Strahd Hub
Full-stack D&D campaign management app
A campaign app used by 2 D&D groups (~15 players) for shared inventory, spellbooks, maps, and NPC records, where the DM controls what each player can see. Authorization lives in Postgres: 23 row-level security policies mean hidden content is never sent to a player's browser, not just hidden in the UI. I also closed a privilege-escalation hole by removing direct UPDATE access on profiles and routing every change through security-definer functions that limit which columns can change.
My role: Solo developer: schema, RLS policies, frontend, and deployment