Project Overview

A progressive web app for a regional bank with 500K+ active users. Supports transfers, bill pay, check deposit via camera, spending analytics, and push notifications for fraud alerts."

Practice Name
PSLAB
Location
Beirut / Lebanon
Category
Photography
External Link
tanyatraboulsi.com/le-rocher
Security Architecture

Biometric authentication (TouchID/FaceID) via WebAuthn API as the primary auth method. All API requests are signed with HMAC using a per-session derived key. Session tokens are stored in an HTTP-only cookie with Strict SameSite.

The app uses a Content Security Policy that blocks all inline scripts except for the known Svelte bundle hash. This prevents XSS even if user-generated content gets rendered.

Offline Support

Service Worker with a Cache-First strategy for static assets and a Network-First strategy for API calls. Recent transaction history is stored in IndexedDB, allowing users to view their last 30 days of transactions even offline.

Failed transactions (e.g., while offline) queue locally and sync when connectivity returns. The UI shows a clear sync status indicator so users know the state of each pending transaction.