MindBridge

Inspiration

This July, a friend of mine attempted self-harm. They're okay now, but it stuck with me, and it made me want to build something that could reach someone like them earlier: not a clinical app, something that feels warm enough that a teenager would actually open it on a bad day.

What it does

MindBridge is a daily mood check-in for teens. You log a score, an emotion, what you were doing, and an optional journal entry, then a Supabase Edge Function calls Claude Haiku and returns a real CBT coping technique in about two seconds. Low scores or AI-flagged concern surface crisis resources (988, Crisis Text Line, the Trevor Project) directly in the app, one tap away on almost every screen.

How I built it

Flutter (mobile) and React (web) share one Supabase Postgres backend with Row Level Security on every table. The AI call lives entirely server-side, the Anthropic key never touches client code , nd the journal text is wrapped in explicit XML tags so the model treats it as data, never instructions. A deterministic, server-side heuristic can raise the crisis flag but never suppress it, even if the model's own output tried to say otherwise.

What we learned

The scariest bugs are the ones that don't error. An earlier migration silently revoked a database permission our feedback buttons needed,Postgres doesn't fail loudly on a blocked write, it just does nothing. Every 👍 and 🔖 had been quietly no-op-ing until we caught it. We fixed the grant and built defense-in-depth checks so a silent failure like that can't hide again. We also learned that building two platforms in lockstep, rather than one-then-port, is slower up front but forces cleaner shared types and catches design inconsistencies immediately.

Challenges we ran into

Keeping the app feeling non-punitive while still motivating daily use, no red colors, no streaks that reset to zero and shame you for missing a day. Getting the crisis-detection logic to be provably tamper-resistant against prompt injection. And doing real security hardening (RLS audits, rate limiting, CORS scoping) on a hackathon timeline without cutting corners on the parts that actually protect a vulnerable user.

We've had three people testing it so far, and the feedback's been genuinely positive, very few critiques. But this was never really about polish. It's about making sure the next person in that moment has something that reaches them.

Built With

• ai/ml
• anthropic
• claude
• dart
• flutter
• react
• typescript