Built by 
About this software
About TradeVault — Crypto & Trading Portfolio Tracker
TradeVault is a React 18 + TypeScript + Vite + Tailwind web app for tracking crypto, stocks and ETFs across multiple portfolios. It includes a trade journal, watchlist, price alert rules, analytics, risk analysis and rule-based insights computed in the browser (no LLM call). Supabase (Postgres, Auth, RLS) is the intended backend, with 14 tables and 14 per-user RLS policies, plus an optional plain-Node Express server with JWT-protected REST routes and notification senders. The shipped demo runs browser-local on fictional seeded data with fixed demo prices; live market data and scheduled notifications are not included and need to be added by the buyer. The web app has 13 page components, and 12 unit tests cover calculations and alert triggers.
Why TradeVault — Crypto & Trading Portfolio Tracker
What makes it better
than the alternatives
- 01
Derived holdings
Holdings are computed from opening balances plus open trades, with the same rules in the browser and in the server port.
- 02
RLS on every table
Schema defines 14 tables with per-user auth.uid() policies and 20 indexes, documented in docs/RLS-policies.md.
- 03
Owner-checked REST API
Every /api route requires a Supabase JWT, filters by the verified user id, and ownership-checks parent portfolios before creating trades or balances.
- 04
Multi-channel notifications
Server can send price-move messages by email (SMTP), WhatsApp or Telegram, with per-user rate limits and no per-user bot token stored.
- 05
Pinned, audited dependencies
All versions are pinned exactly, the README reports 0 vulnerabilities from npm audit and OSV-Scanner, and setup and provider docs are included.
Portfolios & Holdings
- Multiple portfolios with base currency
- Opening balances as initial positions
- Derived holdings and portfolio summary (value
- cost basis
- unrealized
- realized
- return %)
- Assets list and asset detail pages
Trade Journal
- Trades with
Buy/Sell/Long/Shortdirection - fees
- strategy
- notes
- stop loss and target
- Open and closed status
- closed automatically when an exit price is set
- CSV import format with sample-trades.csv
Watchlist
- Watchlist of tickers with notes
- Global search across assets
Price Alerts
- Alert rules with above
- below or percent conditions
- Active and triggered flags
- Alerts page in the UI
Analytics & Risk
- Analytics page and risk page
- Volatility
- max drawdown and exposure calculations covered by unit tests
- Charts built with Recharts
Insights
- Rule-based insights generated in the browser
- LLM provider interface present
- demo implementation only
Notifications
- Per-user settings: threshold %
- scope (holdings
- watchlist or all)
- channels
- WhatsApp and Telegram sending from the server
- Manual test endpoint; cron scheduling is left to the buyer
Accounts & Settings
- Login page with a shared demo account
- Profile page and settings page
- Dark and light theme
- appearance customization
- Branding in a single config file
Backend & Data
- Express server with REST routes for portfolios
- trades
- balances
- holdings
- watchlist
- alerts
- profile and notify
- schema.sql and idempotent seed.sql
- Market data provider interface (demo
- CoinGecko
- Alpha Vantage named in config); only demo prices are wired
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| TypeScript (React) | — | — | Front-end | 54.4% |
| TypeScript | — | — | Front-end | 21.9% |
| JavaScript | — | — | Front-end | 12% |
| SQL | — | — | Database | 9.3% |
| CSS | — | — | Styling | 2.2% |
| HTML | — | — | Front-end | 0.1% |
- Primary language
- TypeScript 5.9 (web) + JavaScript (Node server)
- Framework
- React 18.3 + Vite 6.4 (Tailwind, Recharts)
- Database
- Supabase (PostgreSQL); no minimum version stated in code
- Authentication
- Supabase Auth email/password, JWT, RLS per user
- Licence
- Single-site
- Screens
- 13
- Database tables
- 14
- Supported languages
- English only; no i18n or RTL support in code
- Browser support
- Not specified in code (Vite default modern build targets)
| Minimum | Recommended | |
|---|---|---|
| CPU | 1 vCPU | 2 vCPU |
| RAM | 1 GB (optional Node server only) | 2 GB (optional Node server only) |
| OS | Node.js 18+ (engines >=18), any OS with Node | Node.js 18+ (engines >=18), any OS with Node |
| Est. monthly hosting | $25 | $25 |
```bash cd "Web App" npm ci npm run build # deploy the dist/ folder to Netlify or Vercel ``` Set VITE_SUPABASE_URL and VITE_SUPABASE_ANON_KEY in the host's environment settings.
```bash cd "Web App" npm ci npm run build # serve dist/ with any static web server cd ../server npm install npm start ``` The server is optional; the demo runs without it. Create server/.env from HowToSetup.md step 6.
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (2 minor)
Public demo password committed in source and docs; no real service credentials found; queries are parameterized and user-scoped; some gaps in update scoping, input validation and unseen schema. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
