DEV Community: baanbok

The night before launch, every door was wide open

baanbok — Tue, 14 Jul 2026 13:57:42 +0000

At the end of the last post I mentioned a bill. This post is that bill.

Let me start with three lines from the commit log.

06/28 13:18  feat: enforce auth (401) — no token, no entry
06/28 13:41  fix: resource ownership checks (IDOR) — check items, body metrics, templates
06/28 23:04  submitted to App Store review

I locked every door, and ten hours later I pressed the submit button. This post is about how those doors got left open in the first place — and who found them.

How the backdoor was born

Rewind to the first two days. There was no app yet, no login screen, and testing the server API meant dealing with tokens. Annoying. So I added a convenience: a fallback where ?userId=1 in the query string just... makes you that user. No token needed. For development, it's heaven. One curl line and everything works.

It's the textbook "runs right now" code. And as I said in the last post, the problem with this kind of code is that it never shows up in a demo. Every feature works. The house looks perfectly fine with the doors open.

Day-6 me was drunk on the feature list and had forgotten the door existed.

I asked the builder to inspect the building

The weekend before submission, I stopped adding features and gave my AI pair a different job:

"Real users are going to touch this now. Review the entire server from a security standpoint — auth, permissions, data exposure. Think like an attacker."

The same pair that had been laying bricks all week put on an inspector's hat and started tapping its own walls. A few turns later, the report came back.

The summary: without any token, just by changing ?userId=, anyone could read and modify any user's data. Meals, workouts, body weight — everything. The server didn't have authentication. It had authentication-shaped decoration.

Here's the part that actually chilled me, though — that door wasn't an AI mistake. I asked for it, I reviewed it, I merged it. If this were company code, nine years of habit would have flagged it in review instantly. But it was my project, so "I'll remove it later" felt fine. That's how the speed bill arrives: with interest, right before launch.

That night

I fixed it the same night, straight through.

The policy was deliberately blunt, because every exception is a future backdoor:

No token → 401. Everywhere. No fallbacks. The whitelist is login and signup, nothing else.
Ownership checks on every resource. "Does this check item actually belong to this token's owner?" — verified server-side, every time. That also kills IDOR probing with other people's IDs.
All authorization decisions live on the server. Blocking things only in the client is the same as not blocking them.

I tore it out through the early morning, the commits landed Sunday afternoon — 13:18 auth enforcement, 13:41 ownership checks — and at 23:04 that night, I submitted for review.

The one mercy: at that point, the app had exactly one user. Me. There was nobody to walk through the open door. So the damage was zero — but let's be honest, that's not skill. That's luck. If I had shipped without knowing, gotten real users, and then someone found it? This series wouldn't be a build log. It would be an apology letter.

The rule this left me with

Every vibe-coding conversation eventually hits the same worry: "how can you trust AI code?"

After this incident, my answer settled: I don't trust it. I verify it. And I make the AI do the verifying too.

Sounds contradictory, but the key is the role. The AI laying bricks and the AI doing inspection look at the same code with different eyes. If you only ever say "build this" and never say "now attack it," the second pair of eyes never opens. And knowing what to ask for — knowing that "security review" belongs on the pre-launch checklist at all — that doesn't come from the tool. That comes from nine years of watching other people's servers catch fire.

Speed from the AI, accountability on me. Three posts in, that line isn't a slogan anymore. It's what a man writes after a night without sleep.

Next post is a change of pace — dogfooding my own app through my own cut. Featuring: the mystery of the list that saved but showed up empty (culprit: a JPA trap that gets 9-year veterans too), and the day I learned a frozen number on screen is worse than no number at all.

Baanbok is free on the App Store — no sign-up required, guest mode gets you everything.

Zero React Native experience to a 6-day MVP — what "vibe coding" actually looked like

baanbok — Mon, 13 Jul 2026 02:30:25 +0000

In the prologue I said I ran git init on the night of June 24th. This post is about the six days that followed.

Fair warning: this is not an "AI made coding easy!" post. If anything, it's the opposite. Roughly half of what I did over those six days was distrusting what the AI produced.

