● Designed a REST API with a layered handler–service–repository architecture over PostgreSQL, evolved from an in-memory store. ● Enforced authorization in the data layer: every query is owner-scoped, so another user’s task returns 404 and never leaks. ● JWT authentication, bcrypt-hashed passwords, input validation, and correct status codes (400, 401, 404, 409) on every route. ● Wrote 61 tests in three tiers: service unit tests with fakes, repository tests and full-HTTP tests on a real PostgreSQL.