What is it?
The whole life of a sports event, in one system: registration, payment, race pack collection and participant timing. Galasin.com and GalasinVR.com have run it since 2011. It is the oldest thing I have built that is still in production, and the one that has taught me the most.
What makes it hard?
The minute the registration opens. A popular race sells out in minutes, and in that window the platform sees more than a million requests per second. Everything is designed for that peak: caching, load balancing, rate limiting and asynchronous processing, so the site stays up and stays fast while the rush passes. Payments run through integrated gateways, around 250,000 transactions a month at the peak, with bank transfer, e-wallets and virtual accounts, because every participant pays the way they prefer. Race pack collection and BIB timing work from the same registration data, kept consistent through synchronised workflows and validation, so the person who paid is the person who runs and the person whose time is recorded.
Why does it matter for my security work?
Because I have been on the other side of my own advice for fifteen years. Real money, real deadlines, a start gun that will not wait for a deploy. That is why every control I recommend to a client starts from what a team can actually operate. If it would not survive a registration peak, I do not suggest it.