Identity & Auth
NextAuth v5 JWT with the security defaults that should be standard but usually aren't: lockout, breach-list password check, anti-enumeration, invite-only signup.
in production, no sandbox here
This one runs in Broomstick Hub and Beeline Medical. It has no sandbox on this site, because the pattern only means anything against a real database, real roles, and real money. Rebuilding that as a toy would demonstrate the toy.
The write-up covers how it works and where it is deployed.