Following up on my directory project — genuinely asking devs to poke holes in it
Posted a couple times before about Groupverse, the WhatsApp/Telegram group directory I've been building solo. Not linking it again here since link-heavy posts tend to get pulled it's on my profile if you want to find the earlier posts.
Since then I stopped adding features and actually did a real audit instead. Found a legit RLS hole in Supabase where anyone could insert directly into my live groups table and skip review entirely. A couple of admin functions were also callable from the public API with zero auth check. Fixed all of it, added rate limiting with lockouts on the admin login too. Slightly embarrassing it sat like that for as long as it did, but better to catch it than assume everything's fine just because nothing had obviously broken yet.
Also rebuilt the content side. The site was effectively one page as far as Google was concerned, since everything rendered client-side. Broke it out into 45 real static pages with actual content instead.
Still not getting much organic traffic though. Might just be normal for a new domain, might be something I'm missing — hard to tell at this point since I've been staring at it too long.
If any devs have a few minutes, I'd genuinely rather have someone competent point out what's actually wrong than keep guessing on my own. Not fishing for "nice job" — looking for what's broken or dumb that I can't see anymore.