One Public Form Did Not Make the Rest of GraphQL Public
A bounded landing route and exact public-field policy connected demo requests to storage, with local throttles and explicit no-storage paths.
Reviewed by Dmytro Nasyrov on October 27, 2026.
Our landing form originally validated a demo request and stored nothing.
Connecting it to the backend created the product's first deliberately public write operation. The important change was not the success message; it was making that one unauthenticated operation possible without opening the surrounding API.
I contributed to the landing route and backend. My work also covered the restricted admin workspace for managing requests. The merged frontend record and the checked implementation support this engineering case, not a claim that the form is immune to abuse or satisfies every privacy regime.
Public was a field-level decision
The access policy names submitDemoRequest as public. The admin's list, counts and update fields remain restricted to a super administrator, and other unauthenticated operations remain refused. Allowing a browser to reach the gateway is not the same decision as allowing its selected GraphQL field to execute.
Requests from the landing reach its own route, which forwards server to server. The backend address is read from server runtime configuration for each request. It is not a public build-time browser variable. That preserves one request boundary where the form's origin, size and result mapping can be inspected.
Bound the request before parsing it
The route first checks the origin and applies its per-address throttle. It reads a bounded body before parsing JSON, rejecting one over 16 KB. A browser disconnect while sending the body is a different failure from invalid JSON or a backend timeout.
On the backend, the application validates the fields again. The implementation normalizes text, counts Unicode code points and refuses unsafe control characters. Text is stored as text and rendered as React text nodes in the table, phone cards and detail sheet. A stored script-shaped string must remain a string rather than acquire an HTML interpretation.
| Boundary | Recorded response or behavior |
|---|---|
| Wrong origin | 403 before forwarding |
| Body exceeds 16 KB | 413 before JSON parsing |
| Invalid form fields | 400; known field can be named without its value |
| Throttle exhausted | 429 |
| Upstream refuses the operation | 502 |
| Upstream unavailable or timed out | 503 |
| Accepted submission | 204 with no-store |
A successful answer does not always mean a stored row
A filled honeypot deliberately returns success without storing a request. In non-production development with no backend address, the route also validates and returns success while recording that the request was dropped. Those paths mean that success cannot be used as an unqualified storage receipt in a test.
The final implementation narrowed the dangerous configuration case: no backend address in production returns unavailable instead of a false confirmation. A malformed address also returns unavailable. This final behavior matters more than the early specification's broader missing-address shortcut. An integration control therefore inspects a backend row as well as the browser confirmation. The honeypot control expects the same outward success shape with no row. Their difference is intentional, and a test asserting only the confirmation cannot distinguish them.
Local throttles have local guarantees
By default, the landing allowed five requests per IP per hour. The recorded backend defaults were three per email per day and a global cap of 200 per hour. The implementation keeps these limits in memory per process or replica. They are not a distributed quota shared across an arbitrary deployment.
The backend reserves an email slot atomically before checking the global cap. If the global limit refuses the request, that email slot is returned. If the later database insert fails, the service releases both reservations so a genuine retry is not charged for a failed write.
validate submission
reserve email and global slots
try:
insert request
except write_failure:
release reserved slots
propagate failureThis handles concurrency inside the checked replica. It does not provide submission idempotency after an ambiguous network failure: a request may have been stored even if the caller did not receive the answer. Nor does it turn a honeypot into proof that automated traffic has been eliminated.
Keep the operational record small
The staff workspace stores status, an internal note and the identity and time of the last change. The public path never exposes the admin's reads or update operation. Audit messages describe outcomes and request identifiers rather than logging the submitted field values; the visitor's raw IP is not stored as part of the request record.
Deletion, mail notifications and CSV export were excluded from this release. A confirmation that the team will contact a visitor does not imply an implemented notification service. An export added later would also introduce a new interpretation boundary for spreadsheet cells.
To inspect this public write operation, start with the exact public-field allowlist and bounded-body handler. Then follow the reservation-release paths. We have not run a new penetration test or the product's integration suites for this article.
FAQ
Quick answers to common questions about custom software development, pricing, process and technology.
