Build verifiable course certificates with a separate security-audit pass
At a glance
Michael Taggart used Claude Code to build CertGen, a service that emails verifiable course-completion PDFs as his institute moved off Teachable. This workflow is listed under certificate-generation, test-driven-development, security-review.
- Agents / tools
- Claude Code, Claude Sonnet 4.6, Rust, Svelte, Typst
Building a tool for these workflows? See weekly rates.
What they did
In the report linked from Lobsters, Taggart describes saving feature plans in Markdown, generating tests before implementation, running cargo check and cargo test, and reviewing every change. Rust, Svelte and Typst powered a webhook-to-PDF flow with certificate IDs and QR verification links. After the features worked, he cleared Claude's context and requested a security audit recorded in FINDINGS.md.
How it went
He reports finishing in three weeks and deploying the service to issue certificates for The Taggart Institute.
Worth knowing
The audit identified template-path traversal and a password-check timing side channel. A proposed security fix also introduced a potential denial of service that he caught during review.