--- title: Medium | daily.dev description: A solo developer built Felines, a platform for feral cat colony management, during the 14-day HackTheKitty 2026 hackathon. The post reflects on product... canonical: https://daily.dev/posts/medium-rw5pnp2ef twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Medium | daily.dev og:description: A solo developer built Felines, a platform for feral cat colony management, during the 14-day HackTheKitty 2026 hackathon. The post reflects on product... og:url: https://daily.dev/posts/medium-rw5pnp2ef og:image: https://api.daily.dev/og/posts/rW5pNP2Ef.png og:image:alt: Medium og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Medium **[Medium](https://daily.dev/sources/medium_js)** · 24 min read · 0 upvotes · 0 comments ## Summary A solo developer built Felines, a platform for feral cat colony management, during the 14-day HackTheKitty 2026 hackathon. The post reflects on product strategy (targeting unconvinced users rather than existing cat advocates), UX decisions around intentional friction, and security architecture including progressive location blur, Row Level Security in Supabase, and five vulnerabilities identified and fixed via Aikido Security. Built with Next.js 14, TypeScript, and Supabase, the project achieved 262 commits, 75 database migrations, and a perfect security score from judges. Key lessons include treating security as a product decision from day one, the limits of breadth over depth in solo development, and using Claude Code as an accelerator while keeping all product and ethical decisions human-driven. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Supabase Row Level Security combined with column-level grants protect sensitive location data from anonymous users? Column-level grants can restrict access so that a query from an anonymous or unauthorized role returns nothing for a specific column, such as exact latitude, rather than returning the row and relying on the frontend to filter it out. In the Felines project, exact and blurred coordinates were stored in separate database columns, with the exact coordinate reachable only through a server-side RPC that reconfirms the caretaker link on every call, avoiding any caching. _Developers hardening location or PII data models can find real-world RLS patterns like this shared on daily.dev._ ### What kinds of vulnerabilities does an Aikido Security audit typically catch in a Next.js and Supabase app? An Aikido Security audit on a Next.js/Supabase project identified five issues: a high-severity path traversal in photo uploads from an unsanitized filename prefix, a low-severity SSRF in geocoding calls from unvalidated coordinates interpolated into a URL, database RPC functions callable by the anonymous key by default, notification RPCs vulnerable to text injection for spam/phishing, and care streak data exposed to any authenticated user instead of just its owner. _Teams shipping Supabase-backed apps can track common RLS and RPC pitfalls like these through daily.dev._ ### How can AI coding tools like Claude Code be used effectively for building a full product solo within a short hackathon timeframe? Claude Code was used as an implementation accelerator to build in two weeks what would otherwise take months, executing code with precision based on human direction. It made no product, ethical, or design decisions on its own; every architecture choice, security fix, and feature call still required human judgment, meaning AI assistance changes what's possible to build quickly but not what decisions still need a human driver. _Solo builders relying on AI coding assistants to move fast can compare real workflow lessons like this on daily.dev._ ## Similar posts on daily.dev - [How I Built a KiloClaw Dashboard that Does Work for Me](https://daily.dev/posts/how-i-built-a-kiloclaw-dashboard-that-does-work-for-me-q6ltkomhz) · Kilo Blog · 62 upvotes · 2 comments - [Embracing agentic coding](https://daily.dev/posts/embracing-agentic-coding-6xevwobxo) · ElixirStatus · 0 upvotes · 0 comments - [I'm 12. This morning I fought two hosting providers. My app survived both.](https://daily.dev/posts/i-m-12-this-morning-i-fought-two-hosting-providers-my-app-survived-both--idkuxfs1o) · DEV · 2 upvotes · 0 comments - [A Trail of Code - Boomstash](https://daily.dev/posts/a-trail-of-code---boomstash-08rv7juw0) · Evil Tester · 8 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#ux](https://daily.dev/tags/ux), [#nextjs](https://daily.dev/tags/nextjs), [#supabase](https://daily.dev/tags/supabase) [View this post on daily.dev](https://daily.dev/posts/medium-rw5pnp2ef) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Medium","url":"https://daily.dev/posts/medium-rw5pnp2ef","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/medium-rw5pnp2ef"},"datePublished":"2026-07-22T21:11:59.944Z","dateModified":"2026-09-14T06:13:18.289Z","description":"A solo developer built Felines, a platform for feral cat colony management, during the 14-day HackTheKitty 2026 hackathon. The post reflects on product...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d884932e4f13bcbe3ec88cdff8804721?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d884932e4f13bcbe3ec88cdff8804721?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/medium-rw5pnp2ef","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ux,nextjs,supabase","timeRequired":"PT24M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Medium"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/medium-rw5pnp2ef#faq","mainEntity":[{"@type":"Question","name":"How does Supabase Row Level Security combined with column-level grants protect sensitive location data from anonymous users?","acceptedAnswer":{"@type":"Answer","text":"Column-level grants can restrict access so that a query from an anonymous or unauthorized role returns nothing for a specific column, such as exact latitude, rather than returning the row and relying on the frontend to filter it out. In the Felines project, exact and blurred coordinates were stored in separate database columns, with the exact coordinate reachable only through a server-side RPC that reconfirms the caretaker link on every call, avoiding any caching. Developers hardening location or PII data models can find real-world RLS patterns like this shared on daily.dev."}},{"@type":"Question","name":"What kinds of vulnerabilities does an Aikido Security audit typically catch in a Next.js and Supabase app?","acceptedAnswer":{"@type":"Answer","text":"An Aikido Security audit on a Next.js/Supabase project identified five issues: a high-severity path traversal in photo uploads from an unsanitized filename prefix, a low-severity SSRF in geocoding calls from unvalidated coordinates interpolated into a URL, database RPC functions callable by the anonymous key by default, notification RPCs vulnerable to text injection for spam/phishing, and care streak data exposed to any authenticated user instead of just its owner. Teams shipping Supabase-backed apps can track common RLS and RPC pitfalls like these through daily.dev."}},{"@type":"Question","name":"How can AI coding tools like Claude Code be used effectively for building a full product solo within a short hackathon timeframe?","acceptedAnswer":{"@type":"Answer","text":"Claude Code was used as an implementation accelerator to build in two weeks what would otherwise take months, executing code with precision based on human direction. It made no product, ethical, or design decisions on its own; every architecture choice, security fix, and feature call still required human judgment, meaning AI assistance changes what's possible to build quickly but not what decisions still need a human driver. Solo builders relying on AI coding assistants to move fast can compare real workflow lessons like this on daily.dev."}}]} ```