Impact Data Hub: Build, Audit, Harden

Small nonprofits sit on impact data — outcomes, demographics, program results — that they need to report to funders but can't easily analyze. The organizations that most need data insight are the least able to afford a data team. They end up wrestling with spreadsheets and stacks of files when what they need is a way to ask plain-English questions and get real answers.

A full-stack data platform where nonprofit staff upload their program data and ask natural-language questions about it. The app returns cited answers drawn from their own documents and datasets, so staff can pull funder-ready insights without touching a formula or writing a query.

Core stack: React, Express, Drizzle ORM, PostgreSQL. Claude API powers the document Q&A layer. Built and deployed on Replit.

This is the part that matters most.

I ran a full MCP-powered security audit against my own audit checklist. The initial score came back B−. Two high-severity findings:

JWT exposed in the login response body — the token was being returned in a way that made it accessible to client-side scripts beyond what was necessary

No rate limit on the RAG chat endpoint — the single most expensive route in the app, wide open to abuse

Several medium-severity findings followed, including AI conversations that weren't scoped per user, meaning one user's chat context could theoretically leak into another's session.

All findings were remediated, then re-verified. Seventeen discrepancies closed across security, data integrity, and credential hygiene. The app went from B− to deployment-ready through repeated audit cycles.

Deployment-ready and in pilot outreach to nonprofit organizations. The platform was hardened specifically so it could be handed to real users with confidence.

This project is the process I sell as a service. The same audit methodology, the same MCP-powered checklist, the same severity-rated findings with file-and-line remediation guidance. The difference is I apply it to your codebase instead of mine.