The hand I was dealt

Backend dev, 9 years. Java, Kotlin, Spring, JPA — on this turf I do everything from design to deployment alone.
But: nine years of MySQL and MariaDB only. I picked PostgreSQL for this project for the deeply professional reason that I'd always wanted to try it. So even on my home turf, one thing was brand new.
React Native: zero lines written. Ever.
Expo? I genuinely thought it was a trade fair.
Time budget: weekday evenings after work and the gym — roughly 10pm to midnight — plus weekends.

The old me would have started with "step 1: complete a React Native course." And we all know how that goes. The side project dies quietly somewhere around week 3 of the course. My GitHub has three repos that died exactly that death.

This time I skipped the course and sat an AI down as my pair.

The division of labor — this is the whole trick

People hear "vibe coding" and picture typing "make me an app" and watching magic happen. Six days in, my conclusion is different: it only works when the division of labor is explicit.

What I kept:

The domain model. A three-layer structure — Template → Schedule → Daily Check. Checks are hierarchical with three states. Daily logs are snapshot copies of the template, so editing a template never rewrites your history. Decisions like these are human work. This is where nine years actually got spent.
API design and the entire server. Home turf.
And verification. Whether AI-written code gets merged is my call, every time.

What I delegated:

Every React Native screen. Components, navigation, state management — the conventions of an ecosystem I didn't know.
Hundreds of "how do I do X in Expo?" questions. Hours of doc-diving compressed into a few conversation turns.

So I drew the blueprints, the AI laid the bricks, and I walked around tapping the walls. It's a lot like the code review I do at my day job — except this reviewer never sleeps and never sulks.

The six days, replayed from the commit log

I dug up the actual commit log to write this post. It didn't match my memory. The log is scarier.

Day 0 — June 24 (Wed), night.
App repo at 21:54, server repo at 21:55. One minute apart. And the second commit of the night, in both repos, isn't code — it's docs: add CLAUDE.md, an architecture document written for my AI pair. I onboarded it the way you'd onboard a human teammate: design intent and next steps, written down before bed. Looking back, this was the move that bought the speed. In vibe coding, the first real commit is context, not code.

Day 1 — June 25 (Thu).
6:52am, before leaving for work: backend API complete. Migrations, service layer, REST endpoints — a full loop in under a day. Home turf is fast.

The real event was that night. 21:50 template screen → 21:56 schedule → 22:11 trends → 22:16 settings → 23:13 login. A screen landing every 6, 15, 5 minutes — from a guy who had never written a line of RN. Here's what it actually looked like: I define "this screen, this data, this structure," the AI builds it, I poke at it in the simulator, and if it holds, I commit. That loop ran all night. I felt like a magician. Completely lost track of time.

Day 2 — June 26 (Fri).
Free-tier gating, pick-one meal slots, a "+2.5kg?" double-progression hint. And then, at 17:58, this commit: fix: enforce JWT userId in all controllers — remove ?userId= param dependency. Early on, for convenience, I'd let a query parameter switch the user. That day I started tearing the backdoor out. What I didn't know yet was how uncomfortably close I'd cut it. Next post.

Day 3 — June 27 (Sat).
No daytime commits. Gym, and time with my wife. The deep-work session started at night and rolled into —

Day 4 — June 28 (Sun).
Five commits in the 2am range: account deletion, onboarding coach marks, a new app icon. One of them, at 2:28am: fix: JPQL path (userId → user.id). That one compiles clean and crashes on boot — a landmine specific to the JPA + PostgreSQL combo that nine years of MySQL had never shown me. It would bite me again later, more than once.

Daytime: i18n (Korean/English), notifications, kg/lb units. And at 23:04 — submitted to the App Store. Four days after git init.

Day 5 — June 29 (Mon).
Rejected. Two issues. Fixed after work, resubmitted as build 4 at 21:47.

Day 6 — June 30 (Tue).
Didn't sit still while waiting on review: completion feedback, a rest timer between sets, one-line daily notes.

So — I remembered it as "an MVP in 6 days." The log says the app had taken shape by night two, went to review on day four, and by day six had already eaten a rejection and been resubmitted. My memory was modest. The log was precise.

It wasn't free, though

If I stopped here, this would read like a vibe-coding hype post. That's not what this is.

AI code is optimized for runs right now. And nine years in backend teaches you exactly what "runs right now" leaves behind: temporary hacks, over-broad exception handling, convenience doors left unlocked. None of it shows up in a demo. It shows up in production, at the worst possible moment.

