About the client
By mid-2025, the engineering team had accumulated meaningful technical debt: the codebase had grown without consistent quality controls, the Git workflow relied on direct pushes to main without reviews or security gates, and the infrastructure — running on a self-hosted Kubernetes cluster — lacked modern tooling for CI/CD, artifact management, and incident monitoring. There was also no formal process for catching security vulnerabilities before they reached production.
Neotecnica engaged WWG to conduct a comprehensive technical audit of all four repositories, restructure their development and deployment workflows, harden their infrastructure security posture, and assess the AFM backend’s readiness for cloud migration — all with the goal of reducing risk and establishing a scalable foundation for future product growth.
Challenge
- Technical Debt Across Four Heterogeneous Codebases. Neotecnica’s software stack spanned a React frontend application, a private React component library with a Storybook gallery, and a Java EE/Spring monolithic backend — each with its own dependency tree, linting configuration, and vulnerability surface. Conducting a meaningful audit across all four required coordinated tooling and the ability to interpret findings in the context of each codebase’s role in the overall system.
- A Git Workflow Without Safety Nets. All Neotecnica repositories operated without branch protection. Feature branches — some long-lived enough to function as de facto beta versions — were merged directly without pull requests, code reviews, or CI checks. This meant unreviewed and untested code could reach production at any time, and rollbacks were operationally difficult due to the absence of consistent tagging or versioning conventions.
- Infrastructure Without Modern CI/CD or Observability. The existing Kubernetes cluster was running on an outdated certificate configuration, lacked high-availability control-plane redundancy, and had no CI/CD orchestration beyond a rudimentary Jenkins build. There was no artifact repository for managing private NPM packages and Maven builds, no centralised alerting for cluster or application health, and no on-call routing for incidents.
- A Monolithic Backend Approaching Architectural Limits. The AFM backend presented structural challenges that went beyond code quality. Tightly coupled frontend/backend layers, hardcoded credentials and configuration values, manual thread management, embedded SQL, and a general absence of modular service boundaries made the system difficult to test, maintain, and extend. A cloud migration was under consideration, but there was no clear readiness assessment or phased strategy to guide it.
Have some question?
Let’s meet and talk.
Solution
WWG delivered the engagement across four parallel workstreams, structured to produce both immediate risk reduction and a clear roadmap for longer-term modernisation.
Codebase Audit: Security, Dependencies, and Code QualityWWG ran a complete audit across all four repositories using a consistent multi-tool methodology. Each codebase was assessed for:
- Security vulnerabilities — npm audit and osv-scanner surfaced 19+ issues across the frontend and component library, including high-severity CVEs in core dependencies and a confirmed ReDoS vulnerability affecting three separate repositories
- Dependency health — npm-check and depcheck identified unused packages accumulating as dead weight and dozens of packages behind by one or more major versions
- Code quality — ESLint surfaced approximately 9,000 issues in the React frontend and over 4,000 in Component library, primarily no-undef violations, unused variables, and @typescript-eslint/no-explicit-any usage
- Java backend — SonarQube analysis of the codebase identified hardcoded credentials, catch-all exception blocks, manual SQL, commented-out code blocks, and large tightly-coupled classes as the primary maintainability risks.
Each audit was delivered as a structured report with a per-area severity classification and a prioritised remediation roadmap.
Git Workflow Audit and Branching Strategy RedesignWWG conducted a full audit of Neotecnica’s Git workflow across all repositories, documenting the risks of the current approach — unprotected main branches, direct merges from long-lived feature branches, absence of PR-based code review, and no CI gate before production.
Two alternative branching strategies were evaluated in detail: GitHub Flow (optimised for frequent deployment cycles) and Trunk-Based Development (optimised for minimising merge conflicts via short-lived branches and feature flags). For the private React component library, the assessment specifically addressed the challenge of long-running beta branches, which don’t fit neatly into either standard model. A concrete implementation recommendation — including branch protection rules, PR templates, and CI integration checkpoints — was delivered alongside the audit findings.checkpoints — was delivered alongside the audit findings.
A technical assessment of the AFM backend was produced, documenting its current architectural limitations and proposing a phased migration strategy: short-term Dockerisation and cloud VM deployment (AWS EC2/ECS) with Oracle DB migration to RDS; long-term replatforming to Spring Boot microservices, PostgreSQL, and Kubernetes with full observability (Prometheus, Grafana, ELK).
To support the development team going forward, WWG produced two standards documents: Backend Coding Conventions and Modular Architecture Standards (covering Java naming conventions, layered architecture, Spring Security, testing targets, and SonarQube integration), and Professional Guidelines for Creating a React NPM Package (covering build configuration, tree-shaking, peer dependencies, and dual CJS/ESM output).
