Sivden Architects
Production hardening and modernization of a live property platform — public listings site plus admin CMS — audited, secured, sped up and migrated closer to its users with zero downtime.
Visit the live site ↗
“The platform worked, but it had drifted — months-old code with no version control, dead dependency pins, and quiet security and performance debt. Get it onto a maintainable footing without changing the product for users.”
The engagement
A live real-estate showcase — a public listings site and an admin CMS — running on a production server that no one could safely redeploy. We were brought in to audit it, modernize it, and hand it back on solid ground.
Security audit and hardening
A full read of the auth, upload and middleware layers turned up around a dozen issues: an unauthenticated admin-bootstrap endpoint, refresh tokens signed with the access-token key, a host-header allowlist that was effectively off, an unbounded in-memory rate limiter, and unbuffered uploads. We separated the signing secrets, added constant-time comparison, and made the app fail fast on missing production config instead of falling back to insecure defaults.
Modernization and performance
Moved the backend to Python 3.13 and current FastAPI / Pydantic / SQLAlchemy — which surfaced two latent crash bugs the old pins had been hiding. On the front end: nginx micro-caching, PNG assets converted to WebP (3.8 MB → 380 KB), and a scroll animation that eagerly loaded 102 PNG frames (~90 MB) replaced with a single scrubbed video (~4.5 MB).
Zero-downtime region migration
The user base is in India; the servers were in Stockholm. We moved the whole stack to Hyderabad via snapshot → AMI → cross-region copy, with row-count verification on every table to prove zero data drift, a low-TTL DNS cutover, and TLS confirmed intact afterwards. Then swept all 18 AWS regions for orphaned resources and retired the old one.
Outcome
Production back under version control on current runtimes with a documented deploy path. Public asset payload down ~90%, scroll animation down ~95%, hosting latency cut for the real user base, and no unauthenticated privilege paths left. Every change recorded in a running changelog with resource IDs and verification steps.
Next project
Stranger Events