All projects

Community and events app

Community-App

A privacy-first community and events app for iOS, Android and web from one codebase.

Pre-launch, built as a duo with Tim

Hallo Sam

Frankfurt 6

A recreation with made-up events. Change the trust level under Konto, Einstellungen.

Core skills

  • Security and privacy
  • Mobile and native
  • Backend and APIs
  • Infrastructure and ops
  • Testing and verification
  • AI-assisted engineering

Tech stack

  • Expo
  • React Native
  • Expo Router
  • NativeWind
  • TanStack Query
  • MapLibre GL
  • NestJS 11
  • Prisma 7
  • PostgreSQL 18
  • CASL 7
  • Passport
  • otplib
  • TypeScript 6
  • Zod 4
  • OpenAPI
  • pnpm
  • Turborepo
  • Coolify
  • Docker
  • Grafana
  • Loki
  • GitHub Actions

The hardest part

The meeting point the search has to know

Security rules belong in one place that can't be bypassed.

The whole story

  1. What it looked like

    “Events near me” needs the exact location. But someone with little trust may only see the rough area. And with about 137 routes, one forgotten spot is enough to reveal the meeting point.

  2. What was really going on

    Write the rule into every endpoint and the copies eventually drift apart. Store the location rounded and the radius search is no longer right.

  3. The fix

    A single mapper on the server decides who sees what. Internally the location stays exact, and it's only rounded as it leaves the server.

2,215
commits in 9 weeks, from both developers combined
~7,650
automated tests, about 1,600 of them against the real server
32
database models, about 137 HTTP routes
In plain words

People find events nearby, but not everyone sees everything. How exactly you see the meeting point depends on how much the community trusts you. The name stays private on purpose until launch.

In many communities, who knows where people meet and when is a real safety issue. That shouldn't depend on a setting. It should be built into the architecture.

How it works

Step 1 of 4

Request

The app asks for nearby events. Search uses a bounding box and Haversine, with a hard cap.

What was built
  • Events with series, capacity limits, attendee lists, comments and share links
  • Location search with a bounding box and Haversine, sorted by distance, plus an event map
  • Trust-based visibility, enforced in one place on the server
  • QR tickets that also open offline behind a biometric lock, plus a door scanner with single-use scans
  • Refresh token rotation with reuse detection, TOTP step-up, rate limiting that stores no addresses
  • A feed, push, moderation and an LLM moderation worker that runs with no tools
How those skills were used
Security and privacy
Token rotation with reuse detection, recovery, account deletion, data export and trust-based visibility
Mobile and native
iOS, Android and web from one Expo codebase, with offline persistence, MapLibre and biometrics
Backend and APIs
About 137 HTTP routes, 32 database models, Zod schemas and CASL rules in one shared package
Infrastructure and ops
Coolify, Docker, nginx, systemd timers, GitHub Actions, Grafana, Loki and Alloy
Testing and verification
About 7,650 tests, end-to-end against a running API and a real Postgres
AI-assisted engineering
A claim system for two developers and their agents on one trunk, plus repo gates for raw SQL, API coverage and OpenAPI
My role

One of two developers, each with their own agents on one trunk. Using my multi-dev agent workflow, based on Context Observer.

See the Context Observer project
Next projectAhoyMusic