Marie Starck

At my old company, we used to rely very much on Stripe to handle our customers, plans, charges, etc. However, we wanted to start creating custom plans for our enterprise customers and Stripe didn't allow us to do that very easily. So my task was to move some of the billing in-house such as plans but also calculating costs and invoices such that Stripe would only be used to charge customers an amount determined by us. Added to this, we were also changing plans for our non-enterprise customers so we would have to support both sets of plans: the new and the legacy ones. This meant: - New billing pages developed in HTML/CSS, CoffeeScript and KnockoutJS - New Ajax endpoints to subscribe, unsubscribe, add credit card, ... - New Django models for billing plans and invoices including schema and data migrations workers to calculate costs at the end of the month for each customers and fire a API call to Stripe to charge them - Also used Docker and Heroku to help with programming and deploying

I also implemented a new Multi-Factor Authentication system using Twilio and wrote a blog post about it. As many companies are improving their security system so did we. This project included: - Creating a new Multi-Factor model with recovery codes, secret code attributes. - A two-step login page with the option of sending the authentication code to the owner's phone if they didn't have an app such as Authy - A Twilio integration in order to send those SMS - New pages to create the 2FA token first explaining Multi-Factor Authentication then displaying the QR code and then validating. In order to do this safely, a Two Factor Authentication object would be created at the beginning of the process, the secret code would then be sent to the front-end in order to display the QR code and after the used inputs the 6 digits code to activate it, it would be sent back to the backend, compared against valid codes and if it was correct, an 'activated' flag on the Two-Factor object would be set to true. This removed any secret code from being sent from the front-end to the backend and used to create the object which would be a security flaw.