The page used to refuse to load inside any frame. It now allows
thebarbellengineer.com to show it, so the portfolio can run it live,
and still refuses every other site.
Share a tracker with a link and a password. Two people can edit it from
different devices, and each change reaches the other one over a
WebSocket in well under a second.
Every record is encrypted in the browser (AES-GCM) with a key wrapped by
your password (PBKDF2-SHA256, 600,000 iterations). The server stores
only ciphertext and can't read a thing.
Changes sync one record at a time, so two people editing different
expenses never overwrite each other.
Shared trackers are capped at 2 MB, and making a new one needs an
invite code, so a stranger can't fill the server.
125 unit tests, a two-client protocol smoke test, and a UI check that
drives two headless Chrome profiles as two devices.