LiveClinical reference · built with a pediatricianCase study

PediaQuick

A pediatric and neonatal clinical reference in Arabic and English, built with the practising pediatrician who owns it, whose approval alone gives a tool its “Reviewed by” badge.

143clinical tools: calculators, scores, scales and growth charts
1,700+automated tests on the clinical core
137/137row-level security tests; 30 of 30 planted faults caught

Why

A clinical reference is only as safe as its numbers. Every dose, range and threshold in PediaQuick is traced to its primary source and checked by an automated test.

What it covers

Emergency care (PALS, resuscitation and critical care), on-call work (complaints, procedural sedation, assessments and an endorsement list), 143 tools — calculators, scores, clinical scales and the Saudi growth charts — drug doses from the Harriet Lane Handbook, age-based lab reference ranges and a pediatric ECG reading guide, in Arabic and English.

1The About page: fast clinical tools with their sources and review, Arabic-first — 143 calculators and scores, 14 guides, 450 drugs and 94 lab tests.4A drug page: amoxicillin with its label sections, and dosing by indication from the Harriet Lane Handbook, opened by age group, route or indication.View all screens →

Safety gates

Every tool and guide shows its review state. A page carries a “Reviewed by” badge only after the pediatrician approves that exact version from the dashboard, and each approval is stored with the content’s fingerprint and text in a log that cannot be edited or deleted. If the content changes afterwards, the badge reverts on its own to “Awaiting clinical review”, and the build fails until the fingerprints are regenerated. Until a page is approved, the site says plainly that it is not yet clinically approved. Drug doses are quoted verbatim from the Harriet Lane Handbook — never rephrased.

2Why PediaQuick: a declared clinical review — who reviewed each tool and when, or “Awaiting review” — the source under every number, Saudi context, no patient data, offline.3Maintenance fluids by Holliday–Segar, adding the dehydration deficit minus any bolus already given — and still marked “Awaiting clinical review”.View all screens →

Numbers checked against their sources

The jaundice tool draws the NICE treatment-threshold graphs the pediatrician asked for: at 38 weeks and over it reproduces the NICE threshold table at every 6-hour point, checked against nice.org.uk, and below 38 weeks it follows the lines of the hospital guideline he chose, measured on its own pages. The AAP 2017 blood-pressure tables were transferred automatically from the publisher’s own tables rather than retyped, and the Saudi growth references come from their peer-reviewed source (Annals of Saudi Medicine, 2016).

Access and privacy

Accounts and roles live in Supabase with row-level security, proven by 137 tests and 30 deliberate policy faults, all caught. Since 14 October the site asks for sign-in, at the pediatrician’s request. On-call endorsement notes are readable only by the doctor who wrote them — not by the owner, not by editors — and capped at 80 patients.

How it is built

A static Next.js site that installs and works as an app, with the clinical core in plain TypeScript, separate from the interface.

7PediaQuick on every Apple device: the same tools for iPhone, iPad, Mac and Apple Watch — “coming soon to the App Store”, usable in the browser now.View all screens →

What was not tested

No test accounts are created on production, so the endorsement list has not been exercised there with a real account: its first real round trip is the doctor’s own first save. What was measured on production, inside a transaction that was then rolled back, is the isolation: the owner could read, change or delete none of another doctor’s rows.

Screens7

Public pages captured on the live pediaquick.app on 30 October 2026, with no account. Clinical pages need sign-in and no test account is made on production, so the three app screens are PediaQuick’s own published screenshots, shown on its About page.

What you can check yourself

Each row is a source you can open or a method you can repeat.

  • Livepediaquick.app
  • Measured30/30 planted policy faults caughtEach of 30 deliberate faults was planted in the row-level security policies on a temporary database, and the permission tests had to fail on every one; on the real policies all 137 pass.
  • Screens7 screensPublic pages captured on the live pediaquick.app on 30 October 2026, with no account. Clinical pages need sign-in and no test account is made on production, so the three app screens are PediaQuick’s own published screenshots, shown on its About page.

Talk about this project

For judges, mentors and security teams — WhatsApp and email reach me directly, and I reply myself. Open to mentorship and cybersecurity programmes.

WhatsApp +966 50 759 6095EmailDownload CV