sample deliverable, real data
Overall: needs attention, but not a rewrite. The app is small, clean and works. Its problems are all around it: software that stopped getting security fixes in 2025, no automatic backups, and deploys that depend on one person knowing which terminal to restart.
Biggest risk: 77 published security advisories against the libraries it uses, 4 rated critical, on a server whose operating system went out of support in 2023.
Biggest win: a 2-week renovation gets it onto supported versions, with backups and one-command deploys, for a fixed $6,000. After that, it needs about 2 hours a month of care.
Visitors ──► nginx 1.22 (EOL) ──► Rails 7.0 app (puma 5.6)
│ │
│ ├── SQLite database (single file)
│ ├── Admin panel (catalog, creators, guides)
│ └── Newsletter signups
│
Same server also runs 8 other sites + scheduled scripts (cron)
Server: FreeBSD 12.4 (EOL Dec 2023), one machine, no staging
Outside the app:
• Product prices and links checked by hand on 30+ creator sites
• Backups: one manual copy taken during a cleanup, nothing scheduled
• Deploy: SSH in, pull code, restart a process inside a terminal session
| Area | Finding | |
|---|---|---|
| Framework | Rails 7.0.3.1. The 7.0 line stopped receiving security fixes on 1 April 2025. Current is 8.x. | High |
| Language | Ruby 3.1.0. End of life 26 March 2025. | High |
| Libraries | 77 published advisories across rack (30), nokogiri (19), Rails components (21), puma (5), sqlite3 (2). 4 critical, 19 high. Not all are exploitable in this app, but nobody has checked. | High |
| Size | About 1,000 lines of Ruby, 6 models, 13 controllers, 51 views. Small and readable: good news for cost. | Good |
| Tests | 9 test files, mostly generated scaffolding. No tests on the paths that matter: search, product pages, admin edits. | Medium |
| History | 64 commits since 2022. Untouched for long stretches, then bursts of changes. Recent work isn't pushed to the remote repository, so the only copy of the latest code is on the server. | High |
| Deploys | No deploy script, no CI. Manual SSH and process restart. | Medium |
| Hosting | Shared with 8 other sites. Web server version disclosed publicly; compression off; security headers missing; no SPF/DMARC on the domain. | Medium |
Everything about how this runs lives in one person's head: which terminal window runs which app, how to restart it, where the backup is. If that person is unavailable for a month, nobody can safely change anything. In small-company software this is the most common problem, and the cheapest to fix.
| # | Improvement | Why it matters | Effort | Fixed price |
|---|---|---|---|---|
| 1 | Push all code to the repository; protect the main branch | Today the latest code exists only on the server | 1 h | incl. |
| 2 | Nightly automatic backups, kept off-server, with a tested restore | One disk failure away from losing the catalog | 3 h | $300 |
| 3 | Upgrade Ruby 3.1 → 3.4 and Rails 7.0 → 8.0 | Back on supported, patched versions | 2–3 days | $2,400 |
| 4 | Update rack, nokogiri, puma; clear the 77 advisories | Closes the known security holes | with #3 | incl. in #3 |
| 5 | Tests for search, product pages and admin edits + CI | Future changes stop being scary | 1.5 days | $1,200 |
| 6 | One-command deploy with automatic rollback | Anyone can ship a fix in minutes | 1 day | $800 |
| 7 | Web server: compression, security headers, hide versions; SPF + DMARC | Faster pages, fewer attacks, email not spoofable | 3 h | $300 |
| 8 | Weekly automatic link and price checker for creator sites | Replaces hours of manual checking | 1 day | $800 |
| 9 | Move to a supported server (or isolate this app from the other 8) | OS out of support since 2023 | 1–2 days | quoted after #3 |
| 10 | Handover kit: AI-maintainer instructions, runbooks, alerts | You own the knowledge, not us | 1 day | incl. in sprint |
Scope: items 1–7 and 10. Duration: 2 weeks. Price: $6,000 fixed, minus the $1,200 already paid for this fog map.
Result: supported versions, zero known advisories, nightly tested backups, tests and CI on the important paths, one-command deploys, and an AI-maintainer setup your team can use. Items 8 and 9 can follow as a second, smaller sprint.
Afterwards: Care at $750/month is plenty for an app this size.