DEV Community: Madiha W

Building HomeScope with Floot and Perfai Security

Madiha W — Tue, 04 Aug 2026 16:29:35 +0000

In the past year alone, AI-assisted development has enabled developers to build applications faster than ever before. But speed isn't the goal. The real challenge is creating software that's useful, secure, and delivers a great user experience.

For this experiment, I wanted to see how far an AI-assisted workflow could take a real product idea. The result was HomeScope, a role-based real estate platform built over a single weekend that brings the home-buying process into one streamlined experience.

Disclosure: I am currently interning at Perfai Security, the security testing platform mentioned below in this post. Nonetheless, this post is not sponsored, HomeScope is a personal project, and I decided to utilize Perfai as a part of my release process because I was already familiar with the platform. All views expressed in this post are my own, and I'd love to hear feedback on both the application and this post.

The Problem

Finding a home is more fragmented than it should be. Buyers often jump between multiple websites to browse listings, compare neighborhoods, estimate affordability, contact agents, and schedule tours. That process wastes time and makes an already stressful decision even more complicated.

I wanted to see what that experience would look like if everything lived in one place while also testing how quickly AI could help bring that vision to life.

The App

HomeScope is designed around two user roles:

Home Buyers

Buyers can:

Search for properties
Explore listings on an interactive map
Save favorite homes
Compare neighborhoods
Estimate mortgage affordability
Schedule property tours
Communicate directly with listing agents

Everything is managed from one personalized dashboard, eliminating the need to switch between multiple platforms.

Real Estate Agents

Agents have their own workspace where they can:

Create and manage property listings
Respond to buyer inquiries
Approve tour requests
Track listing activity

Instead of building two separate applications, HomeScope delivers both experiences in a single platform, automatically adapting the interface and available features based on the user's role.

Tech Stack

Floot
TypeScript
React / Next.js
Tailwind CSS
NextAuth
PostgreSQL + Prisma
Google Maps Platform
RentCast API
Perfai Security

Floot handled much of the initial application structure, component generation, and integrations. NextAuth managed authentication, PostgreSQL and Prisma handled persistent data, Google Maps powered the interactive map experience, and RentCast supplied listing and market information.

Security Check

Building a functional application is only part of the process. HomeScope stores user accounts, saved properties, messages, and role-based permissions, making security just as important as functionality.

Before considering the application ready for release, I audited the live deployment using Perfai Security.

Rather than relying on source code access, the platform analyzed the application's routes, workflows, and business logic before performing targeted security testing. The results uncovered several issues that were worth addressing before moving toward production.

One of the biggest lessons from this project was that a polished interface doesn't automatically mean a secure application. Security deserves the same attention as design and features.

Building the Application

The project started with a detailed prompt in Floot outlining the product vision, user roles, workflows, UI direction, and technical requirements.

The first version provided a solid foundation, but building a product people would actually enjoy using required multiple rounds of refinement. I iterated on user flows, improved the interface, integrated APIs, and ensured buyers and agents only had access to the information relevant to their roles.

AI dramatically accelerated development, but it didn't eliminate the need for thoughtful design, testing, and iteration. Instead, it allowed me to spend less time on boilerplate code and more time building a product that solves a real problem.

Final Thoughts

Building HomeScope reinforced just how powerful AI-assisted development has become. Platforms like Floot make it possible to go from an idea to a polished full-stack application in days instead of weeks.

More importantly, HomeScope demonstrates that AI can accelerate development without sacrificing quality—provided you invest the time to validate, test, and secure what you build. A great product isn't defined by how quickly it's created, but by how well it works and how confidently people can rely on it.

If you're looking for a simpler way to browse homes, compare neighborhoods, connect with agents, and manage the buying process in one place, HomeScope was built to do exactly that.

