Archeway Application Tracker

A class project can skip security. A production application storing real user data cannot. Going from one to the other required treating the entire codebase as an untrusted attack surface.

Fix. CSRF tokens on every form and endpoint, custom input sanitization utilities against XSS, rate limiting on authentication routes, and CSP headers restricting what resources the browser will execute. Each vulnerability class handled at the framework level, not case by case.

Drag-and-drop feels broken when there's a visible lag between the user's action and the visible result. But updating the server before the UI creates exactly that lag.

Fix. Optimistic UI — the kanban card moves immediately in the DOM, the server update happens in the background, and on failure the card snaps back with an error message. Users get instant feedback; data consistency is still guaranteed.

The gap between a locally running Flask app and a production Azure deployment is substantial: environment secrets, database migrations, SSL, logging, email, and error monitoring all need to exist and be configured correctly before launch.

Fix. Environment variable management for all secrets, Flask-Mail for automated welcome emails, structured error logging piped to a monitoring service, and SSL certificates through Azure for encrypted user sessions.