Sokhom Residence
Attendance that reflects who actually turned up.
Illustration — the enquiries, names and timestamps are fabricated, and no rate or occupancy figure is stated.
The problem
Attendance lived in a spreadsheet and was filled in from memory. Staff arriving late or leaving early were recorded at their usual hours, because the record was written by hand after the fact and nothing contradicted it.
Enquiries arrived through Facebook messages and phone calls, where they were easy to lose and impossible to count. The existing website generated nothing.
What they asked for
A website with an enquiry route that lands in an inbox, and an HR system that records attendance honestly.
What it looks like
The website captures are the client’s own public site. The attendance capture comes from a fabricated demo company, never the client’s own tenant — the people and times in it are invented.
What it does
Geofenced clock-in tied to location, so an attendance record is created where and when the person actually arrived rather than reconstructed later. A property site built to carry the business rather than sit beside it, with enquiries routed to email and logged rather than scattered across chat threads.
The hard part
The whole point of the engagement was that enquiries stop getting lost, so the spam filtering built to protect that inbox had to be reviewed as adversarially as anything else. The security review of that filtering found two real defects. The first was a way through: only some of the form's fields were being inspected, and the address check was loose enough that link spam could clear the filter through the contact field itself. That one was settled by exploiting it against the live endpoint rather than by reasoning about it.
The second mattered more. Rejected messages were discarded quietly and answered with a success response, on the sound principle that a spammer should learn nothing from being refused. But the form treats any success as sent — so a genuine visitor who happened to paste a few links into their message would have been told their enquiry was on its way while it was thrown away, with nothing but a content-free line in a server log to show it had ever arrived. That is precisely the failure this project existed to end, rebuilt by us in a new place. The response is now graduated by confidence: unmistakable spam is still dropped in silence, but merely suspicious mail is delivered with a marker in the subject line so that a person decides. For a business this size, one questionable email in the inbox costs almost nothing. One lost enquiry costs a great deal.
In their words
Between the website handling inquiries and IustumHR handling payroll, the amount of manual admin work at The Sokhom Residence has probably dropped by half.
Where it stands
Delivered and live. Attendance records now reflect actual arrival and departure. Enquiries arrive in one place and can be counted.