[Boost]

Madiha W — Wed, 29 Jul 2026 17:31:27 +0000

I Built a Calendar App Kids Control — Even Parents Can't Access It - DEV Community

Over one session, I built Kid Compass — a calendar and chore planner designed so kids plan their own...

dev.to

I Learned How to Use Floot and Perfai Security Over One Weekend and Built a Real Estate App

Madiha W — Tue, 28 Jul 2026 16:30:00 +0000

I learned Floot and PerfAI Security over one weekend and used them to build a comprehensive real estate platform — complete with a full dashboard offering separate experiences for home buyers and real estate agents.

HomeScope helps buyers search for homes, compare neighborhoods, save favorite properties, schedule home tours, receive personalized recommendations, and communicate directly with listing agents — while giving agents powerful tools to manage listings, respond to inquiries, and track property performance.

The entire application started with one detailed prompt inside Floot. The impressive part: a feature-rich, role-based platform resembling a production-ready real estate marketplace, built in a single weekend.

What Is HomeScope?

HomeScope is a role-based real estate platform designed around two types of users: Home Buyers and Real Estate Agents.

Home Buyers can:
Search homes using advanced filters
Explore listings on an interactive map
Save favorite properties into custom collections
Compare neighborhoods using demographic and market data
Calculate mortgage affordability
Schedule home tours
Contact listing agents through built-in messaging
Receive personalized property recommendations
Track recently viewed homes and saved searches from a personalized dashboard
Real Estate Agents can:
Create new property listings
Upload photos and manage listing details
Edit pricing and property information
Mark listings as sold or pending
Respond to buyer inquiries
Approve or reschedule home tours
Monitor listing performance (views, saves, inquiries)
Manage conversations with potential buyers
Why I Built This

I wanted to explore what a modern real estate platform could look like when AI handled much of the engineering work — and what building a software company looks like when the first version of a product can be generated in days rather than months.

My initial question was:

How far can a non-traditional development workflow take a real product idea?

Real estate was a useful test case because even a focused platform introduces meaningful complexity:

Multiple user roles, each requiring different permissions, workflows, and private data
Buyers should only access their own saved homes, tours, and conversations
Agents should only manage their own listings and customer inquiries
Proper role separation is essential for both usability and security

Each individual feature is understandable on its own. The real challenge is connecting them into one coherent, trustworthy application — especially when external APIs can fail, map requests can time out, location permissions can be denied, and listing data constantly changes.

I wasn't just interested in whether Floot could generate attractive dashboards. I wanted to see whether it could take a broad product specification and turn it into a functional system with authentication, workflows, integrations, and meaningful role separation — the kind of foundation a real startup could be built on.

Tech Stack
Floot — application scaffolding, component generation, and integration work
TypeScript
React / Next.js
Tailwind CSS
NextAuth — authentication
PostgreSQL + Prisma — persistent data
Google Maps Platform — interactive property maps
RentCast API — listing and market data
PerfAI Security — pre-launch security validation

Floot handled most of the initial application structure, component creation, and integration work. NextAuth provided secure authentication while PostgreSQL and Prisma managed persistent application data. Google Maps powered interactive property maps, and RentCast supplied listing and market information.

Finally, I used PerfAI Security to validate the application before launch. As AI-generated code becomes more common, security can no longer be treated as an afterthought — automated security testing helped identify potential vulnerabilities early, ensuring the platform was not only functional and feature-rich, but secure enough for real users.

How It Was Built: One Prompt

I began with one long prompt describing the product, users, pages, design direction, workflows, and technical expectations. The goal was to provide enough context for Floot to generate a connected application rather than isolated screens built one at a time.

First Iteration

The initial generation created most of the application's overall structure. Floot established a consistent design system throughout — typography, spacing, buttons, cards, tables, forms, dashboards, and navigation all felt like parts of the same application rather than independently generated pages.

The role separation immediately made the platform feel much closer to a launch-ready real estate product than a generic dashboard template with different labels.

What Still Required Iteration

A detailed initial prompt created a strong foundation, but it didn't produce a finished company in one attempt. I continued working with Floot to refine workflows, connect generated components, improve UX, resolve edge cases, and make the application behave more like the product I originally envisioned.

