# SantaBox.org: I rebuilt a BestWNC copy-paste into a Christmas charity lootbox platform

Source: https://www.michaelchurley.com/blog/santabox-charity-lootbox-rebuild  
Published: 2026-08-08  
Author: Michael C. Hurley  
Tags: santabox, charity, christmas, nonprofit, lootbox, donations, nextjs, convex, clerk, stripe, resend, vercel

![SantaBox home. Christmas 2026 campaign](/blog/santabox-charity-lootbox-rebuild/screenshots/home.png)

## Who

I got tired of charity landers that look like Christmas and behave like a brochure.

Toy drives need funding progress. Parents need a tax receipt path. Partners need an inquiry form that emails a human. Operators who inherit a wrong-vertical Next scaffold need an autopsy that says the quiet part: this README used to be BestWNC.

SantaBox is for people funding age-tagged gift boxes before December 15 delivery cutoffs, and for builders who will delete fake partner names when legal risk shows up in a commit message.

## What

I built **SantaBox.org**. Package `santabox.org`, version **0.1.0**, private under **HurleyUS/santabox.org**. Metadata line: *Christmas Gift Boxes for Children in Need.* Campaign badge on the live hero: **Christmas 2026 Campaign Now Open.**

Stack facts from the lockfile and tree: **Next.js 16.1.6**, **React 19.2.4**, **Tailwind 4.1**, Bun, **Convex** schema for gift boxes / donations / donors / subscribers / nonprofits / partner inquiries / impact stories, **Clerk** (optional when keys missing), **Stripe** checkout + subscribe APIs, Resend, Sentry, PostHog. Forty-two commits. HEAD `67712cb`.

Donate presets: $25 stocking · $50 half box · $75 small · $100 full (default) · $150 premium · $250 two boxes. Cover processing fees (`2.9% + $0.30`) so the gift side can stay whole. Subscribe UI/schema: **$10/mo** or **$100/yr**.

![Donate presets](/blog/santabox-charity-lootbox-rebuild/screenshots/donate.png)

## Where

Code stays private on GitHub. Product answers at **https://www.santabox.org** (apex 307 to www) and the GitHub homepage URL **https://web-iota-topaz-45.vercel.app**. Both returned marketing **HTTP 200** with `X-Robots-Tag: index, follow` on pack day.

Routes that still 500 without service env: `/impact`, `/subscribe`, `/create-wishlist`. May 20 commits explicitly keep the public site up when service env is missing. The 500s are the other side of that bargain.

No `public/` directory in the tree. Layout still points at `/og-image.png` and favicons that are not on disk. Partners page now sells “Team Up with SantaBox” plus a grid of real team projects instead of invented orgs.

![Partners. inquiry + project grid](/blog/santabox-charity-lootbox-rebuild/screenshots/partners.png)

## When

**January 8, 2026:** `eebf7a1`. Next.js, Convex, Tailwind scaffold. GitHub `created_at` is later (Feb 6). The clock and the hosting console do not owe each other an apology; the commit log does.

**February 6:** Next 16 / React 19 / Tailwind v4 import fix.

**February 9:** Docs stop lying about BestWNC. Major rebuild commit lands the charity storytelling surface. Clerk becomes optional so builds survive missing keys. AUTOPSY.md records the crime scene: wrong layout title, empty Convex, dead buttons, wrong year, subscription-box confusion vs donation README.

**February 13:** `10377d8`. remove fabricated nonprofit/sponsor data. Commit body names the liability. Replacement: partner inquiry form + Resend `/api/partner-inquiry` + project grid of confirmed live sites.

**February 15:** Stripe webhook + signature verification + donate button actually calls checkout.

**Late February:** force-dynamic for Clerk/Convex pages, `proxy.ts` protection, error boundaries, sitemap/robots, security headers, auth on user mutations, `.take(100)` on collects.

**March:** Sentry instead of console.error spam; Vitest; then drop GitHub Actions because Vercel is CI.

**May:** Blacksmith ship gates, Santabox typecheck fixes, deploy URL verification, public-site-without-service-env.

**August 8, 2026 6:50 AM ET:** `67712cb`. X-Robots-Tag index, follow. HEAD. Forty-two commits.

![Boxes browse](/blog/santabox-charity-lootbox-rebuild/screenshots/boxes.png)

## Why

A Christmas charity site that still wears another product's metadata is worse than an unfinished one.

Fabricated partner logos are not placeholder content. They are a lawsuit with good lighting.

Dual honesty shows up here too: PLAN.md still lists Convex schema and Stripe as not started while `convex/schema.ts` and `/api/checkout` exist; AUTOPSY celebrates “production ready” with unchecked env boxes; homepage hardcodes `statesReached: 42` even on the live Convex path; marketing claims 501(c)(3) without an EIN file in-repo. Say the drift out loud.

The money path is real enough to document: fee cover math, taxReceiptSent boolean, subscriber Stripe IDs, wishlist create client, box status enum `pending` to `open` to `funded` to `shipped` to `delivered`.

![Stories. Maya narrative](/blog/santabox-charity-lootbox-rebuild/screenshots/stories.png)

![About](/blog/santabox-charity-lootbox-rebuild/screenshots/about.png)

What would you delete first if you found another vertical's partner logos still living in your charity repo: the logos, or the launch date?