Kontorly is a workplace-wellness pilot-program platform: each client company joins through a dedicated access code, its employees sign in to a portal to log their activities (movement, active breaks, and so on), earn automatically calculated points, and follow their department's ranking against the others in real time. A back office lets the product team manage companies, users, the activity catalog, program tiers (Intro, Medium, Remote, Premium) and challenge windows. The initial build — authentication, employee portal, scoreboard, back office, visual identity — was designed and driven through Lovable, iterating quickly on the product through successive prompts to validate the concept and user journeys without getting slowed down by interface mechanics.
Once the product was functional, the work moved directly into code for a two-part hardening pass. On the security side (Milestone 2 — Security Hardening): company access codes are now hashed (SHA-256) with expiry and revocation, instead of being stored in plain text. Admin sessions run on short-lived hashed tokens (30 min), with IP/user-agent tracing and a strict split between roles (platform owner vs. company admin). Edge Function CORS is locked down to a configurable origin allowlist. The most sensitive anti-cheat point: point calculation is never done client-side — every activity submission is revalidated server-side (active activity, compatible tier, reference point value, challenge time window) before being credited.
On the GDPR side: added a consent banner, a dedicated site-consent hook, and — most importantly — a consent-event audit log (source, purpose, legal basis, version, timestamp), a necessary condition for a program handling corporate health/wellness data. An employee-facing data-deletion request flow was put in place, with a dedicated processing panel on the admin side. All of this runs on Supabase (Postgres + Auth + Deno Edge Functions) for data and sensitive business logic, across nine dedicated server functions totalling roughly 3,000 lines of security logic and business rules. In parallel, the public marketing site followed the same approach: demo and partnership-application forms routed through a dedicated Edge Function with server-side revalidation and a honeypot anti-bot field, lead tables under RLS, automatic email notification (Brevo), and a consent banner with a first-party attribution cookie set only after explicit acceptance.