Famous.ai test data

The Fitting Room brief was pasted word for word (1,689 characters) and submitted at 00:12:53 UTC on 26 October 2026 with the Private switch set. The clock stops when the app is live and the checks pass: 25 of 30 on the full scale, applied here as the 24 checks that need no keys of mine.

Famous.ai asked no question. The progress bar read 95% with 0:01 remaining for several minutes, and the build checkpoint was saved at about 00:28 UTC, 16 minutes after the submit. The builder reported 1 minute 19 seconds of work for 54 actions. The app published itself at https://pilates-booking-studio-1.deploypad.app with a "Built on Famous.ai" badge.

Its closing message said: "Not done: Stripe and email keys aren't set yet, nothing was tested end to end with real accounts".

Two more prompts followed: F1 (a test-only Member credits tab, finished about 00:37 UTC) and F2 (three bug fixes, finished about 01:02 UTC). After F2 all 24 checks passed, about 50 minutes and three prompts after the submit.

• The 25-of-30 mark is applied as the 24 checks that need no keys of mine.

The checks were run against the live app, by hand and by script, with a note per check. The six checks that need your own Stripe and Resend keys (C24 to C29) are left out, so the thresholds are applied to the 24 that remain: 5 needs 93% or more, which is 23 or 24 of 24.

All 24 of 24 checks passed after fix F2. Nothing was invented: the ten seed facts (classes, prices, coaches) were all found and no extra classes, prices, coaches or reviews appeared (C30).

The first version had three bugs, fixed by one prompt (F2): the text "Invalid Date" on My bookings and in the admin's All bookings, member timetable places left that did not drop after a booking ("1 of 1 spots left" with a member booked), and an instructor roster saying "No members booked yet" with a member booked.

Passing: sign-up, log-out, log-in and password reset (C01 to C03), sign-in screens by role (C04), the timetable for 14 days with the right days, times and lengths (C05, C06), booking, My bookings, cancelling and the credit back (C07 to C09), the capacity rule (C10), a new member with 0 credits seeing Buy credits in place of Book (C11), privacy between members (C12), instructor view and attendance (C13 to C15), the admin adding, editing and deleting a class (C16 to C18), All bookings, CSV export and bookings per class (C19 to C21), the Ask the studio form and the admin list (C22, C23).

• Payments and emails (C24 to C29) were not run: they need your own keys.

Sign-up for a member, a second member, the admin, the instructor and a stranger through each role's own sign-in, then log-out, log-in and a password reset for a member. Then two attacks on the live app with the wrong session: member A reading other members' data, and a member calling admin-only actions. Requests and responses are saved as transcripts (probe-transcripts.json).

Sign-up worked for every role. The first account registered on /login/admin became admin; the stranger who registered on the same admin form afterwards landed as a member. The instructor sign-up landed as a member until the admin saved that email against the instructor in Staff & accounts (00:50 UTC).

Log-out and log-in worked. The password reset email arrived within seconds, sent by Famous's database service, and its link opened the app's own reset page. A new password was set and the member logged in with it.

Attack 1 was blocked. A read of the bookings table returned only member A's own rows; a filter for everyone else's bookings returned []; another member's profile by email returned []; orders and the email log returned [] for a member.

Attack 2 was blocked. As a member, PATCH on my own role to admin, PATCH of my credits to 999, PATCH of a class capacity and DELETE of a class all returned 200 with [] (no rows changed), and the role stayed member afterwards.

• Famous.ai's own security scan was not opened.

The six data checks: records are written, survive a reload, survive a republish, survive a design change, can be viewed, edited and deleted by the admin, and export as a file.

Verified (five): the Ask the studio form and bookings wrote records; they survived a reload and several republishes (the bookings made before the F2 fix were listed after it); the admin edited a class capacity (6 to 1), added a class and deleted it again, and the member timetable followed each change; All bookings exported as CSV with the columns booking_id, class, day, session_date, start_time, instructor, member_name, member_email, status, attended, booked_at, cancelled_at.

Not verified: that records survived the colour change (E03), because the checks were not re-run after it. Famous.ai's own CRM and Code data views were not opened.

• One check, records after a design change, was not run.

The build published itself. Three Lighthouse mobile runs (version 13.5.0, run locally) on the home page of https://pilates-booking-studio-1.deploypad.app/.

The app was live at its deploypad.app address without a publish step (the Publish button was pressed after each later change). The Private or Public switch on the prompt box defaults to Public and was set to Private; the app was still reachable by the monitors and Lighthouse. The "Built on Famous.ai" badge was shown although the Mini plan lists removal of it.

Lighthouse scores 64, 69, 69 (median 69). Largest contentful paint 12,156, 11,710 and 11,765 ms; layout shift 0.003; total blocking time 8 to 27 ms; about 3.1 MB in 25 requests.

A custom domain, a timetable with 100 seeded classes, layout faults at three widths and a real phone were not tested.

• Home page only; no domain; no layout fault count.

Code view, Download, then reading the zip. The plan was also to build it on a machine against a database of my own and re-run the checks.

The Code view's Download gave a zip of 97 files (520 KB): Vite, React, Tailwind and shadcn, with a plain package.json and a README.

The back end is not in it. The app talks to a Famous-hosted database (databasepad.com, a Supabase-compatible host) through supabase-js, with the project URL and the public key written into src/lib/supabase.ts. The zip holds no database schema, no migrations and no server functions. The data, the sign-in accounts and the access rules stay on Famous's host.

I read the zip and did not build it: installing an untrusted download was blocked on my machine. The terms of service were not read.

• Read, not built.

The billing page was read at the end of the run (screenshot 10-cost/01-billing.png). Famous.ai shows one total for the project, not a price per prompt.

Plan Mini, $7 a month, "$7 of included monthly build credit", "Pay-as-you-go build credit". The page read "$96.72 of $7 build credit used" and "Additional Build Credit $89.72". Hosting Hours 0.542 hours, $0.00, so hosting was free.

That covered one build, two fix prompts (one of them test-only) and four of the twelve changes. The twelve-change script kept sending changes while Famous.ai kept billing; the balance was read only after $96 had passed.

Running cost at 1,000 bookings a month was not tested.

• The overspend was partly caused by my own test script, which had no spend stop.