Sivden Architects
Production hardening and modernization of a live property platform — public listings site plus admin CMS — audited, secured, sped up and migrated closer to its users with zero downtime.
Visit the live site ↗
“The platform worked, but it had drifted — months-old code with no version control, dead dependency pins, and quiet security and performance debt. Get it onto a maintainable footing without changing the product for users.”
Client
A live real-estate showcase — public listings site plus admin CMS — for Sivden Architects, running in production but with nobody who could safely redeploy it.
Challenge
Months-old code with no version control, dead dependency pins hiding latent crash bugs, unbuffered uploads, an unauthenticated admin-bootstrap endpoint, refresh tokens signed with the access-token key, an unbounded in-memory rate limiter, PNG assets weighing 3.8 MB each, a scroll animation eagerly loading 102 PNG frames (~90 MB), and servers 8000 km from the actual user base in Stockholm instead of India.
Solution
Full audit, then targeted work in three tracks. Security: separated the signing secrets, added constant-time comparison, and made the app fail fast on missing production config instead of falling back to insecure defaults. Modernization: Python 3.13 and current FastAPI / Pydantic / SQLAlchemy (which surfaced the two latent crash bugs the old pins were hiding), nginx micro-caching, PNGs converted to WebP (3.8 MB → 380 KB), the 90 MB PNG frame sequence replaced with a single 4.5 MB scrubbed video. Region migration: snapshot → AMI → cross-region copy to Hyderabad, row-count verification on every table, low-TTL DNS cutover, TLS confirmed intact, then all 18 AWS regions swept for orphaned resources.
Result
Production back under version control on current runtimes with a documented deploy path. Public asset payload down ~90%, scroll animation down ~95%, hosting latency cut for the real user base, no unauthenticated privilege paths left. Zero downtime through the region migration, every change recorded in a running changelog with resource IDs and verification steps.
Next project
Stranger Events