Solo ground-up rebuild of a team-of-four course project — shares the idea, none of the code. Instructor course builder with draft/publish workflow, lesson CRUD with validated reordering, and per-resource ownership checks. Ran a security review of my own code and fixed four issues (ReDoS in search, enrolled-student ID leak, silently defaulting JWT secret, missing rate limiting) — each guarded by a regression test. 229 automated tests plus a separate typecheck gate. Stack: TypeScript, React, Express, MongoDB, JWT.