Overview
At a senior-healthcare company, I went beyond writing plans and built and ran internal data products myself. Every product handled live production data, so each had to be both “fast” and “safe.”
Problem
With no development resources assigned, I had to build and run several internal data products alone, as a non-developer. And because the internal tools accessed the live sales database, a single security failure was a risk to the whole company.
Approach
For each product, I recorded “deliberate simplification” as an explicit design decision (static deployment, no JS, a cost of KRW 0, accepting free-tier limits). Rather than relying on gut feel for security, I adopted a 47-item public-sector security checklist and the OWASP Top 10 checklist as external pass criteria, and automated quality checks with verification scripts to eliminate “rules people have to remember.” For non-developer users, I replaced abbreviations like YoY and ROAS with plain Korean throughout.
Results
① Sales dashboard — Next.js 16 + Supabase + Vercel, deployed and stabilized in 35 commits, with automated Slack delivery (pg_cron). The 7-step security model in its README was adopted as the company’s standard reference for internal tools. ② New business discovery pipeline — 9 agent skills, 39 runs, about 1,950 items, and a 100-point scoring rubric. ③ AI stock-debate podcast — a 3-role debate (moderator, buy side, sell side) → TTS, with v0.1 deployed the day after the request. ④ Multi-scene ad generation pipeline. ⑤ Automated local meeting transcription and daily work sync (Python, faster-whisper). I built all 5 on my own, and in September I put the discovery pipeline on hold because its items weren’t being used.
Lessons Learned
Scripts do the verification; documents do the simplification. Free-tier limits aren’t something to work around but an input to the design. One piece of feedback our CEO kept repeating became a guideline: “If an external submission looks AI-generated, it backfires.”