NutriLogix
Nutrition tracking without the busywork. Log what you eat, see what it adds up to, and stay on target.
Build it.Break it.Lock it down.
Rogue River Labs builds mobile apps and the APIs behind them, and finds where access checks break. We write the locks, so we know where teams forget to check them.
Two sides of the same door
We build
Production mobile apps in React Native, running on Supabase with Postgres, auth, and row level security. Every access rule is written by hand, not left to a default.
Shipped to real users on the App Store and Google Play, with analytics and AI features in production.
We break
Authorization testing on APIs. The bugs scanners miss because they need two real users to find: IDOR, broken function level authorization, and mass assignment.
Findings are reported responsibly through bug bounty programs on HackerOne, with clean reproduction steps and a suggested fix.
The whole test in one sentence: if I change the order number in the URL, do I see someone else's order?
The fix is testing as two users. Log in as A and B, replay A's requests with B's token, and flag anything that returns data it shouldn't.
Apps we've shipped
CastLog
Fishing session logging. Track catches, conditions, and spots, and see what actually works over time.
Astro AI
An AI powered mobile app built on the same stack, with every access rule written in house.
All three run on React Native and Supabase, with PostHog for analytics. Same builder, same access model, same attention to who can read what.
Founder
Anthony Smith is a full stack engineer in West Michigan who ships production apps on his own and spends his evenings breaking APIs.
Before Rogue River Labs, he spent three years on Department of Defense work at Intelligent Waves, building penetration testing software and working on GRAYPATH, a patented VPN that splits traffic across multiple encrypted paths at the same time.
Rogue River Labs is named for the river that runs through Rockford, Michigan, a few minutes from where the work gets done.
Get in touch
Building something with an API behind it? Want a second set of eyes on your access controls? Or just met me at a conference and want to keep talking? LinkedIn is the fastest way to reach me.