My app has free and paid plans with feature gates and usage limits. Audit every gate and make sure enforcement happens server-side. 1. Inventory: list every plan-gated feature and usage limit (max projects, max team members, API calls, exports, premium features). Note where each is currently enforced: hidden button in the UI, disabled form, client-side check, or actual server check. 2. Server enforcement: for every gated action, add an authoritative check in the server route/handler that runs before the action executes: does this account's plan include this feature, and is it under its usage limit? Return a clear 403 with an upgrade prompt code the frontend can use. 3. Usage counting: verify usage counters are maintained server-side and cannot be reset or skipped by the client. Check the race condition too: two concurrent requests both passing a limit check (use an atomic increment or database constraint where the limit is hard). 4. Downgrade behavior: define what happens when a paying user downgrades past their current usage (e.g., 10 projects on a 3-project plan). Pick a policy (read-only, grandfather, or forced cleanup), implement it, and tell me which you chose. 5. UI sync: keep the frontend gates as UX (hide what the plan does not include), but the UI must handle the server's 403 gracefully since client state can be stale. Do not rely on any client-side check as the only enforcement; treat hidden buttons as cosmetic. Do not delete user data on downgrade without an explicit policy choice. Give me: the full inventory with before/after enforcement per gate, the server checks added, and test cases showing a free user hitting a paid endpoint directly (curl, not the UI) and being rejected.