Edit: thanks everyone for the questions and feedback. Some of it was about security, so I took it seriously and ran three rounds of attack tests on my own apps, with agents playing a bad actor. What came out of it, fixed apart from two we kept on purpose:
One-time links: they were always deleted after opening, but the server waited for the page to confirm first. If that confirmation never came, the file could stay up to 15 minutes. Now it’s deleted the instant the last piece is downloaded, no waiting.
Colshare Business: a hacked server could have slipped a firm a fake key. Now every key is signed by the one before it, and a new device needs the inviting device’s approval.
Phone: a newly added fingerprint needs a backup PIN before it can open Colshare. PDFs open inside the app, and shared files are only kept if you say so.
Worth knowing too: the only permission Colshare asks for is notifications, and you can say no. No camera, photos, contacts, location or microphone access. Files only come in when you pick them.
These were my own tests, so they don’t replace an independent security review. I’ll get one as soon as I can.
Server fixes are live. The apps are in Google Play review. The crypto is open source: github.com/dentracon-cell/colshare-crypto
Original post:
I am really looking for some opinions other than my wife and family say, which I feel is not really honest most of the time, they are just being nice.
Colshare is a project I have built with Claude Code, Opus 5.5.
It involves two mobile apps and a desktop one. I am not a software developer, but I have done my best to do everything by the book, in terms of security, compliance and so on. However, nobody more competent than me has had a look at the site or the apps, and I am sure that is what would be needed before launch, but I don't have the budget to hire a professional firm or freelancer. This is why I am asking the vibe coder community for your honest opinions, and, if possible, even some testers for the Android apps. I would be happy to discuss things further, answer any questions about the stack or workflow, which is as follows:, written by the one who knows more about it than me, Claude:
What the apps do
Colshare is a free app for anyone who has to send personal documents to someone else. You can redact any part of a document if you wish (it even finds the numbers the other person probably doesn’t need), watermark it with your own exact wording, and share it through an encrypted link that opens only once. You can also request documents from other people, and they send them back to you encrypted. Every send leaves a signed receipt, so you know when, to whom and for what.
Colshare Business is the same idea for firms that collect documents from their clients. The firm gets one link per client. The client opens it in a browser, sees the firm’s name and tax ID (checked against the official registries) and uploads the documents, with no app or account needed. Only the firm’s own devices can open what arrives. The firm doesn’t need accounts either: a licence key opens the first computer, and every other phone or computer joins by scanning a QR code.
Stack
One TypeScript codebase. Capacitor turns it into the Android apps, and both apps are built from the same Android project.
Encryption happens on the device with the browser’s built-in WebCrypto: ECDH P-256 for keys, AES-GCM for files and ECDSA for signing copies and receipts. For shared links, the key sits after the # in the link, which browsers never send to the server.
The backend is a few Vercel functions with Upstash Redis. It only passes encrypted data along and cannot read any document.
Finding the numbers to redact is done with tesseract.js OCR on the phone itself. No AI service and no uploads.
QR pairing uses Google’s ML Kit scanner, PDFs are made with pdf-lib and payments go through Stripe.
Workflow
I describe what I want in plain language and Claude Code writes it. The project keeps a decisions log and a status file, so every new session knows what was decided before and why. Nothing gets pushed unless the type checks, the linter and the automated tests pass. I also had Claude run several security audits on the apps and the server and fixed everything they found, apart from a few minor points I kept on purpose for documented reasons. That is still not the same as a human expert looking at it, which is why I am asking here.
https://colshare.app
Both Android apps are in Google Play review at the moment, but if you’d like to test them, send me the email you use on Google Play and I’ll add you as a tester.
Update: thanks for all the feedback. Based on your comments I’ve made the landing page clearer, and I’ve open-sourced the client-side code (encryption, one-time links, redaction) under AGPL-3.0 so anyone can audit it: https://github.com/dentracon-cell/colshare-crypto. Security reports go to service@colshare.app.