WWG restructured the Neotecnica Kubernetes clusters from the ground up for high availability and modern CI/CD support:
- HA with 3 control-plane nodes and dedicated worker node groups based on their workloads.
- Rancher installation and configuration as the cluster management UI, enabling workload visibility and operational control without the need of CLI knowledge.
- Jenkins installation with Kubernetes-native agents — pipelines run with ephemeral pods, eliminating the need for persistent agents on VMs.
- Nexus Artifact Repository deployed for hosting private NPM packages (replacing git submodules) and Maven build artifacts.
WWG conducted CIS Benchmark assessments for servers running such supplementary services as the Keycloak identity server and the OpenVPN server, producing detailed results reports against the applicable security benchmarks. OpenVPN server was also set up for remote team access with per-user configuration files and PKI backup management.
Technology Stack
Security vulnerability scanning across all JavaScript/TypeScript repositories — CVE identification and severity classification
SonarQube
Static analysis for the Java AFM backend — code smells, security issues, maintainability scoring
Rancher
Kubernetes management UI — workload visibility, node management, and operational control
Nexus Artifact Repository
Private artifact hosting for NPM packages and Maven builds, replacing git submodules
PagerDuty + Healthchecks.io
Incident management with MS Teams integration, on-call scheduling, and escalation policy configuration
Code quality, unused dependency detection, and package version health across React and component library codebases
MicroK8s on VMware
Self-hosted Kubernetes cluster, restructured for HA with 3 control-plane nodes and worker node groups
Jenkins with Kubernetes agents
CI/CD pipeline orchestration with ephemeral pod agents; GitHub App authentication and Shared Library pattern with reusable templates
Keycloak + OpenVPN
Identity and access management; per-user VPN rules and PKI backup; CIS Benchmark hardening applied to both servers;
AWS (EC2, ECS, RDS)
Target cloud infrastructure proposed in the AFM migration roadmap for short- and long-term deployment phases
Key Technical Challenges
Each of the four codebases operated with a different configuration baseline — different ESLint rule sets, different package managers, different build systems. Standardising the audit methodology across all of them without modifying their existing configurations required careful tool selection and result interpretation. In particular, distinguishing ESLint issues that were configuration artifacts (e.g., rules flagging intentionally dynamic patterns) from genuine technical debt required code-level review alongside automated output.
The component library repository had developed a branching pattern where a feature branch had effectively become a long-running beta version branch. Neither GitHub Flow nor Trunk-Based Development handles this pattern cleanly out of the box — GitHub Flow discourages branches lasting more than a week, and Trunk-Based Development requires feature flags for unfinished work. WWG’s Git audit addressed this specifically, providing a hybrid recommendation that acknowledged the library’s versioning needs without forcing a workflow that would create friction for the team.
Neotecnica’s three main repositories — a React application, a private NPM library, and a Java Maven backend — have meaningfully different CI/CD requirements. A React app requires a standardized workflow for quality checks and automated delivery. An NPM library needs automated versioning and secure artifact management for distribution. A Maven backend requires a complex build process, including containerization and deployment to a private registry. WWG designed example pipelines for all three types, using Jenkins Shared Libraries to extract reusable template logic — reducing duplication and ensuring the Neotecnica team had working references rather than abstract guidance.
Both the Keycloak server and the OpenVPN server were alive and in active use during the engagement. CIS Benchmark assessments and hardening required identifying which recommendations could be applied immediately and which required planned maintenance windows.
Results
- Full Technical Picture Across All Four Repositories
Every codebase was audited with consistent tooling, producing structured reports with severity-classified findings and prioritised remediation roadmaps — giving the Neotecnica team actionable visibility into their security and quality debt for the first time. - 19+ Security Vulnerabilities Documented with Fix Paths
All critical and high-severity CVEs were identified, attributed to specific packages, and paired with concrete remediation steps — including version targets, migration alternatives, and CI enforcement recommendations to prevent regression. - High-Availability Kubernetes Cluster Operational
The MicroK8s cluster was restructured with a 3-node HA control plane, Rancher management, Jenkins with Kubernetes-native agents, and Nexus artifact hosting — replacing a fragile single-node setup with a production-ready delivery infrastructure. - Real-Time Incident Monitoring with On-Call Routing
PagerDuty and Healthchecks.io were configured and integrated with Microsoft Teams, giving the engineering team structured incident management with escalation policies, on-call scheduling, and per-responder notification routing.
Conclusion
WWG approached each workstream with the same methodology: assess the current state accurately, understand the business and operational context, and deliver recommendations and implementations that the team can actually act on.
The outcome is a codebase with full visibility into its risk surface, an infrastructure ready for modern CI/CD delivery, and a development team equipped with the standards and tooling to maintain quality as the platform continues to grow.
