Two months ago, a non-technical founder reached out to our engineering team at EnactOn.
He had hired an agency on a freelance marketplace to build a multi-tenant booking platform. The agreed contract was $800 with a promised delivery of 21 days. On day 22, the contractors delivered a zipped archive, collected their final milestone payment, and marked the project complete.
On the surface, the application looked finished. The UI was responsive and used a polished Tailwind dashboard theme.
The moment he invited 15 local business owners to test the beta, the wheels came off:
- Competitors could see each other's financial invoices by changing the company ID number in the browser URL.
- Credit cards were charged, but booking records vanished whenever a user closed their browser tab before the confirmation screen finished loading.
- With only 30 active users testing the calendar, page loads crawled to 4.2 seconds because the database had zero table indexes.
- There was not a single automated integration test or database migration script in the repository.
- The founder paid us $6,000 to audit the codebase and make it work in production.
Here is the breakdown of what actually failed, where the rescue budget went, and what to verify before accepting a budget quote.
The Illusion of the Finished Frontend
When evaluating software, non-technical founders judge what they can see. If buttons click, modal windows open, and the layout looks clean on mobile, they assume the heavy engineering is done.
Low-cost agencies understand this dynamic. They spend almost all their billable hours skinning frontend templates, while skipping foundational backend architecture.
1. Authentication as a Client-Side Illusion
The agency verified user permissions by reading a flag in local storage. The backend accepted any incoming request and fetched records without verifying if the requesting user actually belonged to that organization. Overlooking server-side permission checks is among the most severe mistakes to avoid before developing your MVP, because tenant validation must always happen at the database query boundary.
2. Fragile Payment Architecture
Stripe payments were handled entirely on the client side. If a mobile user lost internet connection after submitting their card, Stripe processed the charge, but the backend never received the trigger to create the booking. Reliable financial transactions require server-verified asynchronous webhooks with idempotency keys rather than relying on browser redirects.
3. Unindexed Full-Table Scans
The database contained 14 tables with zero composite indexes on foreign keys. Simple calendar queries forced the database to scan thousands of rows sequentially, pinning CPU usage to 100%.
Where the $6,000 Rebuild Budget Went
Rescuing broken software is almost always slower and more expensive than building it clean from scratch. Our team had to reverse-engineer undocumented assumptions, patch security holes, and migrate tables without losing existing test data.
Here is the exact breakdown of the 80 hours required to stabilize the system:
- Security & Tenant Isolation (24 hrs - $1,800): Enforced session-bound tenant validation across 18 API routes so no organization could view another's data.
- Payment & Webhook Reliability (18 hrs - $1,350): Rebuilt the checkout pipeline with server-side webhook signature verification and database idempotency to eliminate ghost charges.
- Database Optimization (14 hrs - $1,050): Created structured migration scripts, added composite indexes, and resolved table-locking bottlenecks (reducing response latency from 4,200ms down to 38ms).
- Automated Integration Tests (16 hrs - $1,200): Wrote 42 end-to-end tests covering authentication, payments, and calendar scheduling following a structured mobile app testing checklist.
- Production CI/CD & Deployment (8 hrs - $600): Automated container builds and secret management aligned with standard DevOps best practices for startups.
The Takeaway
An $800 quote for a full-stack SaaS is an uncollateralized loan with high interest that comes due during launch week. Estimating the realistic cost to build an MVP requires evaluating database design and transaction integrity, not just UI components.
Before signing off on any MVP development contract, ask for three specific deliverables:
1. Version-controlled database migrations instead of raw database dumps.
2. Server-enforced tenant isolation on all database queries.
3. Automated integration tests for authentication and payment flows.
