Client Mobile App — Security Hardening & Ground-Up Redesign

A client’s production Flutter/Firebase mobile app, handed to me mid-life as its sole engineer. Before touching a single screen, the first job was making the codebase safe to build on — tightening data access, writing down decisions, and establishing a process the project didn’t have yet.

Stabilizing before building

• Hardened data access. Audited and locked down database security rules collection by collection, extending coverage as new features shipped so every write path is scoped rather than left open.
• Stood up process from nothing. Wrote the project’s first architecture, security, and setup docs; opened a lightweight in-repo ticket tracker so decisions and known issues survive between sessions instead of living only in someone’s head.
• Restructured the codebase into a proper monorepo ahead of a planned dashboard and website that will sit alongside the existing mobile app.

Rebuilding the UI against a real spec

• Working screen-by-screen off a client-supplied design file, matching typography, spacing, and a specific accent color pixel-sampled directly from the source artifact rather than approximated from the app’s existing theme.
• Rebuilt several core flows — listing browsing, detail views, and an in-app reservation request — including new backend schema and queries to back them.

Treating data quality as a first-class bug

• While wiring a filter against live data, discovered two populations of existing records used the same two fields for opposite meanings — traced by querying the raw collection directly rather than guessing from the query layer.
• Chose to revert the filter to its safe, unfiltered state and schedule a proper data migration instead of shipping a query clever enough to paper over the inconsistency.

The client and product name are confidential and intentionally omitted.