Web Applications · Security-minded design
Repair Ticket Tracking Portal
A public status page for repair customers that exposes one ticket at a time and nothing else.
- Status
- Prototype
- Year
- 2026
- Role
- Designer and developer
- Client
- Shared with permission
01
Overview
A separate public app, deployed on its own, that reads from the shop's Supabase project through one SECURITY DEFINER Postgres function. It needs an exact ticket number or phone match and returns only customer-safe fields.
- React
- TypeScript
- Vite
- Tailwind CSS
- Supabase
02
The challenge
Customers want to check their repair without calling, but opening the shop database to the public would expose every customer's data.
- Giving customers useful status without leaking anyone else's data
03
System requirements
- Look up a repair by ticket number or phone number
- Returns no internal notes, no other customers' details and no financial breakdown
- Separate repository and deployment from the staff app, so staff code never ships to public traffic
- Static build that can sit on any host or subdomain
04
Solution architecture
Responsibility
Public tracking page
A static Vite build where customers enter a ticket number or phone number.
05
Implementation

Public tracking page where a customer enters a ticket number and the phone number used at drop-off. No ticket data is shown.
06
Technical decisions
- Expose one database function instead of granting the public role SELECT on the table, because row-level security applies per role, not per query
- To add a field, extend the function rather than widening table access
- Keep the public app in its own repository and deployment
07
Results and validation
Content needed: measured results with period and method. Never estimated.
Evidence
- Design rationale and setup are documented in a private repository README
08
Lessons learned
Content needed: what you would do differently
Content checklist (remove once filled)
- Whether it is live, and its URL
- Permission to name the shop
- Any usage results, only with a period and method
09