Toli
An Android app for making real-life plans in Pakistan, with nearby discovery, group chat, and a NestJS/PostGIS backend.
- API security flaws closed
- 8
- Queries no longer leaking personal data
- 17
Toli helps people turn shared interests into real plans. Starting in Karachi, people can browse nearby activities, post a plan, join instantly or request a host's approval, and keep the conversation going in a plan's group chat. The Android app is live on Google Play.
I built across the Expo mobile app, NestJS API, and React moderation dashboard. PostgreSQL and PostGIS power location-based discovery; Prisma manages the data model; JWT-authenticated WebSockets deliver plan chats and direct messages. Seat claims are atomic, and full plans offer waitlisted people a place one at a time.
I hardened the API before launch: closed 8 security flaws, including a mass-assignment bug that let users change their own reputation scores; stopped personal data leaking across 17 queries; and enforced rate limits. The product also includes show-up karma, reminders, reporting, and blocking to support plans that happen offline.