I shipped the fix a real company asked for. Then almost shipped a way to bypass all of it.
Hey Indie Hackers 👋
Biggest technical stretch on RamenHire so far, and one moment that genuinely scared me. Sharing the honest version.
What shipped
Real company accounts — sign up, sign in, and the thing that actually mattered: a company can now create, edit, and remove their own job listing without emailing me. This came directly out of an earlier company asking me to take their listing down and having no way to do it themselves. That's fixed now.
Underneath it: real per-company data isolation at the database level (not just "the app checks this," the database itself rejects a company touching another company's data, tested by trying to forge it directly), and a security audit that re-tested the closure adversarially instead of trusting my own sprint checklist.
The part that actually scared me
A few days after I called the sprint done, someone posted about a pattern where a route checks you're logged in, then writes your request body straight into the database — letting a client sneak in a field like "is_admin" alongside a legitimate one. In my case that's worse than usual: my write routes use a service-role connection, which skips all the per-company protection I'd just built, for these specific routes. So all that isolation work would have meant nothing if any route forwarded the body instead of picking exact fields.
Went and tested it for real — crafted a request with a legitimate field sitting next to "is_admin: true" and someone else's company id, sent it against the real database, checked what actually landed. Every route held. But I don't think I'd have thought to check this on my own initiative — it took someone else's post to make me look.
The honest number
Real registered companies: still zero. This sprint didn't move that number — it built the floor a real company should expect to stand on before that number becomes real. Full technical write-up (the actual code, the actual test) is here: the technical write-up
Genuine question for this crowd: how many of you have shipped something you were sure was solid, only to have a stranger's unrelated post make you go back and re-test it? Did it ever turn up something real, or was it always fine?
