An authenticated user belonging to Group A could read expense records from Group B by supplying foreign record UUIDs directly to the query client.

The initial Supabase RLS SELECT policy only validated that the requesting user was authenticated (auth.role() = "authenticated"), neglecting to enforce group membership scoping on individual expense row reads.

Wrote a failing reproduction query, discarded the loose policy, and authored a scoped subquery constraint requiring auth.uid() IN (SELECT user_id FROM group_memberships WHERE group_id = expenses.group_id). Reverified with automated integration assertions.

Rapid double-taps on high-latency mobile networks could submit duplicate ballots before UI disabled states propagated.

The ballot submission handler checked voter status in React state rather than enforcing uniqueness at the database level.

Created a PostgreSQL composite unique constraint on (election_id, voter_id). Converted the ballot recording step into an atomic transaction that throws on constraint violation.

Evaluating "8 - 4 - 2" produced 6 instead of the mathematically correct result 2.

The recursive descent parser mistakenly applied right-associative recursion to binary subtraction, grouping the AST as 8 - (4 - 2).

Refactored the binary operator grammar parser into a left-associative loop, properly binding earlier operands before consuming subsequent tokens.