Type to filter questions and answers. Use Topic to narrow the list.
Showing all 14
No matches
Try a different keyword, change the topic or clear filters
-
How long have you been in business?
Pharos Production has been in business since 2013, with over 13 years of experience in custom software development. During this time, we have delivered over 110 applications for 200+ clients across 28 industries, including FinTech, healthcare, crypto and e-commerce. We are rated 5/5 on Clutch based on 107 verified reviews (2026).
-
What services do you provide?
Pharos Production provides six core service categories: AI Development (LLM applications, AI agents, machine learning and computer vision), Blockchain and Web3 (smart contracts, DeFi, tokenization on Ethereum, Solana, TON and other chains), FinTech Development (payment platforms, digital banking, KYC and AML integration), Software Development (mobile apps, web platforms, database design, UI/UX), Security and QA (code audits, penetration testing, smart contract audits, manual and automated testing) and Consulting (architecture design, MVP validation, startup consulting).
-
Where is Pharos Production located?
Pharos Production is headquartered in Las Vegas, Nevada, USA (5348 Vegas Dr, Las Vegas, NV 89108), with an engineering office in Kyiv, Ukraine (44-B Eugene Konovalets Str. Suite 201, Kyiv 01133). We work with clients worldwide and provide remote collaboration across all time zones. Visit our contact page for directions and scheduling options.
-
How big is your team?
Pharos Production has a team of 90+ engineers, including software developers, blockchain specialists, QA engineers, DevOps experts, UI/UX designers, project managers and solution architects. Our founder, Dr. Dmytro Nasyrov, holds a PhD in Artificial Intelligence and leads the technical direction of all projects.
-
What types of customers do you serve?
We serve a wide range of clients, from startups and product companies to mid-sized enterprises and large institutions. Our clients include crypto exchanges, FinTech providers (like Pleenk), healthcare organizations, sportsbook operators (like Pro Gambling), e-commerce platforms and SaaS companies. Pharos Production has worked with 200+ clients across 28 industries since 2013, adapting engagement models to match each client's stage, whether it is MVP validation for a startup or enterprise-scale development for an established business.
-
How is a custom software development company different from an agency?
A custom software development company like Pharos Production assigns one dedicated engineering team that owns your product across multiple release cycles, instead of handing it off once a contract ends. Agencies more often rotate staff between clients and optimize for fast delivery over long-term product ownership.
Pharos Production keeps the same team on your codebase through 2-week sprints, so there is no re-onboarding cost each time you request a new feature.
-
How much does custom software development cost?
Custom software development costs vary based on project scope and complexity. At Pharos Production, typical project ranges are: MVP development ($10,000-$25,000), suitable for startups validating a product idea; full-fledged production ($25,000-$50,000), for established businesses scaling a proven concept; and full-cycle development ($50,000-$80,000+), for complex enterprise-grade systems. These ranges include architecture design, development, QA testing and deployment. Hourly rates range from $50 to $99 depending on role and seniority. Final pricing depends on technology stack, number of integrations and engagement model (staff augmentation, dedicated team or project outsourcing).
-
How long does it take to develop a custom software application?
Development timelines depend on scope and complexity. At Pharos Production, a typical MVP takes 2-4 months, a production-ready application takes 4-8 months and a complex enterprise system can take 8-12+ months. We use an agile methodology with 2-week sprints, delivering working increments after each sprint. Every sprint includes a retrospective, progress report and planning session for the next iteration. This approach ensures transparency and allows businesses to launch faster by prioritizing high-impact features first. Get a timeline estimate for your project.
-
What industries does Pharos Production serve?
Pharos Production serves 28 industries: FinTech, MiCA Compliance, Banking, Insurance, Crypto, Healthcare, Fitness, E-Commerce, Food & Restaurant, On-Demand, Manufacturing, Automotive, Energy, Oil & Gas, Supply Chain, Construction, Real Estate, Gaming, Streaming, Media, Telecom, Education, Aviation, Travel, Logistics, Marketing, Agriculture and Recommender Systems. Our deepest expertise is in FinTech, blockchain and healthcare, where we have delivered compliance-ready platforms (HIPAA, PCI DSS, GDPR) and high-load systems handling thousands of concurrent users. For the latest industry insights, read our guides on FinTech trends in 2026 and the Web3 technology stack.
