Night Owl

Challenge

Friend groups own games across Steam, Xbox, and PlayStation; a session means finding the overlap, voting, scheduling, and launching. Night Owl is that coordination layer. It was also the portfolio’s first Neon-native project, a deliberate break from the standard EC2 and shared-database pattern that forced the question of where authorization lives.

Process

Neon’s Data API serves the browser directly over HTTP, so most tables have no server-side API tier. Postgres Row-Level Security is the whole authorization boundary, and I proved it. A two-phase adversarial suite tested the policies’ mechanics, then re-ran the model over the live Data API with genuine Clerk-signed JWTs: 11 of 11 assertions passed, deliberate forged-role-escalation attempts included. The API role has no grant at all on the OAuth-token table. Testing found and closed two authorization edge cases before launch.

The Discord bot splits trust: untrusted public interactions hit a stateless, Ed25519-verified Lambda, and the bot token lives only on a separate always-on daemon, limiting blast radius. Every auth, IAM, and RLS surface got dual adversarial review before merge; migrations were rehearsed on throwaway database branches.

Result

The web app is deployed at nightowl.gg; Steam import is proven on a real 182-game library. Session orchestration, voting, and the decision engine are built and code-reviewed but not deployed. Pre-launch, no customers. The cost model projects roughly 88 to 91 percent gross margin at target scale (modeled, not measured). RLS-as-authorization is now a workspace standard.