Blog
Real engineering notes from building this project — what got built, what broke, and how it got fixed.
Why Build a Fake Helicopter Operations Platform
Most portfolio projects are CRUD apps with a todo list wrapped around them. This one had to be different, on purpose.
The Permission Bug That Let Anyone Clear a Helicopter Back Into Service
Any authenticated staff account — including a field guide's — could call the resolve-squawk endpoint and clear an aircraft back into dispatchable status. Here's how it was found, fixed, and verified live.
Row-Level Security, and the Bug That Fails by Disappearing
A secure-by-default system can still fail in a way that's invisible — and “fails safe” and “fails invisible” can look identical from where you're standing.
The One Table I Took Out of Row-Level Security
Isolation everywhere else was enforced by the database. This table was exempted for a good reason — which quietly made a role check the only thing standing between two tenants. An internal verify pass caught it before it could matter.
The Reload Loop That Reproduced on Pages It Never Touched
The local preview reloaded itself every 150 milliseconds — on a page that never registered a service worker, and it survived every obvious fix. The symptom pointed nowhere near the cause.
The Search-and-Rescue Button That Freezes a Position It Can't Invent
When a group goes overdue, the instinct is to put a dot on the map. The honest version freezes the real last-known fix — and when there isn't one, says so.
The Waiver Signature You Can't Un-Sign
A signed waiver is only worth collecting if the app itself can't quietly edit or backdate it later. That guarantee has to live below the application, in the database.