WardroNest — An In-Browser 3D Wardrobe Configurator, Rebuilt and Hardened

A note on what this is. WardroNest is our own demonstration build, not a client engagement. The underlying product was built in 2024 as Schrankdesign, a German-language made-to-measure wardrobe and cabinet storefront. In 2026 we took the codebase back in hand as an internal showcase: rebranded it to WardroNest, translated the interface from German to English, put it through a full code review, and closed the findings. It is published as a portfolio demo and is deliberately blocked from search engines and AI crawlers by robots rules and page metadata.

The product

Buying a fitted wardrobe means specifying it, and specifying it in a form is miserable. So the storefront is built around a live 3D configurator: the customer assembles the piece visually and sees it change as they choose.

• Per-component configuration — doors, drawers, edges, feet, fittings, handles, plates and plate types each get their own panel, plus a running part list of everything the customer has selected.
• Material realism — PBR texture sets for woods, veneers, colours and floors, so a finish choice looks like the finish rather than a swatch.
• Sample ordering — dedicated pricing for physical material samples, because nobody commits to a wood finish from a screen.
• Checkout and admin — a validated checkout flow and an admin area for managing the component catalogue, categories, products, orders and pricing settings.

Architecture

A React and Vite front end drives the configurator. Behind it, a Node and Express API over MongoDB holds a model per component family — doors, drawers, feet, fittings, handles, plates, plate types, edges — alongside categories, products, orders, settings and part lists, with the pricing and sample-pricing logic living server-side. Authentication is JWT-based, uploads run through Multer, and the API is rate limited.

The 2026 review and hardening pass

Before publishing it we did what we would want done to our own production code: a full review, run as four independent passes over the codebase, consolidated into a single issues document holding 155 findings.

The remediation work that followed is the part we would point a client at. Order pricing was moved decisively server-side, so a price is always something the API computes rather than something a request supplies. Payment webhook handling was made signature-verified. Destructive database maintenance routes were brought behind authentication. Administrative middleware was reinstated everywhere it belonged. Payment handling was narrowed to a single well-understood provider — Stripe only, in USD — rather than three half-configured ones, on the principle that a payment path you cannot fully verify is worse than a payment path you do not offer. Front-end defects the review turned up were fixed alongside: navigation slugs, cart behaviour, configurator bugs and bundle configuration.

These were findings from a review of a codebase we had taken over, remediated before publication. We are showing the review and the fix, not an incident.