Every row is scoped to its owner in the query AND enforced by row-level security in the database. A forgotten filter shows you nothing, not everything.
Server components by default, a self-hosted font, and no client-side state library. The whole interface is a handful of primitives.
Responsive from a phone up, with a light and dark theme that follows the system, and motion that respects a reduced-motion preference.