Digital Home Manual is a property-management SaaS where homeowners catalog everything about their home — properties, rooms, items, appliances and materials, plus contractors, documents, warranties, vault codes, room videos, voice notes and maintenance reminders. Owners can share a read-only view of a property through a secure token and generate per-item QR codes, all on a subscription model with tiered property limits. The app had been generated with Lovable on top of Lovable Cloud (managed Supabase plus gateway services): not a typical SPA, but a server-rendered TanStack Start application deployed to Cloudflare Workers, with Stripe billing running sandbox and live in parallel. It worked on the surface but carried real security, reliability and UX debt, and the client needed an experienced engineering partner to make it trustworthy and ready to hand off.
The work began with a full security and configuration audit — authentication, Row Level Security, database permissions, storage buckets and secret exposure — verifying the ownership-based RLS model across the entire data hierarchy and locking storage down to private, user-scoped buckets. The key insight: several reported bugs were not code bugs at all, but Supabase migrations that had never been applied to the live database. The broken AI receipt scanner, the profile 'Bucket not found' save error and unreliable item photos all traced back to missing migrations — diagnosing that unblocked four problems at once and saved days chasing phantom code issues.
On the secured base, Loopus ran a full UX review with documented recommendations and redesigned key pages to client mockups — a full-bleed property hero, a navigation hub with large cards and serif titles, and a color-coded structure — all aligned to the brand palette (deep navy, sand-gold, warm white) through a token-first theme with day and night variants. Dozens of UX quick wins from real tester feedback followed: a search bar replacing vanity stat chips, phone-number auto-formatting, automatic https:// prefixing for links and a separated account-deletion danger zone. New features included document upload to any of a user's homes, rooms promoted to their own route, per-room reference photos, a calendar entry point and searchable reminders, plus billing and onboarding fixes. Everything was validated with Playwright end-to-end tests and a production type-check gate, then shipped with structured handoff documentation — action plan, applied-versus-remaining recap, manual test scripts and a deploy checklist — so the client can run the platform independently.