Project Story
Secure Notes: Auth, Ownership, and Clean Separation
This project focused on one key idea: every note belongs to one user and no request can bypass that ownership model. The backend enforces identity first, then data access.
Ownership Model
JWT identity is attached to each API request. Database queries are filtered by authenticated user id, not by client-provided values. This prevents cross-user data leaks by design.
API pattern
Auth middleware → User identity resolution → Ownership-constrained query → Response serialization
Deployment Split
Backend is deployed independently from the frontend. Render hosts the API and Vercel serves the React client. The split keeps frontend iteration fast while backend changes remain isolated.