Day-6 me was drunk on having a working MVP and didn't notice the bill piling up. How much it came to — I'll write that next. Hint: I found it right before launch, and I did not sleep that night.

One rule survived all six days, and it's the one I'd give anyone trying this: speed from the AI, accountability on me. If something in this app breaks, it's not the AI's fault. It's mine, for skipping verification.

Baanbok is free on the App Store — no sign-up required, guest mode gets you everything.

Next: the night before launch, when I found the door wide open.

I deleted every fitness app I tried. So I built my own — in 17 days, after work.

baanbok — Sat, 11 Jul 2026 16:55:33 +0000

I'm a back-end developer in Korea.

Nine years of Java, Kotlin, and Spring — all of it building other people's servers. Until last month, there wasn't a single app with my name on it in any store.

That changed in 17 days: 172 commits, 30 database migrations, 5 languages. A fitness and diet app called Baanbok — it's Korean for repetition. It's live on the App Store now, and currently fighting its way through Google Play's closed-testing gauntlet (a mandatory 14-day gate — 5 days to go).

The numbers make it sound like a hackathon story. It wasn't. I have a full-time job. I just opened my laptop every evening after work and stacked a little more on top of yesterday's pile.

This series is the log of those 17 days. But honestly, the story starts three years earlier.

Why the app is called "Repetition"

In the spring of 2023, I was in a bad place. I'll keep the details to myself, but I'll tell you the part that matters for this story: the heaviest thing I carried wasn't sadness. It was guilt. The kind that renews itself every morning — you did nothing again today. I learned firsthand how deep that spiral goes.

That May, I signed up for a gym. First time in my life. 98 kg, zero muscle, no idea what I was doing.

There was no grand resolution. I just went. Then I went again the next day. The weights were embarrassing and my form was terrible, but on the walk home after each session, the guilt went quiet for a while.

That was three years ago. I'm still going.

What pulled me out wasn't willpower. It was repetition. So when I built an app three years later, there was only ever one name for it. Calling it anything else would have felt like skipping out on a debt.

(Fun fact: the romanization should technically be "Banbok," but I couldn't let an app built on never punishing you start with the word "ban." So it got an extra a. The only thing banned in this app is the word itself.)

Okay, but what does the app do?

This year I started a proper 16-week cut, and figured I'd finally track things seriously. I installed every fitness and diet app I could find. Then I deleted every single one.

They all demanded the same thing: daily input. Search the food, type the grams, save. Chicken breast, 200g. Same as yesterday. Same as tomorrow.

Here's the thing about being on a cut — your days are almost comically repetitive. The meal plan is fixed. The workout split is fixed. The information content of my day is basically zero. And these apps wanted me to re-enter that zero, by hand, every single day.

As a backend dev, this offended me on a professional level. It's recomputing an identical response on every request. These apps don't cache. And humans have far less patience than servers — we drop the connection after about three days, then leave a review blaming ourselves for it.

So the idea was one sentence: check, don't log.

Design your plan once, with as much care as you want. Then every day, the app lays out today's list and you just tap what you did. Macros and volume aggregate themselves from your checks. And one more rule, the one I refused to negotiate on: the app never, ever scolds you for a missed day. I know exactly what guilt does to a person. I wasn't going to ship a guilt machine.

On June 24th, at night, I ran

git init.

What's coming in this series

How a backend dev with zero React Native experience got to an MVP in 6 days by pairing with AI — and what "vibe coding" actually looks like in practice
The night before launch, when I discovered my server's auth had a door wide open (AI builds fast; locking up is still your job)
Dogfooding my own app through my own cut, and learning that a frozen number on screen is worse than no number
Why I killed the streak feature — the industry's default retention answer — and what I stole from an old racing game instead
The day I shipped 8 database migrations before midnight
And the thing I did more diligently than building features: deleting them

Fair warning: there's no "I grinded harder than everyone" arc here. The method for the body and the code was identical. Don't sprint. Show up daily.

One more thing: English isn't my first language, and I write these posts the same way I built the app — my story, my facts, an AI pair polishing the sentences. Speed from the AI, accountability on me.

See you in part 1.

Baanbok is free on the App Store — no sign-up required, guest mode gets you everything.

The Android build is in closed testing.

Thank You.