Full Stack / Security · Archived engineering retrospective
Line Skip
Device-bound mobile access and real-time pass platform
Built a mobile pass platform with a Cloudflare Worker backend. Users could request access, create and redeem passes, while admins could approve accounts, refresh live pass data, and review activity. Running it with real users exposed security, third-party data, and mobile UX problems beyond the original interface.
Built the full pass flow from creation and venue selection through redemption and expiration.
Bound approved accounts to devices so a password alone could not recreate an authorized session elsewhere.
Built an admin feed showing users, venues, pass titles, redemption times, and access controls.
Handled stale or missing data from the upstream venue source instead of assuming every successful request returned complete data.
Used Cloudflare Workers for server-side authorization, pass state, and admin operations.
The upstream source sometimes returned HTTP 403 errors or incomplete inventory, so I had to detect bad data even when a request technically succeeded.
Real-world misuse showed that a convincing screen is not a security boundary. I shifted more trust to server state, device checks, redemption records, and admin revocation.
Mobile browsers exposed timing and layout bugs that did not appear during desktop testing.
Built and operated the full system, then retired it after real-world misuse exposed security and operational risks.
USER ↔ ADMIN
One access loop, two sides.
The walkthrough plays continuously from user onboarding to administrator approval, back to the authorized user, then into administrative operations.