Project takeover · Gold MerchandisingTaking over a SaaS platform built with no-code: security audit, hardening and an exit from technical dependence
Take over the existing product without breaking what worked, close the critical security gaps, and give the client back control of their code and infrastructure.
- Client
- Gold Merchandising, an agency for in-store merchandising and fixture installation (historical client: Nocibé, prestige cosmetics)
- Role
- Full-stack developer & technical architect (takeover)
The context
Gold Merchandising's platform, a multi-role SaaS for managing in-store installation jobs, had been built on Lovable by a non-developer. It worked and was used in production, but it relied entirely on the no-code platform, with accumulated technical debt and several critical security flaws that had been reported but never verified.
What was done
- 1
Leaving the no-code platform for owned infrastructure
Versioned Git repository, Docker images and multi-environment Coolify deployment (production, staging) on a Contabo VPS, with Supabase configuration injected when the container starts. The client now owns their code and their server, with no dependence on a third-party vendor.
- 2
Security audit and fixes in production
Full technical audit, then fixes for the flaws confirmed exploitable on the live database: privilege escalation (any signed-in account could declare itself administrator through the API), open read access to the users table, client prices and margins leaking to subcontractors. About 70 redundant RLS policies inherited from no-code were consolidated into one clear rule per table and per action.
- 3
Bringing reliability up to standard
Rebuilt job state machine (status derived by a PostgreSQL trigger), trigger-generated notifications, a pg_cron scheduled task for expired-document alerts, transactional stored procedures for pre-invoicing and client approval, file storage moved to a private S3 bucket with presigned URLs issued server-side after access checks, and Sentry set up.
- 4
Passwordless authentication
Switch to magic-link sign-in (no reusable secret left to steal or replay) and an impersonation feature reserved for administrators, for support.
- 5
The "2026 campaign update" feature
Multi-store campaigns with separate installation teams (each installer only sees their team's jobs), a guided reporting flow (before/after photos, point-of-sale materials, after-sales), schedule import from Excel (each row's colour sets the team), a trilingual FR/DE/EN interface, and read-only observer access for client-side contacts. The real campaign went live: 109 stores, 7 teams.
Tech stack
- React 18
- Vite
- TypeScript
- Supabase (PostgreSQL, RLS, Edge Functions, pg_cron)
- TanStack Query
- Tailwind / shadcn
- Contabo S3
- Sentry
- i18next
- Docker / Coolify
What it changes
A platform no longer locked into a no-code vendor, whose code and infrastructure the client fully owns. Security flaws closed before they became costly, in particular margins leaking to outside contractors. A technical base that can take on new client campaigns without a rewrite.
Concrete results
Around forty security and feature migrations delivered and applied in production, critical flaws closed and verified, a Nocibé campaign of 109 stores and 7 teams put online, a cleaned-up codebase (zero type errors, about 145 dead files removed).
