Stealth biotech startup
Zero to a production health-data product in one month
A three-month sprint as sole operator. The site relaunched in ten days, then the company's first product shipped in a month on a hardened Postgres layer, an authenticated engine API and first-party analytics.
- Role
- Growth Systems Architect (contract)
- Years
- 2026
- Result
- 1 month to production
- 36Diff-reviewed builds between an empty database and a feature-complete member app
- 6Findings from a live security audit, three high and three medium, all closed
- 54Behavioral event types in a privacy-by-design analytics layer
The system
A stealth Swiss biotech startup building tokenized bioscience assets brought me in for a three-month pre-sale sprint, and I ran it as sole operator. The contract covered growth, the funnel, the community and a quest and points MVP. Three weeks in, the founders re-sequenced the build around one product: a private health journal that would give the community a reason to show up and feed everything built after it.
So I built the whole stack under it. The marketing site came first, relaunched in ten days for a conference. The product shipped a month after its database went live, on a data layer I hardened and audited myself, with an engine API, first-party analytics and a data interface for the company's AI partner.
What shipped
| Layer | What it does | Built on |
|---|---|---|
| Marketing site | Two audiences, eight pages, CRM capture, and attribution tags on every path into the app | Framer, 31 custom React code components |
| Member app | Structured intake, history, a progress dashboard, a calendar on a pharmacokinetic model, export and account deletion | TanStack Start, React SSR, Tailwind, shadcn/ui |
| Data layer | Three schemas, row-level security on every table, audited admin access, de-identified views | Supabase Postgres, PL/pgSQL |
| Engine API | Missions, points, predictions and peer review, idempotent on every write | Node/Express, Prisma, Railway |
| Identity | One login across the app and the engine | ES256 JWKS verification |
| Analytics | Visitor-to-member funnels with no raw identifiers | Postgres event table, hashed views |
The data layer, hardened before the first user
Health data leaves no room for a second pass. Row-level security was on from the first migration, because a readiness review caught the gap that would have exposed the database through the public anon key before any code ran. The schema grew across nine versioned migrations, with definer functions on pinned search paths, an audit log that survives a rejected call, and aggregate views that return nothing below five contributors.
Then I audited the live system myself.
| Finding | Severity | Fix |
|---|---|---|
| The engine trusted a user-ID header, so a member could impersonate another | High | Identity comes only from the verified token |
| The review queue had no role check | High | A shared validator gate on every review route |
| A member could promote themselves to admin | High | A grant-level revoke plus a trigger that pins privileged columns |
| The anonymous role held write grants on member tables | Medium | Revoked in full |
| Admin reporting functions answered any member | Medium | Every call logged, and empty for non-admins |
| Members had no way to delete their data | Medium | Account deletion through a server-checked function |
One login across two systems
The app runs on Supabase auth, and the engine runs as its own service on Railway. I bridged them with asymmetric keys. The engine verifies every Supabase session against the project's public JWKS with issuer and audience checks, then resolves the member through a cross-schema join. No shared secret exists to leak, and a database trigger mirrors every new signup into the engine.
Measurement with no health data in the stream
The app only stored completed entries, so drop-off was invisible. I built an insert-only event table bound to the signed-in identity, with a stable anonymous ID that stitches a first visit to the member it becomes. The attribution tag on a site link rides into signup metadata and the event stream, so site, ambassador and Reddit traffic separate cleanly.
Fifty-four event types cover per-field form timing, abandonment and dwell. A leak check confirmed no event carries a dose, a weight or a side effect, and downstream readers get a hashed, de-identified view.
The site in ten days
The company had a conference booth and a site that read like a template. I rebuilt it in Framer through its MCP integration, writing 31 React code components and driving the canvas with a sandbox-then-cutover safety model. Eight pages shipped on the deadline. The cutover moved the paid plan onto the rebuild, so the domain switched with no downtime and no rebuild.
Bugs caught before any user saw them
An AI app builder generated every one of the 36 app builds, and every one got a diff review before publish. The review caught four classes of bug.
- Rewrites that would have silently dropped a user's first change in the log form and the calendar.
- Two builds writing to columns that did not exist, which would have failed every save.
- Inserts using the auth ID where the table expects the profile ID, so row-level security rejected every write.
- Foreign keys that would have blocked account deletion for anyone who had reviewed an entry.
What I handed over
The engagement closed clean. I revoked the partner's database role and app account, swept for credentials, and took checksummed backups of the site and the app with restore notes. The company kept its live site, and every record its members wrote stayed in its own database.