Software Takeover & Maintenance
Full ownership of your MVP portal — maintenance, performance optimization, and continuous feature development.
Overview
Webisoft proposes to take full ownership of Tamarack Defense's MVP portal — currently built on React, TypeScript, Django 5.2, and Python — providing long-term maintenance, performance optimization, and continuous feature development.
This engagement replaces the current single-developer dependency with a stable, onshore Canadian engineering team of ~40 people with deep Django and React expertise.
Scope of Engagement
Onboarding & Takeover
- NDA execution and codebase access
- Full code review and architecture assessment
- Developer knowledge transfer and documentation
- Performance audit and optimization (targeting the 4–5M row load latency issue, currently 5–10s)
- Parallel collaboration with existing freelance developer during handoff
- Delivery of internal technical documentation
Ongoing Maintenance & Development
- Primary point of ownership for the portal
- SLA coverage for bug fixes and critical updates
- Continuous improvements drawn from monthly development hour bank
- Quarterly roadmap reviews aligned with product priorities
Pricing
One-Time Onboarding Fee
Covers codebase review, architecture documentation, knowledge transfer, and initial performance optimization sprint.
Monthly Retainer
| Item | Detail | Cost |
|---|---|---|
| Base Retainer | Maintenance, SLA coverage & monitoring | $2,000/mo |
| Included Dev Hours | 8 hrs/month @ no additional charge | Included |
| Additional Hours | Discounted retainer rate | $110/hr $125 |
| Unused Hours | Roll over after 3 months | — |
Key Differentiators
Onshore Canadian Team
All engineering based in Montreal — no offshore risk, same timezone, same standards.
Exact Stack Match
React + Django expertise at the CTO and senior dev level. No learning curve.
Proven B2B Portal Experience
Dashboards, data-heavy platforms, government sector (RCMP asset seizure tool).
Performance Track Record
Experience resolving similar high-volume data load issues in production environments.
Flexible Model
Hour bank rolls over. Pricing adjusts as scope evolves. No lock-in.
Security-First Mindset
Immediate attention to hardcoded secrets, exposed keys, and auth vulnerabilities.
Codebase Evaluation: TDGUI
A full-stack defense analytics platform (Django 5.2 + React 18 + PostgreSQL) for tracking military platforms, budgets, and subsystems.
| Area | Rating | Key Issues |
|---|---|---|
| Architecture | 7/10 | Well-structured, but monolithic files |
| Code Quality | 5/10 | Broad exceptions, debug prints, no typing |
| Security | 3/10 | Secrets in code, no rate limiting |
| Testing | 2/10 | Only 76 lines of tests in entire project |
| Error Handling | 4/10 | 40+ bare except Exception: blocks |
| Performance | 7/10 | Good indexing/rollups, but no caching strategy |
| Dependencies | 8/10 | All current, no known CVEs |
Critical Security Issues
These must be addressed immediately — they represent active risk in production.
Improvement Roadmap
Security (do now)
- Move all secrets to environment variables (SECRET_KEY, DB creds, API URLs)
- Remove certbot private keys from git history (BFG)
- Restrict ALLOWED_HOSTS to actual domains
- Add rate limiting middleware (django-ratelimit)
Code Quality
- Split monolithic files: subsystem_views.py (2,043 lines), views.py (1,709 lines), models.py (1,087 lines)
- Replace 30+ print() statements in utils.py with Python logging module
- Remove 20+ console.log() calls in React components
- Replace bare except Exception: with specific types across 40+ occurrences
Testing
- Only users/tests.py exists (10 test cases) — zero API, React, or integration tests
- Add coverage for: auth flows, data filtering, Excel imports, permission checks
- Set up CI/CD pipeline
Frontend
- Add PropTypes or TypeScript for component type safety
- Extract magic numbers into constants
- Add error boundaries and retry logic for API calls
- Implement lazy loading for page components
Operations
- Create .env.example for onboarding
- Reduce DATA_UPLOAD_MAX_MEMORY_SIZE from 10GB (abuse vector)
- Reduce Celery worker memory cap from 12GB
- Extend GET request cache TTL beyond 500ms
- Remove commented-out AWS S3 code in utils.py:156-170
What's Done Well
The biggest wins would be fixing the security issues (hardcoded secrets, exposed keys) and adding test coverage — those are the highest risk-to-effort improvements.
Next Steps
Next Steps
- 1. Sign letter of engagement
- 2. Schedule the knowledge transfer and kick off the takeover
This proposal is valid for 30 days from the date of issue. Pricing is subject to change after the validity period.
WBSFT®
Prepared by Webisoft for Tamarack Defense · March 2026