TideFit

Credit

The app is Utkarsh Mittal's (UtkarshMitta on GitHub). The audit, the upgrade, the tests, the CI and the launch are mine.

What it does

TideFit is a trip planner for athletes. It fetches sport-specific forecasts (sea state for swimmers, air quality for runners, wind and heat for cyclists and hikers), grades each trip day safe, caution or unsafe against tunable thresholds, and writes a day-by-day plan.

What I did

• Audited all 45 source files and confirmed 15 security and correctness findings against the running app: the Strava and Google OAuth callbacks accepted any authorization code, a Supabase policy let anyone holding the public anon key read every user's trips, a visitor's Strava app secret sat in a plaintext browser cookie, and the endpoints that spend money had no rate limit. 13 are fixed and verified; 2 low-severity ones are documented in docs/AUDIT.md.
• Upgraded Next 14 to 16 and React 18 to 19 by hand (async cookies(), middleware to proxy, ESLint 9 flat config), across 16 merged pull requests. npm audit went from 6 vulnerabilities (1 critical, 5 high) to 0, and tests from 0 to 45.
• CI runs typecheck, lint, tests and a zero-key build, then deploys main to Vercel.
• Launched it at tide-fit.vercel.app, with private Blob storage so shared links survive redeploys, an edge rate limit verified at 20 requests then 429, and Strava and Google Calendar sign-in verified end to end on the live site.

Built With

• github-actions
• next.js
• node.js
• react
• supabase
• typescript
• vercel