Context

TixiGen is an AI content CMS built in-house at Tiximax: SEO planning, AI-generated articles and images, a rich-text editor, SEO scoring, review and scheduled publishing to multiple sites and languages.

It began as an in-house tool for a single company. Turning it into a multi-workspace SaaS meant that assumptions of a single tenant — in routes, prompts, defaults and data — had to be found and replaced across the codebase.

What I did

I joined the CMS in mid-August and became its second-largest contributor. Colleagues had already built the multi-tenant foundation, SSO, billing integration, CI/CD and the core of the LLM pipeline; my work sat on top of that.

• Led the workspace-isolation hardening: audited 445 API routes, closed 43 cross-workspace read/write gaps and wrote a 368-case test suite (341 automated).
• Shipped multi-workspace accounts, per-workspace subdomains, invite links and public sign-up.
• Built a customer-facing content API after comparing 10 headless CMSs against the OWASP API Top 10: scoped, expiring per-workspace keys with a 3-day rotation grace period.
• Extended the LLM pipeline: made the Claude API the primary text provider, generated Gemini response schemas from Zod, added embedding retrieval with LLM re-ranking and a verified-facts set to block invented statistics.
• Implemented a 60+-criterion SEO rubric from the business spec, with a live scorecard in the editor and language-aware thresholds (Vietnamese syllables, Japanese characters, rules for Indonesian and Tagalog).
• Re-architected PostgreSQL around a trigger-enforced content tree, replaced string-built SQL with parameter binding, and localized the UI into Vietnamese, English and Japanese.

How it works

Every query filters by a workspace key taken from the token or request context, never from user input. The workspace is resolved from the subdomain, and a user who belongs to several workspaces switches the active one through the token.

To prove isolation I did not rely on code review alone. Each audit round followed the same steps:

• Snapshot row counts per workspace across 241 tables.
• Call 112 GET endpoints as two different workspaces and compare what each can see.
• Fix every read, write, update or delete that crossed a workspace boundary, including cron jobs, social posting and MCP tools.
• Re-run the snapshot and the 368-case suite against a real QC database.

Results

In about 2.5 months I landed 850+ commits on the main branch across 41 tickets and 50+ merge requests, with 120+ SQL migrations and 130+ test files.

• 445 routes audited, 43 isolation gaps closed, 368 test cases (341 automated).
• Multi-workspace accounts covered by 77 API integration tests and 26 UI tests.
• Schema reduced from 149 to 137 tables; 19 tables renamed in one transaction.
• Editor SEO analysis cut from 53.6 ms to 22.4 ms per pass on a ~2,700-word article, with identical scores.
• UI localized into three languages, 5,804 keys each, stored in the database so translations change without a redeploy.
• News-article prompt shortened by 40% (6,499 to 3,879 characters).

What I'd do next

The isolation work was retrofitted onto an existing codebase, which is why it needed three audit rounds. Next time I would put the workspace check into a shared data-access layer from day one, so a new route cannot skip it, and keep the cross-workspace snapshot as a CI check rather than a manual audit.