Envestorr SecureCheck — Cybersecurity Diagnostic Tool

What Was Built

Envestorr SecureCheck is a serverless cybersecurity self-assessment web application designed to evaluate organizational security posture through a streamlined, interactive diagnostic questionnaire. The system combines a responsive frontend hosted on GitHub Pages with an event-driven Google Apps Script (GAS) backend serving as a custom RESTful API. Features include a dynamic client-side conditional logic engine that evaluates multi-variable user inputs to compute real-time risk scores, automated webhook endpoints (`doPost`) that structure and log submitted assessment data directly into Google Sheets, and an embedded Calendly integration that enables high-risk respondents to instantly schedule targeted security consultations.

Why Was It Built

Small businesses and individual contractors often lack access to formal enterprise risk management tools or dedicated security auditors, leaving critical vulnerabilities in access control, data backup, and employee protocol unaddressed. Traditional assessment platforms require paid SaaS subscriptions or complex database backends that are costly to maintain for lightweight outreach tools. Envestorr SecureCheck was created to provide an accessible, zero-cost diagnostic solution that provides instant, actionable security feedback to non-technical users while streamlining lead capture, data aggregation, and consultation booking without maintaining paid infrastructure.

How It Works

When a user initiates the diagnostic, the application presents a structured sequence of security queries covering password management, multi-factor authentication (MFA), network hygiene, and data encryption practices. As responses are provided, the JavaScript conditional logic engine evaluates inputs against weighted risk matrices to calculate an overall security posture score and categorize vulnerability levels in real time. Upon completion, the frontend triggers an asynchronous `fetch` POST request carrying the payload to a deployed Google Apps Script web app endpoint. The serverless backend validates the payload, parses the JSON input into structured multi-dimensional arrays, appends the record with a timestamp to a central Google Sheet database, and returns a response payload. If the calculated risk exceeds a designated threshold, the interface dynamically renders an embedded Calendly widget, allowing the user to pick an available slot for an expert security review.

What Broke and How Did I Fix It

Building a serverless web app across GitHub Pages and Google Apps Script introduced specific cross-origin and data-handling hurdles. The primary issue was handling Cross-Origin Resource Sharing (CORS) preflight checks, as standard `fetch` POST requests with `Content-Type: application/json` were blocked by browser security policies when sending data to Google Apps Script web apps. This was resolved by reconfiguring the client-side request to send raw text stringified payloads using `text/plain` headers, allowing the script's `doPost(e)` handler to parse `e.postData.contents` into a JSON object server-side without triggering preflight blocks. Additionally, early backend scripts suffered from concurrent write lock errors when multiple responses arrived simultaneously; this was resolved by implementing Google Apps Script's `LockService` API (`LockService.getScriptLock()`) to enforce thread-safe execution during Google Sheets append operations. Finally, layout responsiveness issues with the embedded Calendly iframe on mobile viewports were resolved by wrapping the widget in a CSS flexbox container with adaptive height scaling.