Illustrative example. The company, product, code and figures are fictional. They reflect problems that often show up when an MVP goes into production. The real report is delivered in writing, with a one-hour walkthrough.
The context
Planora (a fictional name) sells a B2B team scheduling SaaS: 40 client companies, around 1,200 users. The MVP was built by an agency 14 months ago, with React, Node.js (Express) and PostgreSQL, on a single server. For three months, every release has caused an incident, and the schedule screen takes several seconds to load.
What we looked at
- The code repository, read-only: front end, API and deployment scripts.
- Production logs and server metrics over 30 days.
- The database schema and the slowest queries.
- A one-hour interview with the founder and the developer still on the team.
The verdict
The product can be saved without a rewrite. Three fixes are urgent, including a flaw that exposes one client's data to another. After that, 6 to 8 weeks of consolidation are enough to get back to incident-free releases.
The five priority risks
| # | Risk | Severity | Effort | Recommendation |
|---|---|---|---|---|
| 1 | Tenant isolation is done in the browser: by editing a request, a user can read another company's schedules. | Critical | 4 d | Enforce access control on every API route, server-side, with one automated test per route. |
| 2 | No database backup has ever been tested. Nobody knows whether a restore would work. | Critical | 0.5 d | Automated daily backups, an off-server copy and a monthly restore test. |
| 3 | API keys and the database password are stored in plain text in the Git repository. | High | 1 d | Rotate every key, remove them from the repository and store them in a secrets vault. |
| 4 | No automated tests and no continuous integration: every release is done by hand, from a laptop. | High | 3 d | Automated deployment and tests for the five critical journeys: sign-in, schedule creation, invitations, billing, export. |
| 5 | The schedule screen is slow (4.2 s for 5% of page loads): the API runs one query per employee instead of a single one. | Medium | 2 d | Batch the queries, add two indexes and cache the week's calendar. |
The recommended plan
- Week 1: fix tenant isolation, set up backups, rotate the keys (5.5 days).
- Weeks 2 to 4: continuous integration, tests for the critical journeys, schedule performance (5 days).
- After that: consolidation along the roadmap, with systematic code review.
Estimated cost of the first two steps: 10.5 days, around €5,900 on a time-and-materials basis. The diagnostic fee is credited against it.
What the full diagnostic adds
In 4 days, the full diagnostic adds a detailed security review, performance measurements under load, technical debt costed module by module and a step-by-step, costed plan to production. See diagnostics and prices.