Client Project · Codebase Takeover
Psychology-backed tools for dating anxiety. I took over the live codebase, closed a security hole, rebuilt payments on Stripe, cleaned up the AI-generated code, and documented all of it.
TranquiLove offers interactive, psychologist-designed exercises for managing dating anxiety. The tools have to feel warm and guided rather than clinical, and work as well on a phone as on a laptop.
The product was already live when I joined. My job was to take over the existing codebase, fix what was unsafe or broken, and leave it in a state the client could keep building on — without taking the app offline for its users.
The codebase had grown quickly and without a plan. Much of the interface looked AI-generated: inconsistent components, repeated styles, and screens that looked finished as a mockup but did not hold together as a product.
Underneath the design were two problems that mattered more. Authentication had a security loophole, and the payment flow had issues — the two things a paid wellness product cannot afford to get wrong.
None of it was documented, so every change risked breaking something that nobody knew depended on it.
I fixed the security hole first, because it was the one problem that could hurt users directly. Authentication moved to server-managed sessions in httpOnly cookies, which closed the loophole and put the session out of reach of any script running in the page.
Payments were rebuilt on Stripe, replacing the flow that was causing problems, alongside the other third-party integrations the product depends on.
Then the cleanup: the AI-generated interface was consolidated into a consistent set of reusable components, and messy code was untangled so the next feature does not have to work around the last one.
Finally, documentation — how the app is structured, how auth and payments work, and how to run and deploy it — so the client is not dependent on me, or on anyone, to understand their own product.
Security before cleanup. A messy codebase is tempting to tidy first because the mess is visible and the risk is not. But the auth loophole was the only issue that could harm real users, so it went first and everything else waited.
Fix, do not rewrite. The app was live with real users, so the work was done incrementally inside the existing codebase rather than as a rewrite that would have frozen the product for weeks and rediscovered every edge case the old code handled.
Stripe instead of custom payment logic. Payments are easy to get subtly wrong, and a wellness product lives on trust. Moving them onto Stripe put the hard parts on infrastructure built for exactly that.
I take on a small number of freelance projects at a time — codebase takeovers, Figma to React, and new builds.