SecureScan

Lavjeet Rai — Sat, 23 May 2026 17:19:44 +0000

This is a submission for the GitHub Finish-Up-A-Thon Challenge

What I Built

SecureScan is a privacy-first web utility that bridges the gap between physical sharing and ephemeral digital storage.

At its core, the application converts standard text into secure QR codes. The latest major feature addition is the Ephemeral Image Vault. Instead of relying on permanent cloud hosting for sensitive images, SecureScan allows users to upload an image and generates a QR code linked to that specific file with a strict, mathematically enforced 120-second lifespan.

The Architecture:

Frontend: Next.js / React (update this to your actual frontend)
Backend & Database: Node.js paired with MongoDB.
Storage & Access Control: Supabase Storage.
The Logic: When an image is uploaded, it is routed to a private Supabase bucket. The backend instantly generates a Pre-Signed URL with expiresIn: 120. This URL is encoded into the generated QR code. Once 120 seconds pass, cloud-provider authentication mathematically invalidates the link—blocking access completely. To prevent storage bloat, a Node.js cron job runs every 5 minutes in the background, querying MongoDB for expired timestamps and batch-deleting the dead files from the Supabase bucket.

Demo

Live Application: Insert Live URL here
GitHub Repository: Insert Repo URL here

(Note: Consider adding a GIF or video walkthrough of the 120-second expiration in action right here!)

The Comeback Story

SecureScan initially started as a straightforward client-side utility: converting simple text strings into QR codes. It functioned well, but it was static and lacked a complex backend challenge.

The turning point was tackling the problem of secure, temporary file sharing. I wanted to allow image uploads, but I refused to build a system where user images sit on a server forever, consuming storage and posing a privacy risk. The technical hurdle was enforcing a strict expiration. My initial thought was to use a basic setTimeout deletion script, but analyzing that logically revealed it was prone to server lag and race conditions.

The "comeback" was entirely re-architecting the feature into a two-layer system: relying on Supabase's cryptographic Pre-Signed URLs for exact, to-the-second access control, while offloading the actual file deletion to an asynchronous MongoDB/Node-cron garbage collection cycle. It transformed a basic QR generator into a highly efficient, self-cleaning ephemeral storage engine.

My Experience with GitHub Copilot

GitHub Copilot was a massive accelerant during the backend re-architecture, specifically when bridging the different APIs.

Instead of constantly context-switching to read the Supabase Storage SDK documentation, Copilot accurately generated the boilerplate for uploading the buffer and creating the Pre-Signed URL with the exact expiration parameters. It also handled the tedious syntax of setting up the node-cron scheduling syntax and scaffolding the Mongoose schema for the EphemeralImage database models. This allowed me to focus strictly on the system design and the logic of the two-layer access control, rather than hunting down typos in the database queries.

DEV Community: Lavjeet Rai

SecureScan

What I Built

Demo

The Comeback Story

My Experience with GitHub Copilot