10), the no-credit message (C11), member A never seeing member B's bookings (C12), the coach seeing only their own classes and the members booked on them (C13, C14), Mark attended, still there after a reload (C15), the admin adding, editing and deleting classes (C16 to C18), every booking, the CSV and the counts per class (C19 to C21), and the Ask the studio form with the admin's list (C22, C23).

One failed: the password reset (C03). The page said the reset email could not be sent, and the server answered 502, because the app sends mail through Resend and its key is the owner's, which I did not add. All ten facts were on the live timetable and nothing was invented, though the page adds a line the brief did not give: credits never expire.

• Payments and the declined-card check were not run: they need your own Stripe key. The reset email is counted as a failure, although the missing key is mine.

Sign-up, log-in and log-out for a member, an instructor and an admin on the live app, then two attacks: a member asking for another member's bookings with the other member's user id, and a member calling an admin-only action. I replayed the app's own requests as the wrong user, and also tried to change my own role to admin.

Attack 1 was blocked: GET /api/bookings with member B's user id returned only member A's own bookings (the id is ignored), and DELETE on B's booking answered 403 You can only change your own bookings. Attack 2 was blocked: DELETE and POST on /api/admin/classes and GET /api/admin/bookings answered 403 Admins only to a member and to a visitor. A member who opened /admin saw a page saying it is for studio admins only.

Admin cannot be chosen at sign-up: the form offers Member or Instructor, and the admin is the address in the ADMIN_EMAIL secret. A call to set my role to admin returned member. Anyone can choose Instructor, but a second account signed up as Lena Park saw no classes. The one flow that did not work is the password reset (see Spec Accuracy).

• I did not find how an instructor account is linked to a seeded instructor; the first account signed up as Lena Park was linked, and a second with the same name was not. Anything's own security scan was not run.

The six data checks: the form and bookings write real records, they survive a reload, a republish and a design change, the admin can view, filter, edit and delete them, and they export as a file.

Proved (six): the Ask the studio form and the bookings wrote records; they stayed after reloads, after five publishes and after the colour change in E03; the admin viewed, edited and deleted records in the app, and I viewed, filtered, changed and deleted rows with SQL in the Databases screen; and the bookings exported as CSV from both the admin page and the Databases screen.

The Databases screen shows production data. Deleting a class in the app is a soft delete: the row stays with its active flag set to false.

• The export I ran was a query result, not a full backup. Anything's support says a whole-database export exists; I did not find or run it.

Publish to the vendor address, timed, then a Lighthouse phone run on the home page of https://fitting-room-pilates-studio-22.created.app, and layout at 360, 768 and 1440 pixels.

Each publish took about two minutes from the click to the Published message (132 to 144 seconds on the four that worked), and the first one failed after 203 seconds. The app is on a created.app address. Pro includes custom domains and the Domains screen offers to add one; I did not try it.

The phone score was 69. The largest contentful paint was 3.3 seconds, the layout shift 0.34, blocking time 37 ms, and the page weighs about 0.37 MB in 34 requests. The home and admin pages did not scroll sideways at the three widths.

• One speed run, home page only; no domain; no real phone; no timetable of 100 classes.

Looking for a way to take the app out, then downloading it and opening it read only in a clean folder outside the project: install with scripts off, then build.

In the code view, Download Project gave anything.zip: 11.8 MB, 225 files, a Next.js web app (with better-auth for sign-in and a Neon database driver) and an Expo mobile app. The web app built after I added two packages it uses but does not list, stripe and argon2.

It still depends on Anything: an Anything project token in its environment file, an upload service on an Anything address and a sign-in helper folder. I did not run it against a database of my own. I did not read the terms, because their link downloads a file.

• Only the build was run, not the app.

One real question by email to hello@anything.com, Anything's main support channel, sent at 19:44 UTC on 26 October 2026: how to restrict who can sign up as an admin, and how to export the whole database. The plan was then cancelled on 27 October 2026.

An AI agent replied at 19:45, about 1 minute later, and no person took part. On admin sign-up it said the sign-in supports roles but the documentation describes no setting for several admins or for stopping a privileged role at sign-up; admins are controlled by checking the role in the app's own code. On the export it said Export database in the database viewer emails a zip with development.sql and production.sql, with the structure and data of both. I did not run that export.

Cancelling is self-serve: Subscription & credits, Update plan, then the Stripe billing page. It then read Cancels Nov 26 and Your service will end on November 26, 2026, and the invoice history showed one paid invoice of $24.00, the amount I expected.

• I have not seen what happens to the live app after the plan ends on 26 November 2026.

The plan page, the credit meter and the pricing page (both views) were read on 26 October 2026. Auto Top-Up was off all the time and I never bought credits.

I paid $24.00 for one month of Pro, read from the card statement. The pricing page lists Pro 20k at $24 a month, or $19 a month billed yearly, so the $24.00 matches the monthly price. I did not open Anything's own receipt.

The meter started at 23K of 20K. The first build took about 5.9K, the phone field change about 4.6K, the role rename about 8.8K and the colour change the last 3.7K, after which the meter read 0 and the chat said I was out of credits. Nine of the twelve changes could not run. A top-up or a bigger plan would have been needed: Max is $239 a month.

• Yearly prices were not tested at the checkout.