Rescuing an AI-Generated Financial Modeling Application
Client: FinVector Analytics (Seed-Stage Fintech Startup)
Auditing, refactoring, securing, and deploying an MVP built using Cursor and Bolt that was plagued with client-side secret leaks, infinite API loops, and broken auth.
Confidentiality Notice: Client branding and proprietary domain names are protected under mutual non-disclosure agreements. Architectural diagrams, code patterns, and performance metrics displayed below are authentic records extracted from the live production build.
The Problem
The founders used AI coding assistants to assemble a financial modeling prototype. While the visual charts looked impressive, the code had fatal flaws: Stripe secret keys were exposed in client bundles, database permissions allowed any user to read other tenants' financial files, and build scripts failed consistently on Vercel.
Key Constraints
- •Two weeks remaining before critical investor demo days
- •Zero tolerance for financial calculation inaccuracies or security leaks
- •Must preserve existing chart interaction UX that founders had carefully prototyped
Technical Approach & Execution
Conducted a forensic codebase audit, moved all sensitive operations to secure Next.js Server Actions, configured strict PostgreSQL Row-Level Security (RLS), and normalized the messy 60-file component tree.
Security & Secret Key Sanitization
Extracted all API keys and external queries from client React components into secure server-side routes with input validation via Zod.
Database Isolation with Row-Level Security
Re-engineered the Supabase PostgreSQL database schemas with strict RLS policies tied to validated JWT authentication claims.
Component Consolidation & Type Safety
Eliminated 35 duplicated component variations, resolved circular state updates, and achieved 100% strict TypeScript build passes.
Cloud & Deployment
- Next.js App Router on Vercel
- Supabase PostgreSQL with RLS
- Stripe Billing Integration
- GitHub Actions Automated CI Workflow
Tools & Languages
Key Engineering Lessons Learned:
- •AI code is great for generating UI ideas, but senior engineers are indispensable for auth, state, and security
- •Fixing the underlying architecture enabled the founder to continue using Cursor safely for small features
Explore other engineering engagements
See how our solutions scale across varying stacks and industries.
Real-Time Fleet Telemetry & Dispatch Platform
Rebuilding a fragmented legacy dispatch system into a reactive Next.js application with real-time GPS tracking, automated driver assignments, and automated invoice reconciliation.
WooCommerce to Headless Next.js & Sanity Migration
Transforming a sluggish monolithic WordPress/WooCommerce site into a headless architecture, reducing load times from 4.8s to 0.7s and raising mobile conversions.
HIPAA-Compliant Patient Telehealth & Scheduling Portal
Engineering an encrypted patient portal with integrated video consultation, instant appointment scheduling, and electronic health record integration.
Want an independent technical review of your application?
Send us your repository, live URL, or technical roadblocks. A senior systems engineer will inspect your setup and record a concise 3-minute Loom video audit detailing security gaps, performance bottlenecks, and architectural fixes.
Facing a similar engineering challenge?
Let's review your architecture, code repositories, or deployment roadblocks.