Refonte d'une application de santé · AP-HP

A child with Marfan syndrome cannot do just any sport at school. A vague unfitness certificate excludes them from everything, when they could practise most activities. The application turns that into a precise, reproducible decision: three specialists each answer a questionnaire, the application crosses the answers with a reference list of school activities, and produces a PDF certificate listing, sport by sport, what is allowed, for the current school year and the next.

Real usage: around 200 to 260 certificates a year since 2019, across 12 hospital centres, 52 accounts, 268 files and 1,313 certificates produced.

Four profiles: super-administrator, centre administrator, secretariat, and a specialist in cardiology, ophthalmology or rheumatology-paediatrics, who can only open their own specialty's questionnaire. While any questionnaire is incomplete, generation is unavailable; once the PDF exists, questionnaires are frozen.

The core logic fits in about fifty lines. For each activity matching the child's school level and gender: if no cardiology answer allows it, it is forbidden outright, the aorta comes first. Otherwise a single contraindication from any specialist is enough to refuse it. All the intelligence lives in the answer-to-authorisation mapping, managed by the super-admin; the code only applies it.

Symfony 4.2, PHP 7.2, PostgreSQL 9.6 and Debian 9 on an OVH VPS: the whole stack out of support, 60 published vulnerabilities including 5 critical, a dead build chain the audit had to repair to rebuild the image, no backups, and e-mail delivery broken since 2022, which also prevented automatic deletion of files after sending.

Six major flaws: certificates reachable without login, database and Adminer open to the Internet, passwords in clear in the code, password sent back in clear by e-mail, no partitioning between centres, destructive actions triggered by a plain link. The audit also found that the "hospital identifier" field in practice held the child's first and last name.

Delivered: 23 pages with reproducible findings, six quotes, a comparison, a maintenance contract, a note for the DPO and an acceptance checklist per role.

An emergency hardening branch, 12 commits and 69 green automated tests: certificates and logos moved out of the web root with random names and authenticated download, per-centre partitioning on 14 actions, anti-CSRF token on 12 routes, password removed from e-mails, secrets taken out of the repository, production without Adminer or an exposed database port, hardened nginx, plus encrypted backup, restore and deployment scripts.

Deployment follows a plan of three short windows on the server, a dress rehearsal on a local replica of production, a per-role acceptance and a report. The proposed next step is a full rebuild on Symfony 7, PHP 8, PostgreSQL 16 and Docker, with a certificate history and an action log, which do not exist today.

Presented as a case study: this is a health application, no real data is shown.