Spent today hardening the backend security for Intervale Mountain Lodge, a live vacation-rental system I've been building end-to-end. 🔒 What went in today: - Row-Level Security enabled across every database table — no direct access possible, only through authenticated server-side endpoints - Server-side rate limiting on the guest portal login — brute-force password attempts now auto-lock after 5 failed tries - Replaced a single shared guest password with a per-booking, auto-generated unique password system - Regenerated and re-secured backend service credentials - Full secrets audit across the frontend codebase — zero API keys, service-role keys, or tokens exposed client-side - Confirmed HTTPS enforced across every API call, no exceptions Security isn't glamorous, but it's the difference between a demo and something you can actually hand to a real client. No shortcuts on this layer. #WebSecurity #Supabase #BackendDevelopment #DataProtection #BuildInPublic #PropTech

Been building out a 3-workflow GHL + n8n system for a vacation rental client (Intervale Mountain Lodge). Today I finished Workflow 2: the Approve/Reject engine. Here's what it does now, live, with real money moving: → Owner gets an SMS the second someone submits a booking inquiry → He drags the card to "Approved" in GHL → n8n automatically pulls the real-time price from their pricing engine (Supabase), generates a GHL invoice, attaches a Stripe payment link, and texts + emails the guest — all in one shot → Card auto-moves to "Payment Pending" → If he rejects instead, guest gets a polite decline message and the opportunity is marked Lost Zero manual invoicing. Zero manual messaging. He just taps approve/reject. The unglamorous part (a.k.a. most of my day): GHL's API has some sharp edges that cost real debugging time — - Custom field data comes back in like 3 different shapes depending on whether you're reading a Contact vs an Opportunity - Webhook custom data gets nested under a customData key that isn't obvious from the docs - Their duplicate-opportunity protection looks like a bug until you realize it's a feature None of it was hard, just required actually reading real API responses instead of guessing — which is honestly 80% of building anything with a third-party CRM API. Tomorrow: Workflow 3 (payment confirmation → calendar lock), and I'm also going to try making the approval step reply-by-text instead of requiring him to open GHL at all — so he can just text back "approve [guest name]" and the whole chain fires automatically. Curious if anyone's done SMS-based approval flows like this before.

Just shipped a complete backend overhaul for Intervale Mountain Lodge, a 24-guest luxury property in New Hampshire — replacing a fully manual booking process with a real, automated system. What's live now: 🔹 Server-side pricing engine (Supabase) — calculates nightly rates, fees, and taxes instantly, with tamper-proof locked price snapshots 🔹 Real-time availability + two-way Airbnb calendar sync 🔹 Multi-step guest qualification form, feeding directly into the CRM 🔹 Password-protected Guest Portal — door codes, WiFi, house rules, all served securely from a live database, zero hardcoded data 🔹 CRM webhook pipeline — every inquiry now routes automatically into GoHighLevel for owner review 🔹 A price-lookup API powering automatic Stripe invoicing on approval 🔹 Full UI/UX redesign with smooth animations + a site-wide performance pass What used to be hours of manual phone calls and hand-calculated quotes per booking now runs end-to-end — accurate pricing in seconds, structured inquiries, and instant self-service access for confirmed guests. Next up: a 24/7 AI concierge trained on the property's full house-rules knowledge base. #WebDevelopment #Automation #Supabase #NoCode #PropTech #AI #BuildInPublic

My partner and I have been building an end-to-end booking system for a real client (Intervale Mountain Lodge), combining a custom website with a GHL-powered CRM backend. Wanted to share progress since it's been a solid case study in real-world automation. What my partner built ( @Malik Ahmed )(website side): - Real-time pricing engine — nightly rate, cleaning fee, pet fee, taxes, deposit, all calculated server-side - Two-way Airbnb calendar sync (live availability in both directions) - Multi-step guest qualification form, fully connected to the backend - Password-protected guest portal — door codes, WiFi, house rules, all served securely from the database - Full UI/UX redesign + performance optimization - CRM webhook connecting the site directly into GoHighLevel What I've been building (automation side, in n8n + GHL): ✅ Workflow 1 — New Inquiry → Owner Notification (done and live) Every time a guest submits an inquiry on the site, it automatically: - Creates/updates their contact in the CRM - Creates a new "booking opportunity" with all their stay details - Sends the property owner an SMS with a full summary — guest name, dates, group size, notes, email, and phone — so he can review inquiries the moment they come in Spent a good chunk of time debugging this one — token/location scoping issues, a hardcoded contact ID bug that was silently routing owner notifications to the wrong person, JSON parsing errors. Nothing glamorous, but the kind of stuff that actually breaks production automations if you don't catch it in testing. 🔄 What's next — Workflow 2: Approve/Reject Logic When the owner approves a booking: auto-generate an invoice, attach a Stripe payment link, send it to the guest, move the pipeline stage automatically. When he rejects it: send a polite decline message and mark it closed. 🔜 After that — Workflow 3: Payment Confirmation → Booking Locked Once payment clears: lock the dates on the calendar, confirm the booking with the guest, and it all syncs back to Airbnb automatically.

Just wrapped up a project I'm genuinely proud of: rebuilding the entire booking and guest-management system for Intervale Mountain Lodge ("The Beast"), a 24-guest luxury property in New Hampshire. The lodge owner was doing everything manually — phone screening every guest, calculating pricing by hand, texting Wi-Fi codes and house rules one guest at a time. We replaced that with a real, secure backend. What we built: 🔹 A server-side pricing engine (Supabase Edge Functions) that calculates exact quotes line-by-line — nightly rate, cleaning fee, pet fees, extra-guest charges, taxes — with a locked "price snapshot" so nothing can be tampered with client-side. 🔹 Live availability sync — real-time blocked dates pulled straight from the calendar, keeping Airbnb and the direct site in sync. 🔹 A multi-step qualification form that captures group details and routes every inquiry straight into the CRM for owner approval — no more manual phone screening. 🔹 A password-protected Guest Portal — confirmed guests unlock door codes, Wi-Fi, house rules, pet policy, hot tub instructions, and the cleaning checklist, all served securely from the database, never hardcoded in the frontend. 🔹 A full UI/UX pass — smooth animations, a cinematic guest-portal reveal, and a performance pass so the whole site feels fast and fluid. The result: what used to take hours of manual back-and-forth per booking now runs on autopilot, while the owner keeps full control over every approval. Excited for what's next — an AI voice/chat concierge is already being trained on the property's full knowledge base (house rules, pet policy, hot tub instructions) to handle guest questions 24/7. #WebDevelopment #Automation #Supabase #PropertyTech #NoCode #AI #SmallBusiness