Hardened

May 2026 (400 Words, 3 Minutes)

Short week. Trakt key was sitting in client-side JavaScript. Fixed that, added a graphing calculator. Tally got a full iOS overhaul over the last couple days.

tuesday

Tally iOS redesign day. Three commits. Started with the full UI overhaul – orange replaces system blue everywhere, solid cards replace the blur material, notification read-state now syncs from the server on mount. Landing page rebuilt as a hero splash. Then a simplification pass to clean up the review findings. Finished with the avatar – went from node-graph to pixel-art and back to node-graph before landing on the Anthropic dot-proximity style. iOS home now matches the web: payment progress bar, monthly/next-payment stats grid.

apps

Grapher landed – Desmos-style graphing calculator, no external dependencies. PIN auth moved per-user, stored in an encrypted Blob profile instead of shared state. Messages sync was out of step with report status and account info in the status tab – fixed all three together. School grades data had gone 562 hours stale, refreshed.

Tally iOS went through a proper redesign. Orange accent replaces system blue everywhere – TabView tint, payment cards, the paid toggle, calendar circles. Solid cards replace the blur material. Notifications now load read-state from the server on mount and sync on tap instead of being local-only. The landing page was rebuilt as a hero splash with an app preview card. iOS home now matches the web layout: payment progress bar and a stats grid showing monthly amount and next payment. Avatar went through two iterations and landed on an Anthropic-style node-graph (dots and proximity lines) on both platforms.

nulljosh.github.io

The Trakt API key was hardcoded in client JavaScript, visible in source. Pulled it out and wrote a serverless proxy at /api/trakt. Key stays server-side now. Roadmap doc added while I was in there.

friday

Heavier week than it looked. The Trakt fix was overdue. Tally took most of the last two days – the iOS side had been drifting from the web for a while and the orange branding cleanup was worth doing properly. Everything else was auth and sync work that had been queued up. The avatar thing is worth noting. Three passes in one session – node-graph to pixel-art to node-graph again. The final version is right. Getting there was not efficient. Sometimes that is how you find out what you actually wanted.