SellerConnect

SellerConnect sells done-for-you Bol.com operations to Dutch and Belgian merchants: product listing, inventory synchronisation, fulfilment and brand registration. The software is the front door to that service business rather than the service itself.

Fifteen public pages in Dutch carry the proposition, one per offer plus a savings calculator, a pricing comparison and a long-form application form. Two forms convert: a general contact form and a qualification form that captures store name, store URL, catalogue size and which services the merchant wants. Behind authentication sits an admin console where submissions are listed, opened, moved through a status workflow and exported to a spreadsheet, so the sales side of the business runs off the same deployment that markets it.

Eighteen days, first commit to last, one engineer.

A merchant filling in the qualification form never touches the database directly: the browser posts JSON to a route handler, which validates the required fields server-side and performs the insert with a server-held service key that never leaves the deployment.

The read path is built so that possessing anything the browser has grants nothing. Row-level security allows the anonymous role to insert into both intake tables and allows no select at all unless the caller has a profile row whose role is admin, so an exposed public key buys an attacker the ability to submit a lead, not to enumerate the pipeline. Edge middleware refreshes the session cookie on every non-static request and bounces unauthenticated traffic off the console. Each admin route handler then resolves the user again and re-reads the role from the database rather than trusting the middleware that already ran.

The redundancy is the point: a middleware matcher is one regular expression away from silently exempting a path, and a route handler is one refactor away from losing its guard, but a policy evaluated inside Postgres fails closed no matter which layer above it was misconfigured.