Rostra: staff rostering app
Built in Lovable. Four screens, two roles: manager and staff.
Findings
- CriticalDatabase service key in the browser bundle. Anyone can read every table.
- CriticalAny signed-in user can read every other staff member's shifts and pay rates.
- MediumDaily backups are on. None has ever been restored.
- MediumNo staging. Every change goes straight to live.
Verdict and price
The access rules are built into every screen, so fixing them in place costs more than starting again. Screens and workflow are kept.
Fictional app and findings, to show what you get. Not a client result.