-
Why hire a software development company instead of building in-house?
Hiring a software development company offers faster time-to-market, lower upfront costs and access to specialized expertise without long-term employment commitments. According to Deloitte's 2024 Global Outsourcing Survey, 57% of companies outsource software development to access skills they cannot hire internally.
Factor In-house team Software development company Time to assemble 3-6 months (recruiting + onboarding) 1-2 weeks Upfront cost High (salaries, benefits, equipment) Lower (project-based pricing) Specialized expertise Limited to who you can hire locally Access to 90+ engineers across blockchain, AI, FinTech Scalability Slow (each new hire takes months) Fast (scale up or down per sprint) Long-term commitment Full-time employment contracts Flexible engagement models Risk High if key engineers leave Company ensures continuity and knowledge transfer For businesses that need blockchain, AI or high-load architecture expertise, outsourcing to a specialized firm like Pharos Production reduces risk and accelerates delivery.
-
What projects does Pharos Production not take on?
Pharos Production focuses on mid-to-large custom software projects with budgets starting at $10,000. We do not take on template-based websites, WordPress theme customization or short-term contracts under one month. We also do not provide non-technical staffing (marketing, sales or design-only roles). Our strongest fit is blockchain, FinTech and healthcare projects where security, compliance and high-load architecture are critical. For smaller projects or MVPs under $10,000, we recommend exploring freelance platforms or no-code tools as a more cost-effective starting point.
-
Why does Pharos Production use agile methodology?
We use agile with 2-week sprints because it reduces the risk of building features that miss the mark. Each sprint ends with a working demo, a retrospective and a plan for the next iteration.
This means clients see progress every 14 days and can adjust priorities based on real results, not assumptions. We chose this approach after years of experience showing that rigid, fixed-scope contracts lead to scope creep, missed deadlines and products that do not match market needs by launch day.
-
When should you NOT hire a custom software development company?
Custom development is not the right choice in every situation. You should not hire a custom software company if: your problem is fully solved by an existing SaaS product (e.g. Shopify for e-commerce, Salesforce for CRM); your budget is under $10,000 and timeline is under 4 weeks; you need a simple landing page or marketing website (WordPress or Webflow is faster and cheaper); or you are still validating the idea and have not spoken to potential users yet.
In these cases, off-the-shelf tools or no-code platforms offer better ROI. Custom development makes sense when you need unique workflows, regulatory compliance, high-load architecture or competitive differentiation that packaged software cannot provide.
-
What kind of projects has Pharos Production delivered?
Here are three anonymized examples from our recent delivery history:
FinTech startup - payment platform (MVP)
Scope: mobile app + backend API with bank-grade encryption. Team: 4 engineers, 1 QA. Timeline: 10 weeks. Budget: $38,000. Result: launched on schedule, processed $2M+ in transactions within the first quarter.Healthcare provider - patient portal (Full product)
Scope: HIPAA-aligned web platform with EHR integration, appointment scheduling and telemedicine. Team: 6 engineers, 1 DevOps, 2 QA. Timeline: 6 months. Budget: $120,000. Result: 15,000+ active patients, zero compliance violations in two annual audits.Crypto exchange - trading engine (Complex)
Scope: high-load matching engine handling 50,000+ orders per second, multi-chain wallet infrastructure on Ethereum and Solana. Team: 8 engineers, 2 QA, 1 security auditor. Timeline: 11 months. Budget: $340,000. Result: 99.97% uptime, passed three independent security audits.See more projects: NoMoreBets, Pulse, Sagas, Gambit Stream and Pleenk. For the full portfolio, visit our case studies. Learn more about the technology behind these projects in our guide to stablecoins and crypto infrastructure.
Stas Rysin is the Lead Frontend Developer at Pharos Production. His work covers the design system, reader interfaces and administration workflows of a professional learning platform for aesthetic medicine.
