The PIN layer from Track 5 is the right answer for a startling number of solo apps: low-stakes data, single user, network-perimeter already in place. But threat models shift over time — and so should your auth.
The trigger conditions
| Trigger | What changed | Add |
|---|---|---|
| You added a second user (partner, friend, family) | Per-user accountability matters now; PIN sharing breaks accountability | Per-user identity (passkey or magic link) |
| You expose the app outside Tailscale | Perimeter is gone; PIN is now the only gate | 2FA + reverse-proxy WAF + mandatory longer PIN |
| The data became sensitive | Health, finance, work secrets, NDA material | Hardware key, encrypted data at rest, audit log retention |
| You added paying users | Compliance enters the chat | Real IdP (Auth0, Clerk, Supabase Auth) |
| You hit a recurring brute-force baseline | Attackers found you and care | Rate-limit at edge, reCAPTCHA / Turnstile, geo-blocks |
| Mobile app added | Cookie-based session model fits browsers, not native | OAuth2 device flow, refresh tokens, native biometrics |
What doesn't change
Even after upgrading: keep the PIN layer for solo-dev sessions. Defense in depth means the network perimeter, the per-user identity, and the application-level gate all coexist. Removing layers because you "have something better" is the most common downgrade pattern in the wild.