[ID_01] Settled
⭘ LIVE · readout offline · anshdhariwal/settled
A shared-expense tracker that settles balances between people in a group.
Problem
Groups splitting rent and bills lose track of who owes whom. Spreadsheets drift out of date and nobody trusts the final number.
Decision
I built it on Supabase with Postgres and row level security so each group only reads its own ledger. Balances are computed server side, not in the client, so the settle-up total is authoritative.
! Finding
A row level security policy on the expenses table was too permissive. A member of one group could read expense rows from another group by guessing IDs. I found it, wrote a failing query to prove it, tightened the policy to scope every read by group membership, and reverified. It was a real gap, and it is fixed.
Tradeoff
Computing balances on the server costs a round trip on every settle-up. I accepted the latency because a wrong balance is worse than a slow one.