What building this taught me
A few real takeaways from shipping a full-stack household finance app solo.
RLS does more than app code ever could
Household isolation lives in Postgres policies, not if statements — a bug in a Server Action can't leak another household's data.
Hand-rolled validators, for now
Zod would be a natural upgrade, but installing a new dependency couldn't be verified in the environment this was built in — hand-rolled validators cover the same cases in the meantime.
Two flows RLS can't express
Accepting an invite before membership exists, and deleting a household as its last member, both go through SECURITY DEFINER functions instead.
A CI budget catches what code review misses
A bundle-size gate in CI has caught regressions that lint and type-checking never would have.