The Shirt Store LV: Auditing and Hardening a Live Order Pipeline
A full-stack audit of a live DTF and bulk-apparel printing site — a homepage filter that silently did nothing, an order form that could quietly lose a customer's file, and five copies of the same price quietly drifting apart.
Technical Audit & E-Commerce Hardening
Focused audit + remediation (36 files, 6 commits)
Solo Full Stack Developer — Audit, Backend & Conversion Systems
The business problem
The site looked complete: an Astro + React marketing site for a Las Vegas DTF gang-sheet and bulk-apparel printer, with a Cloudflare Worker order pipeline behind it handling file uploads, Turnstile verification, and Resend email. Underneath, the surface hid real drift. The homepage's service-category filter tabs clicked and did nothing. The order form's backend could silently fail to notify the shop of a new order while telling the customer everything succeeded. Bulk-shirt and DTF pricing existed as five independent hardcoded copies — including inside the site's own interactive pricing calculator — kept in sync only by hand. And five of nine service pages showed a visitor no price at all. The mandate was to find what the site's own logic disagreed with itself about, and fix it without a single dropped order on a site actively taking real customer files and payments.
Approach
- 01
Trace every interactive element back to its actual render path before trusting that a click does what it looks like it does — the dead homepage filter and a later upload race condition both only surfaced by tracing execution, not by reading the JSX.
- 02
Treat the order pipeline as the highest-stakes surface on the site: reproduce race conditions and pricing math in isolated scripts, diff old output against new, before a single line touches the live form.
- 03
Consolidate duplicated logic — pricing, FAQ content, structured data — into single sources of truth, since every one of them had already drifted at least once from being copied by hand.
What I built and changed
A Dead Filter and a Non-Hydrating Homepage
The homepage's service-category tabs and a hero search widget both looked interactive but weren't — the whole component was being server-rendered to a static HTML string with no client hydration, so every onClick and useState on the page was dead on arrival.
- Traced the dead click handler back through the render path and found the issue was structural — no hydration directive on the whole component — not a missing event listener.
- Rewired both the category filter and the hero search widget as plain DOM scripts operating on the same static markup, matching the page's actual render strategy instead of fighting it.
- Restructured the homepage from 13 stacked sections to 9, reordered the service catalog ahead of the pricing table, and fixed a mobile bug where a floating call button and a full-width quote bar were rendering on top of each other.
An Order Pipeline That Could Lose an Order Without Anyone Knowing
A full trace of the quote-and-upload flow — a Turnstile-gated React form to a Cloudflare Worker backed by R2 — surfaced four issues that only show up under real conditions, not a quick test.
- Found the Worker returned 200 OK even when the shop's own notification email failed to send, so an order could exist with nobody at the shop aware of it; added a second, customer-facing confirmation email and surfaced the failure state instead of masking it.
- Reproduced a submit-during-upload race condition in an isolated script, fixed the underlying promise handling, then reran the same script to confirm identical, correct behavior before touching the live form.
- Found the server attached whatever was left in temp storage to a finished order rather than the client's actual final file list, so a failed delete-on-remove call could ship a file the customer had explicitly removed; rewrote it to trust the client's list, with a path-prefix check against a tampered key.
- Added session-ID format validation across every endpoint that interpolated it into a storage key, closing a path-traversal-shaped input gap.
One Price, Not Five Copies of It
Bulk-shirt and DTF gang-sheet pricing existed as five independent hardcoded copies, including inside the site's own interactive pricing calculator.
- Consolidated the printed price table, the quote-page summary, the homepage teaser cards, and the Service schema price data into a single typed pricing module.
- Rewrote the calculator's own pricing math to read from that module instead of its own hardcoded tiers, then diffed old-vs-new output across the calculator's full input range before deploying — confirming byte-identical prices to what customers had already been quoted.
- Applied the same pattern to duplicated FAQ content, wiring FAQPage schema through from the same array already driving each page's visible accordion, closing a gap where two pages were shipping zero structured data at all.
Content and Component Drift
Two issues found during the audit rather than requested up front — a content bug and a systemic UI pattern, both closed in the same pass.
- Found a location page whose live heading read "What this Clark County page should do" — an internal planning note shipped as customer-facing copy — and rewrote it, along with a second page carrying a smaller version of the same bug.
- Diagnosed why every service page felt like a stack of identical boxes: four shared components each independently wrapped their entire section in a near-identical bordered card; replaced the section-level wrapper with plain spacing across all of them in one pass, keeping card styling only for the interactive calculator and for atomic list items within a section.
- Audited all nine service pages, found five with no visible pricing anywhere, and added the calculator, a hero pricing signal, and — where missing — a real customer-photo gallery to each, including a mis-tagged photo found sitting under the wrong category, invisible to the page it should have been promoting.
Business results
Fixed 4 order-pipeline bugs on a live site actively taking customer files and payments, each verified with a before/after reproduction rather than a visual check alone.
Consolidated 5 independent copies of pricing logic — including a live interactive calculator — into one source of truth, verified byte-identical against its prior output across the full input range before deploying.
Brought all 9 service pages to a consistent standard — working pricing, FAQ schema, a shared container system — replacing a pattern where every page had duplicated the same repeated card styling.
36 files changed across 6 focused commits, each one verified with a clean build from a fresh clone before pushing, not just the local working directory.
What the work proved
A calculator that quotes the right price today isn't the same as a calculator that's wired to the price list — this one had simply been kept in sync by hand, and nothing would have caught the next change. The FAQ content sitting right next to structured-data markup that never referenced it told the same story: working and correct aren't the same guarantee as connected, and the fix in both cases was the same — make the drift structurally impossible, not just currently absent.