# Project rules: feedback board

## What we are building
A public feedback board: people sign in, post ideas, upvote (once each) and comment. The admin sets a status
(Under review, Planned, In progress, Done) and the public roadmap shows ideas grouped by status.

## Stack
- Next.js (App Router) + TypeScript + Tailwind + shadcn/ui
- Supabase: Postgres, Auth (magic link), Row Level Security

## Rules
- Security lives in the database: RLS on every table. The UI hiding a button is not security.
- One vote per user per idea, enforced by a unique constraint, not by the UI.
- Vote counts come from the database (a view or count query), never from a number the client sends.
- Only admins (profiles.is_admin) can change status or delete.
- Server Actions for writes. Never expose the service role key to the browser.