Case study FitTrack PE 2026
FitTrack PE: built by a teacher, made ready to scale
How Aspen audited an AI-built app before a state took interest in it.
Rich Abrams teaches health and physical education in the Iowa City Community School District. He’d never built software. In May 2026, Iowa signed House File 2676 into law, adding a physical fitness testing requirement to the PE curriculum: students tested at least once across each of three grade bands, from first grade through high school, with results a district needs to be able to produce if its accreditation is ever questioned.
Rich could see what that meant for him: years of results, across hundreds of students, that a spreadsheet wasn’t going to hold. So he built FitTrack PE using Claude Code — a place to add students, log fitness test results over time, and pull up progress whenever it was needed.
He built it for his own classroom. Then he demoed it, and his district got interested in running it everywhere. The state floated the idea that it could work for every school in Iowa. Rich’s job hadn’t changed, but he was suddenly the owner of software other schools wanted to depend on, with no way to know if it would hold up.
01What we did
Rich brought Aspen in to find out whether FitTrack PE could handle that kind of scale, and whether it was safe to hold student data at that scale. Under NDA, he gave us access to the codebase.
We spent several days on it: mapping the architecture, tracing how data moved through the app, and testing every feature by hand — the same process we run on any AI-built application. Alongside that, we ran a heuristic review of the product, walking every path a student, teacher, or administrator would take. We handed it all back as a site Rich could log into: architecture, user journeys, and every issue found, prioritized and explained.
02What we found
Three issues were worth fixing before FitTrack PE went further. Two were the kind of gap that shows up often in AI-generated backends.
Gap one
Every teacher’s data was readable by every account
The database’s row-level security was meant to let a student see their own teacher’s testing window and populate a name dropdown. What it actually granted was read access to every column on every teacher’s row: email, class roster, school, and the Stripe billing ID sitting in the same table. Any signed-in user, at any school, could read all of it.
Gap two
The billing page didn’t check who was asking
Handed a Stripe customer ID, the billing function returned a working link into that customer’s payment portal — no check on whether the person asking was the account holder. Paired with the first gap, a student with nothing more than a browser’s built-in developer tools could pull a teacher’s billing ID off a roster page and open their payment portal.
We also flagged a set of WCAG accessibility gaps — worth fixing on any app, and particularly relevant to one likely to run on federal education funding.
We handed Rich a plain-language writeup with a prioritized remediation plan.
03Outcomes
Rich fixed it himself
Rich didn’t need to hand the fixes to a developer. He took the remediation plan into Claude Code and worked through it in priority order. The row-level security policy now exposes only what a student actually needs from a teacher’s record: a name for the dropdown and the dates of the testing window. The billing function confirms that the person asking owns the account before it opens anything. The accessibility fixes are complete, beginning with the issues most likely to block students using screen readers or keyboard navigation.
He can explain what he built
The bigger change is that Rich now knows how his app works. He can say where student data lives, who can reach it, and what stops anyone else from getting to it. When the district asked how FitTrack PE protects student records, he had a real answer, backed by a documented review and fixes he made and understands.
Ready for the rollout
FitTrack PE is on track for district-wide rollout across Iowa City Community School District this school year. The state conversation is still open. If it moves forward, Rich goes into it with an independent audit, a remediation record, and an app that was checked before it held a single other school’s data.
I can’t tell you how helpful Aspen has been in making my app optimally functional. I’m now able to work through a staging environment to test all of my changes before I push them out into the real world.
Get the same review for your app
Built something with AI that other people now depend on? We’ll run the same audit on it: architecture, data access, every feature tested by hand, and a prioritized plan you can work through yourself.
$499 fixed price · 1 week
Book an Audit