Minaka

The problem

Minaka was vibe coded. It looked finished, but real venues ran into payments that never marked as paid, revenue and contracts filed under the wrong venue, and data that wasn’t locked down.

Key decisions

1. 01

   Found and closed a data exposure the database’s own advisor missed: one access rule let the public browser key read every venue’s proposals, events and contacts. The open rules are gone, and a check now fails the build if one ever returns.

2. 02

   Moved access control onto a single fail-closed permission check, and fixed six endpoints that worked without signing in, including a payment lookup and a self-invite-as-owner hole.

3. 03

   Money: Minaka’s own subscription billing now runs on a separate Stripe account from venue payments, ACH payments settle correctly without storing bank account numbers, and a daily balance audit flags money that was never collected.

Outcome

Working on my own, I took a vibe-coded app to one venues can trust with their bookings and money, and built the marketing site. In private beta at minaka.app.