Role-Based Experiences

Showing different dashboards was only the beginning. Navigation, permissions, listings, saved properties, messages, scheduled tours, and database records all needed to reflect the current user's role. A home buyer should never see agent management tools, and an agent should never access another agent's listings or a buyer's private dashboard data. The visual separation was straightforward — making that separation meaningful throughout the application required much more iteration.

Third-Party Integrations

The property search APIs and Google Maps integrations required proper loading, empty, and error states. A production-quality application can't assume every API request succeeds — users need graceful fallbacks whenever external services become unavailable.

Results

By the end of the weekend, HomeScope had become a functional full-stack prototype. Users could create an account, choose either the buyer or agent role, and immediately access their own dashboard. Data persisted across sessions, and the application could be published directly from Floot to a live URL.

From a product demonstration perspective, it looked complete: screens connected naturally, primary workflows functioned correctly, and the app featured responsive layouts, realistic property data, interactive maps, personalized dashboards, and enough polish to confidently demonstrate to others.

That's usually the point where a vibe-coded application feels ready to ship.

"Published" and "Ready to Release" Are Different States

Publishing the application was simple — Floot generated a live deployment within minutes. But deployment only proves the application can run on the internet. It does not prove that authorization rules can't be bypassed.

This distinction matters for every application, but especially for a real estate platform. HomeScope contains user accounts, saved properties, private messages, scheduled tours, agent dashboards, and listing management workflows. Even with demo data, these features create the same trust boundaries a production application must protect.

Before considering the application release-ready, I ran the deployed version through PerfAI Security.

The Release-Readiness Check

PerfAI Security tested the deployed application, not just the source code or generated interface. I submitted the live URL, and the platform mapped the application's accessible functionality, routes, requests, and user workflows before testing for security weaknesses.

This wasn't meant to be another development phase — it was simply part of the release checklist, alongside verifying mobile responsiveness, checking integrations, and confirming that core user flows worked correctly.

The scan identified 4 security issues — 2 high-severity and 2 medium-severity — with an estimated $3,100 in potential bug bounty exposure avoided.

Severity Finding
High (CVSS 7.5) Sensitive data exposed in error & metadata responses
High Missing rate-limiting protections
Medium Enumerable resource IDs
Medium Broken pagination limits
Sensitive Data in Error & Metadata Responses (High — CVSS 7.5)

The most severe finding involved sensitive information appearing in error and metadata responses. Applications frequently expose more information than intended when errors occur — in this case, internal details were being returned through responses users should never need to see. This kind of information leakage can give attackers valuable insight into application structure, underlying services, or implementation details that make future attacks easier.

Missing Rate Limiting Protections (High)

Without appropriate request limits, attackers can repeatedly access endpoints, automate abusive behavior, or attempt credential-based attacks at scale. The application functioned normally during testing, but this issue highlighted an important distinction between a working application and a resilient one.

Enumerable Resource IDs (Medium)

PerfAI detected resource identifiers that could potentially be predicted or enumerated. When resource IDs follow predictable patterns, attackers may discover records they were never intended to access simply by guessing identifiers. Even with authorization controls in place, predictable IDs increase the attack surface unnecessarily.

Broken Pagination Limits (Medium)

Pagination controls did not properly enforce limits. This seems like a small feature, but improperly enforced limits can allow excessive data retrieval, increase infrastructure costs, and create opportunities for abuse. Production systems should always validate pagination parameters rather than trusting client requests.

None of these issues were obvious from looking at the finished application. The design looked polished. Buyer and agent dashboards were properly separated. Authentication worked. Property search, messaging, and tour scheduling all behaved as expected — from a normal user's perspective, everything appeared ready for launch.

That's exactly why the security scan proved valuable. It surfaced issues that would never have been found through visual inspection alone, and it demonstrated the real difference between a convincing prototype and a product approaching production readiness.