SwiftCart
Home and decor store, hardened after launch
A home and decor storefront with customer and admin dashboards, Chart.js reporting and PDF invoices, maintained in production across more than 200 commits.
What is SwiftCart?
SwiftCart is a production home and decor ecommerce platform with customer and admin dashboards, reporting and PDF invoices. More than 200 commits of post launch work closed an unauthenticated delete route and a privilege escalation path, hardened authentication against brute force and account enumeration, and fixed a MongoDB connection leak and a cart race condition.
The interesting part
What Was Actually Hard
Every project looks straightforward in a case study. These are the problems that decided how it was built.
An unauthenticated delete route
A route that removed data without checking who was calling it. Found, closed and covered. This is the class of bug that never appears in a demo and ends a business when someone else finds it first.
A privilege escalation path
Discovered during a self directed audit rather than reported by a user. A path existed for a lower privileged account to reach actions it should never have had. Closed at the authorisation layer rather than hidden in the interface.
A connection leak that only showed under load
MongoDB Atlas warned that production was approaching its connection limit. The leak was invisible in development because it needed sustained concurrent traffic to appear. Tracing it meant reproducing the load rather than reading the code again.
A race that lost cart updates
Rapid clicks on quantity controls dropped updates, so the cart disagreed with the customer. Fixed at the write path so the last intent wins rather than the last request to arrive.
Brute force and account enumeration
Authentication was hardened so repeated attempts are throttled and failed logins do not reveal whether an email address exists. Both are standard, and both were missing.
What it does
Shipped Feature Set
- Customer and admin dashboards
- Chart.js sales and inventory reporting
- Generated PDF invoices
- Hardened authentication with throttling
- Role based access control
Built by
Ashraful Islam Hridoy, Lead Engineer
Ashraful builds the systems behind The Cubas engineering work, from typed REST APIs and data models to the React interfaces on top of them. His focus is the part most builds skip: secure access, reliable background jobs, and what happens to a system after launch.
Read the backgroundServices this demonstrates
