API Proxies Management Platform:
Legacy Modernisation at Scale
A cloud-native API management and integration platform serving internal developers, enterprise clients, and external partners. Inherited with 500+ open bugs and 200+ security vulnerabilities across three divergent UI versions. We stabilised, secured, and modernised it without disrupting production.
Central API gateway for every integration
The platform lets organisations design, secure, deploy, and monitor APIs at scale. It acts as the central API gateway and orchestration layer. Every service request from every user type passes through it. Three distinct audiences depend on it: internal teams building and managing APIs, enterprise clients integrating their systems, and external partner developers consuming APIs.
All traffic is routed through a consistent gateway layer that enforces policy, handles transformations, and provides observability. Around 87 backend routes plus custom endpoints sit behind it, with the legacy UI layer alone routing approximately 150 paths.
500 bugs, 200 vulnerabilities, three versions to maintain
On-prem legacy, on-prem modern, and public cloud
200+ vulnerabilities closed, without breaking anything
Every category of vulnerability was addressed systematically: authentication and token-related issues, cross-site scripting exposure, input validation and request handling flaws. The approach was surgical: unused and vulnerable legacy code was removed; outdated libraries and dependencies were upgraded; and where full replacement was not viable, specific mitigation strategies were introduced to contain the risk from legacy components.
The constraint throughout was backwards compatibility. Three versions, running in production environments with different customers, meant that no fix could break existing behaviour. Security improvements had to be introduced incrementally, tested against each version independently, and deployed without disrupting active users.
Version switching in seconds, no user impact
Modernising while keeping everything running
The hardest technical challenge was modernising a highly fragmented legacy system without being able to pause feature delivery. Multiple outdated technologies were running in parallel: AngularJS alongside modern Angular, older backend integrations alongside newer services, and a compatibility shim that had grown into a critical dependency rather than a temporary bridge.
The approach was incremental: stabilise first, then improve. Bug fixes and security mitigations ran alongside feature work. Framework upgrades were sequenced to minimise blast radius. At every stage, all three UI versions had to continue working for their respective deployment environments. There was no clean break moment. Modernisation happened gradually and continuously.
On-demand releases with controlled approval gates
The pipeline runs from code commit through automated build, test, and staging deployment, followed by a validation and approval step before production. Releases are on-demand, driven by feature delivery, bug fixes, and business need rather than fixed cadence. Frontend assets are built and deployed automatically; version activation is a controlled configuration update with an explicit approval gate rather than a direct push.
Scale and complexity by the numbers
Multi-generation stack, brought forward
Dealing with a platform in a similar state?
Legacy fragmentation, security debt, and live production pressure. We’ve navigated all three at once. Let’s talk.