Construction management — the model build-off

The one to copy. Nothing we tried to break came apart.

Best at

Treating confidentiality as a data model rather than a permission check. It builds a share register: each document, drawing or report is granted to a named party, and everything else is refused. All three subcontractors sit on the same project, so isolation cannot fall out of project membership — it has to be real, and it is. Tested in both directions with positive controls, it leaked nothing: each party opened every one of their own shares and got a not-found on every one of the others', a revoked share behaved exactly like a share that never existed, and of 416 files the subcontractor could read precisely the one behind her grant. Its export routes check staff status before they even read their parameters, which is what makes a refusal an authorization decision instead of an accident.

Watch for

Ten wrong passwords in under half a second with no lockout, no backoff, and the correct password accepted immediately afterwards — the failures are written to the audit log, so the observability was built and the control was not. It also carries a high-severity advisory in postcss, reached through the framework rather than its own code, for which the only remedy on offer is a major version bump.

Sign-in survives with JavaScript switched off. Almost nothing else does.

Best at

The entry point, and the shape of its permissions. Its sign-in form is a real form — a POST with named fields — so it works with scripting entirely disabled, and the route refuses the unsafe verb outright. We proved it by submitting the form with the framework bypassed: signed in, no credential anywhere in the address or the referrer. Its permissions are a gradient rather than a switch: the project manager sees four tasks, the supervisor three, the subcontractor exactly the one that is theirs, and cost, estimating and procurement are closed to the subcontractor and the owner alike. Best of all, the highest-sounding role is not a superset — the project manager is refused the owner's records screen. Accounts are default-deny: with no password supplied for a role, that account does not exist rather than existing with a default.

Watch for

The evidence does not reproduce. Its own run reports 132 of 133 checks passing; the same suite on a clean build with setup completed gives us 24 passing and 108 failing, and a second attempt with its QA mode enabled changed nothing. It is not a fake suite — 410 live requests drive it — and it is not hiding product defects, because the type check, the lint, the build and the dependency audit are all clean and everything we drove by hand behaved. The checks simply depend on data the original build session accumulated, so nobody else can re-derive the result. For a build sold on guarded verification, that is the property being sold.Fixed since audit — it also shipped a document declaring itself rejected by six of six reviewers, including a finding that the sign-in form leaked a credential into the address bar. The timestamps show that report was written before the repair landed twenty-eight minutes later. We tested all three of its claims and none survived: the credential path is closed at both layers, the hidden setup export is role-checked, and cross-project access returns not-found for every role but the project manager.

Strongest separation between customers, and the leanest thing here by far.

Best at

Keeping one customer's data away from another's, and being able to prove it. It is the only build of the four that seeds a second construction company on purpose so the separation can be demonstrated rather than asserted — and it holds on every route we drove, with the second company's project manager seeing only their own portfolio. It is also the leanest product in the programme: one production dependency in the entire application, no framework, and nothing for a future advisory to land on. Its verification is the best-designed of the four on paper, with a genuine severity spread and no two checks sharing a description.

Watch for

Two things, and the second is the reason for the placing. Its demo buttons hand any visitor a project-manager session, and while that is clearly labelled and sits beside a real password login, there is no setting anywhere in the application that turns it off — a buyer would have to edit the source. And its verification covers step one of sixteen: of the forty-three checks it declares, fifteen were never written at all, so the run that certifies a finished build is a first-step subset.Fixed since audit — both were repaired against our findings and re-verified, and it was rescored 84 → 93. Demo access now defaults to off, the route returns not-found and the buttons stop rendering, while password sign-in keeps working. Offered the choice of implementing the fifteen missing checks or deleting them and correcting the completion claim, it implemented them — its reasoning, that deleting them would have made the completion claim dishonest, was right. Our own independent run of the full suite now passes thirty-four with nothing failing and nothing pending, and the custody-sealed manifest is byte-identical to the copy we took before the audit.

The richest domain model here, with the confidentiality left out of it.

Best at

Modelling the actual work. Twenty tables with real fields, cost codes that connect an estimate to a commitment to an actual, and genuine construction structure — work breakdown codes with critical-path flags, sheet numbers with disciplines and revisions, submittal and RFI registers that route. Its foundations are sound too: every unauthenticated request is refused across eighteen surfaces, sessions revoke properly on sign-out, forged tokens are rejected, and every write is correctly closed to the roles that should not have it. The company filter is bound into the SQL rather than applied afterwards, which is the right way round.

Watch for

It guards verbs and forgets nouns. Of forty-six role checks, forty-five protect a write and exactly one protects a read — so every other list hands the full company dataset to whoever asks. A trade subcontractor reads every rival's contract value and the total committed across the job. The one table it did protect leaks anyway through its own CSV export, which carries no role check at all, and hands over the contingency the contractor is holding on that sub's own scope. Compounding it, all ten seeded accounts share one company, including subcontractors from two competing firms — so the only separation the app implements separates nobody.Fixed since audit — a repair pass built a real party model with per-company scoping and was re-verified: rival subcontractors can no longer see each other's purchase orders, the export now matches the screen exactly, the public enquiry page no longer leaks internal reviewer notes, and mobile overflow is gone. It was rescored 74 → 82 rather than higher because the owner role is still unscoped on every surface, five routes never received the fix, and the security change introduced a new fault that returns a server error to the application's own front end on any port but two.