The Secured Application

Finish it. Run the four threat modeling questions over your application and write the result down: the boundaries, what could go wrong at each, and the control you have. Then grep your own code for every place a protection was switched off and justify or remove each. Write tests for the permission rules, since those are the ones where a bug is not an inconvenience. Then attack it once more as a second account, and once as a signed-out stranger, and record what you found. One thing must be true before you call it done: every permission rule has a test, and you have watched each of those tests fail.