A Prototype That Could Not Ship — and the Backend That No Longer Existed
We inherited an AI product built on a low-code platform: any logged-in user could make themselves an admin, the intake form only pretended to save, and the database it ran on had been deleted. We audited it, recovered it, and made it launchable.
Industry
PropTech / Self-Storage
Solution
Security Audit & Remediation
Engagement
Phased, Pre-Launch
Services
Security & Platform Recovery
Inheriting Someone Else's Prototype
The client had an AI tool for self-storage operators: answer questions about your facility, and the product tells you which additional income streams — truck parking, billboards, tenant insurance, spare land — are actually worth pursuing.
It had been generated on a low-code platform from a real-estate property-management template, and never hardened. Under the surface it was a different product wearing the wrong schema. And the backend it depended on had been deleted — the database was simply gone.
What We Found
This is not an inferred problem list. It is the audit — fifty-one findings, of which eleven were critical, on a product that was days from being shown to customers.
Three separate paths to make yourself an admin, from the browser console
A plan-tier dropdown that upgraded you to a paid plan for free, bypassing payment
A hardcoded test account with its password rendered in the interface
The intake form's save was commented out and faked with a timer
The backend would not run — the database project had been deleted
Audit, Recover, Then Harden
The order mattered. There was no point fixing security on a product with no database, and no point restoring a database into a product that would leak it.
Full Backend Recovery
The deleted database restored from a cluster backup into a new project — forty tables and a hundred and seventy generated AI reports, with zero errors on restore. Authentication working end to end again.
Privilege Escalation Closed
Three escalation paths shut: role assignment moved out of the client and into a database trigger, the client-writable admin flag stopped being trusted, and the free plan-upgrade dropdown removed and enforced with row-level security.
Real Saves, Real Navigation
The faked intake save replaced with an actual database insert, the fragile browser-storage handoff replaced with proper route state, and hard page reloads swapped for real client-side navigation.
A Severity-Ranked Plan
Fifty-one findings triaged into critical, serious and moderate, each with a fix — so the client could see exactly what stood between the prototype and a launch.
What the Product Does
AI Income Analysis
Algorithms analyse the facility's details to identify which ancillary income options are actually worth pursuing on that specific property.
Intake Form
A multi-step property questionnaire — office space, truck parking, spare land, rooftop, billboards, tenant insurance, truck rental — that feeds the report engine.
AI Income Reports
Generated reports gated by subscription tier: a high-level view on the free plan, full dollar figures and strategy on paid tiers, exportable to PDF.
Vendor Network
Introductions to pre-vetted vendors who actually implement the income streams the report recommends.
Subscription & Billing
Four tiers from free to enterprise, running on Stripe with the entitlements enforced server-side after the audit, not in a dropdown.
Dashboard
Properties overview, stats and charts, with report management and tier-based unlocking.
Admin Console
User-role management and activity monitoring — with role assignment now assigned by a database trigger rather than written from the browser.
Implementation Support
Guidance and tracking as the operator adds and optimises each new revenue stream over time.
The Stack We Inherited — and Secured
Frontend
Backend
Security
AI & Payments
Three Phases, Severity-Ranked
- 1
Phase 1 — Audit
Mapped every route, page, auth component, the dashboard, the intake and the schema, and produced fifty-one findings ranked by severity with a prioritised fix list.
- 2
Phase 1 — Backend Recovery
Restored the deleted database from a cluster backup into a new project: forty tables, a hundred and seventy AI reports, zero errors. Authentication working end to end.
- 3
Phase 2 — Security
Closed the three privilege-escalation paths, removed the free plan-upgrade route, stripped the leaked password hint and the admin-ID leaks.
- 4
Phase 2 — Flow Rewrite
Replaced the faked intake save with a real insert, the browser-storage handoff with route state, and the hard reloads with real navigation.
- 5
Phase 3 — Backend Cleanup
Drop the inherited real-estate tables, reshape the schema for the storage domain, lock down row-level security, and re-enable email confirmation.
- 6
How We Worked
Audit-driven remediation with severity-ranked fix lists and daily task summaries, with client-blocked items tracked separately so they never silently stalled the work.
What Changed
51
Audit Findings Raised
11
Critical Issues Closed
3
Privilege-Escalation Paths
170
AI Reports Recovered
The backend exists again: forty tables and a hundred and seventy generated reports restored from a deleted project, with zero errors.
Nobody can make themselves an admin from the browser console — role assignment lives in a database trigger, not in client code.
Nobody can upgrade themselves to a paid plan for free — entitlements are enforced server-side, not by a dropdown.
The intake form actually saves. It previously waited a moment and pretended to.
Frequently Asked Questions
Yes — that is what this engagement was. We inherited an AI product generated on a low-code platform from a real-estate template and never hardened, then audited, recovered and hardened it in that order. The order mattered: there was no point securing a product with no database, and no point restoring a database into a product that would leak it.
Services Behind This Build
Explore Other Case Studies
Inherited a prototype you cannot ship?
We audit it, tell you exactly what is wrong and how bad it is, and take it to something you can put in front of customers.
Talk to a Delivery Expert