Eliminating Security Vulnerabilities and Establishing Quality Gates

The Starting Point

As Spa Space's platform grew from prototype to production, the codebase had accumulated technical debt common in fast-moving startups: inconsistent code quality, minimal test coverage, and security practices that needed strengthening.

This is a normal phase of startup development - speed-to-market often takes priority over code hygiene. But as the platform scaled and handled real customer data and payments, the team recognised the need for systematic quality improvement.

The Risks

Without quality controls in place, the team faced:

• Security vulnerabilities including SQL injection risks in some legacy code paths
• Minimal test coverage making refactoring risky
• Inconsistent code patterns across different services
• Manual code review as the only quality check
• Deployment anxiety from lack of automated validation

The Business Context

A marketplace handling customer bookings and payments cannot afford security incidents or data breaches. Beyond the direct business impact, trust is foundational to marketplace success - providers and venues need confidence that their business data is secure.

Our Approach

We implemented a comprehensive code quality and security programme, integrating automated tooling into the development workflow so that quality became continuous rather than a periodic audit.

SonarCloud Integration

We introduced SonarCloud as the central platform for code quality analysis:

• Static analysis on every pull request
• Security scanning to identify vulnerabilities
• Code smell detection for maintainability issues
• Test coverage tracking to measure improvement
• Quality gate enforcement to prevent regression

CI/CD Pipeline Enhancement

Quality checks were embedded into the deployment pipeline:

Code Push -> Build -> Tests -> SonarCloud Analysis -> Quality Gate -> Deploy
                                      |
                                      v
                              Fail if: Coverage < 80%
                                       Critical vulnerabilities
                                       Major code smells

This meant no code could reach production without passing automated quality checks.

Security Remediation

The initial SonarCloud scan identified several security concerns, prioritised for remediation:

1. SQL injection vulnerabilities - converted to parameterised queries
2. Hardcoded credentials - moved to environment variables and secret management
3. Insecure dependencies - upgraded to patched versions
4. Input validation gaps - added validation on API endpoints

Test Coverage Programme

We established a systematic approach to increasing coverage:

• Coverage targets - 80% minimum, 90% goal
• New code requirements - all new code must have tests
• Legacy code prioritisation - critical paths tested first
• Test quality - not just coverage numbers, but meaningful assertions

Quality Gate Definition

The quality gate prevented merging code that:

• Had critical or blocker security vulnerabilities
• Had major code smells (maintainability issues)
• Dropped coverage below the target threshold
• Duplicated more than 3% of existing code