The Context

I just wrapped up a major refactoring and security hardening session on yokatlas-scrape—the backend engine and dashboard that powers atlas.bountools.com. The project is a YKS (Turkish University Entrance Exam) analytics platform that scrapes official data and serves it up lightning-fast.

Recently, the codebase went through a rigorous “3-agent review.” We found vulnerabilities, performance bottlenecks, and SEO issues. Here is a look at what we fixed and how we did it.

Taming SQLite SCANs

One of the core invariants of this project is to never SELECT * from programs_2026. The table has 92 columns, and rows average 3.7 KB. When a query scans 250,000 rows, returning SELECT * means moving ~80 MB of data through the SQLite engine just to discard most of it in Python.

We optimized this by strictly projecting only the ~19 fields actually consumed by the API (like for /api/trends). We also added composite DB indexes (idx_p2026_*_sira_nulls) and made sure to run ANALYZE so the query planner knows how to use them.

Closing the LFI and XSS Holes

A scraper talking to YÖK ATLAS currently disables TLS verification (verify=False) because of certificate issues. While we can’t easily fix the source cert, we can treat the incoming data as hostile.

We implemented strict HTML-escaping at every render sink. When SEO <noscript> HTML and JSON-LD schema are injected on the server, every value is now sanitized. We neutralized the stored-XSS chain so that even if the upstream data is tampered with, it won’t execute in our frontend. We also fixed Local File Inclusion (LFI) containment vulnerabilities in the catch-all router by ensuring all resolved paths strictly belong to the frontend distribution directory.

Unifying the Slug Contracts

Nothing kills SEO faster than silent 404s. We discovered that the Python backend (server.py) and the React frontend (utils/slugs.js) had two independent slugification implementations. They diverged for 2 out of 228 universities, breaking deep links.

The fix? A single canonical algorithm:

1. Lowercase
2. Apply Turkish-character map (ı -> i, ş -> s, etc.)
3. Collapse [^a-z0-9]+ to -
4. Strip trailing dashes.

This contract is now enforced by a regression test (tests/test_security.py::TestSlugParity) over the full university dataset.

The Migration

To top it all off, we migrated the production domain from atlas.bogazici.app to atlas.bountools.com. This wasn’t just a DNS flip; it involved updating backend SEO canonicals, self-hosted Docker swarm configurations, and Dokploy, while adding 302 redirects to catch legacy traffic.

It’s been a busy session, but the application is now dramatically faster, properly secured, and ready for the next batch of students.