Six months of evenings. 247 commits and one 2am deploy I'll never forget. I kept a log of everything — the dead ends, the rewrites, the moments I almost quit. Most of it stayed private. This part felt worth sharing.
The RLS bug I almost missed
Three days before launch I discovered my row-level security was wrong. Any authenticated user could read any other user's data. I'd been demoing this for weeks.
-- the policy that was silently wrong
CREATE POLICY "users_own_data" ON time_entries
FOR ALL USING (auth.uid() = user_id);
-- ↑ I had forgotten this entire line
Fixed it in an afternoon. But it was a good reminder: security isn't something you bolt on at the end.
The first paying user
They found it through a comment I left on Hacker News. $12/month. I've made $147 total. That number means more to me than any salary number I've seen — ship the thing.