Case study / Verified candidate / Firebase security hold / unreleased

Parking Alert

A safe local parking-alert lifecycle candidate held behind explicit Firebase ownership and security gates.

Repository ↗

Problem

Parking and vehicle-contact situations need a clear alert workflow without exposing vehicle owners or allowing unsafe direct cloud writes.

Target user

Reviewers evaluating a privacy-conscious mobile parking-alert simulation.

Solution

A Flutter candidate that generates synthetic QR data, previews an alert locally, simulates receipt, and resolves the lifecycle without sending notifications or mutating production Firebase data.

Personal contribution

Completed the deterministic local lifecycle, disabled unsafe direct client writes, added deny-by-default reference rules, tests, CI, documentation, and a narrated candidate walkthrough.

Architecture

Boundaries before buzzwords.

Flutter mobile client with deterministic local demo state
Trusted-backend boundary for any future cross-user write
Deny-by-default reference Firestore rules

Main workflow

State moves with a reason.

01
Generate a synthetic vehicle QR
02
Prepare an explicitly unsent alert preview
03
Simulate delivery in the local inbox
04
Resolve the alert and inspect local activity/settings

Technical decisions

The trade-offs that define the system.

Direct client writes to other-owner alerts and scan logs are disabled
Repository rules are reference policy until console deployment is verified
Release remains held until ownership, rules, restrictions, App Check, and billing are reviewed

Difficult engineering challenge

The product needed to demonstrate a complete alert lifecycle while preventing the simulation from implying that SMS, push delivery, rate limiting, or production Firebase authorization was operational.

Verification

Evidence and boundaries.

Testing

5 Flutter tests
Flutter analyze and web production build
ParkAlert Verify CI
Current tracked-tree Gitleaks scan clean
3:08 narrated candidate walkthrough

Security and privacy

No direct other-user mutation or external message occurs in the verified workflow
Firebase console state and historical credential response remain owner checkpoints

Known limitations

Deployed rules, App Check, authorized domains, key restrictions, billing, and provider ownership are unverified
No SMS, push notification, rate-limit, pilot, or production-user claim
Candidate PR is intentionally unmerged and unreleased