Building a transit booking app is more complex than it sounds. Here's what I learned this week about mobile security, database permissions, and how AI made it faster to figure out.

I'm developing a real-time passenger ferry app for the Portland metro area using React Native, Expo and Supabase. Like any modern app handling payments and user accounts, security isn't optional. One of our first challenges: where do you store authentication tokens on a mobile device?

The answer matters. By default, many apps store session data in a plain text database sitting on the device. If someone gets access to your phone's file system, they can read it. So I split the tokens: the sensitive access and refresh tokens use iOS and Android hardware encryption, while non-sensitive session metadata stays in plain text. Better security, same performance.

Then we needed user roles (passenger, operator, admin) baked into every login session so our database security policies could enforce them automatically. The approach: inject group memberships directly into the authentication token the moment someone logs in, using a Supabase database hook for secure, server-side management.

Simple in theory. Surprisingly tricky in practice.

The hook kept returning empty results even though the data clearly existed. This is where having an AI development partner proved invaluable. Rather than spending hours reading documentation or posting on forums, Claude and I systematically worked through the problem in real time: checking grants, verifying search paths, testing the query in isolation, reading raw logs. Each step narrowed it down.

The culprit? Supabase's built-in data protection layer was silently blocking the hook from reading the very tables it needed. The SQL editor masked it (it runs with admin privileges), which is exactly why it was so hard to spot.

What would have taken a solo developer a day or more of frustrated searching took a fraction of the time with AI assistance. Not because the AI magically knew the answer, but because it helped structure the debugging process, suggested the right questions to ask, and knew where to look at each dead end.

AI-augmented development isn't about replacing engineers. It's about making good engineers faster, and helping smaller teams build things that used to require much larger ones. For a project like a non-profit ferry service, that's a genuine advantage.

If your team is evaluating mobile strategy or looking to accelerate delivery without sacrificing quality or security, I'd welcome the conversation. After 15+ years leading distributed engineering teams and optimizing for both speed and reliability, I've seen what works at scale.

#TechLeadership #MobileDevelopment #ProductStrategy #EngineeringLeadership #MobileAppDevelopment #AppSecurity #AITools #StartupLife