SIS Time Tracker — Hardening a Real App as if It Were Public
The time-tracking and invoicing app I built for my own business, reviewed and hardened against the OWASP Top 10:2025 and WCAG 2.2 AA — Row Level Security as the real boundary, invariants enforced in PostgreSQL, and every claim backed by tests that run on each push.