A national confederation's member system, modernized with the legacy still live

+--------------------+  +----------------+  +--------------+
| member, regional,  |  | public check   |  | membership   |
| national office    |  | by QR code     |  | applicant    |
+---------+----------+  +-------+--------+  +------+-------+
          |                     |                  |
          +---------------------+------------------+
                                v
+----------------------------------------------------------+
| routes declare their profiles; closed by default         |
+----------------------------------------------------------+
| PHP: legacy in production and new code in layers,        |
| growing from the inside (strangler fig)                  |
+------------+--------------------------------+------------+
             v                                v
+------------+------------+      +------------+------------+
| MySQL: main             |      | MySQL: online           |
| registry                +<--+->+ membership              |
+-------------------------+   |  +-------------------------+
                              |
                +-------------+-------------+
                | reconciler between        |
                | the databases             |
                +---------------------------+

+----------------------------------------------------------+
| GitHub Actions: pre-checks on disposable databases;      |
| deploy with backup, health check and automatic rollback  |
+----------------------------------------------------------+

Context

A national confederation of professionals keeps its members’ records and the standing of each professional registration in a web system. The state representations, the regional offices, send card requests in batches; the national office checks them, bills, prints and passes each regional office its share. Anyone can check through the card’s QR code whether a professional is in good standing. The system is old, runs in production and holds real personal data.

What I built

• Version control from the server. The first commit is a snapshot of what was live, code only, with no secrets and no user data. Both databases became versioned as a schema plus migrations, with secret detection in CI.
• The batch workflow as a state machine. In preparation, under review, awaiting payment, in production, final review and done, with deadlines in business days that skip weekends and national and state holidays, extensions with a reason, two-step pending issues (the regional office flags them resolved, the national office confirms) and acknowledgement recorded on both sides.
• Card printing tied to good standing. It only prints when every registration in the batch is in good standing. The screen disables the button and explains what is missing, and the generator repeats the check on the server.
• Online membership, rewritten. A pre-registration with documents, an electronic contract and consent under LGPD (Brazil’s data protection law) recorded separately; routing by state decided on the server; review document by document; and the member only exists after payment.
• Reports for the board. A year-over-year comparison with two readings, finances by state and by batch, and an in-house XLSX export in the format of the office’s spreadsheet.
• Delivery with a safety net. CI pre-checks with disposable databases and migrations applied twice to prove idempotency; deploys with backup, health check and automatic rollback; a staging environment with outgoing e-mail blocked, validated by the board before changes go live.

Security as a method

Code review, dynamic testing against a local container, security questions reviewed on every diff and authenticated red-team suites in CI. A written rule: no scanner against production. The categories covered follow the OWASP Top 10: A01 broken access control, A02 cryptographic failures and credential storage, A03 injection and XSS, A04 insecure upload design, A05 security misconfiguration and A07 authentication and session management. Specific findings are not published.

What is not here

The organization’s name, its professional field, real numbers and any detail that identifies the system. The demo uses a fictional confederation, with made-up people, registrations and amounts.