Telegram knows nothing about anyone's broker account.
Members should only stay while they trade through the IB network. Nobody could check that by hand.
A UK master Introducing Broker (IB) on Vantage runs a gold-trading signals service through a paid Telegram channel. A subscriber should stay only while three rules hold: their account sits under the client's IB or any sub-IB beneath it, they have traded within a set number of Gold trading days, and their balance stays above a minimum, with a warning and a grace period first. A member with several MT4/MT5 accounts passes a rule if any one of them does.
The support team was cross-checking spreadsheets and removing people one at a time, so members who stopped trading or moved broker stayed in for free. The data lives in the Vantage partner portal, which has no public API for it and sits behind bot protection and a CAPTCHA. The signed spec ran to 52 requirements, including a mandatory dry run before the first real removal.
Inherited mid-milestone. Approved the next day.
The original backend was technically strong. The process around it had gaps, and one wrong assumption.
The original developer had cracked the hardest part: getting live data out of a portal that blocks every direct request. But the milestone demo used a Telegram group where the signed spec said channel, on the belief that a bot cannot remove members from a broadcast channel. In a group, every subscriber sees who was accepted and who was removed. The demo showed 6 of the 12 acceptance criteria, and the regression, code and security audits had not been run.
Tested the assumption instead of debating it
On a real broadcast channel, through the live Bot API, the bot approved and declined join requests and removed and unbanned members, with nothing visible to subscribers. Switching to a channel was a configuration change.
Built the missing demo tooling
Scene commands put test members into each rule's state and ran the real rules engine with compressed timers, so all 12 criteria could be shown on live data with nothing faked.
Ran the skipped quality gates first
Regression at 95 of 95, a code audit and a security audit, before the recording. The audit caught a client-facing defect in the welcome message straight away.
Milestone 1 approved
The day after the takeover.
A CRM synced with Vantage, a rules engine and a Telegram bot.
Everything starts with the sync: every 20 minutes the whole Vantage IB network lands in the CRM, so the bot never waits on the broker.
A sync engine logs into the Vantage partner portal every 20 minutes and pulls the full client list for the whole IB network. The Telegram bot handles channel join requests and checks each account number against that data. A rules engine runs after every sync and warns, removes or leaves each member alone, always with a private message saying why. The CRM dashboard gives the owner, the support team and each sub-IB their own view.
Abuse is capped, humans can override
Repeated wrong account numbers block the user and route them to support, who can clear the block in one click.
Every outbound action is throttled
Approvals, removals and messages go through a queue that stays inside Telegram's rate limits and survives restarts, so bulk actions never get the bot banned.
Removal always comes with a reason
Before any kick, the member gets a private message naming the rule they failed: no trades, balance below minimum, or no longer under the IB.
The scope grew 70 percent. The date did not move.
Before writing dashboard code, I audited the contract. Fourteen of 52 signed requirements were covered by nothing.
Eight of those were real, unplanned work, and six had not been known to anyone: role-based access control, Telegram membership tracking, the dashboard half of the dry-run safety feature, audit-log writes and a stale-data guard among them. Our PM added all of it, two days before the demo date, with standing rules: no quality gate weakened to save time, and nothing reported as done that was not.
- 10 acceptance criteria
- Dashboard not started
- No role-based access in any plan
- Demo date two days away
- 17 acceptance criteria, on the original date
- 115 unit and integration tests, 11 real-browser E2E
- Independent code and security audits, no critical issues
- Login brute-force limiter added and verified live
A rehearsal against real broker data showed the account owner arriving in a different field from the one documented, so IB attribution was fixed before the demo. Milestone 2 was approved on 14 July 2026, and the contract closed with a 5-star Upwork review.
Live at 4.7 times the brief, and four real incidents fixed at the root.
The brief said about 12,000 members. The live system found about 56,000, and 66,000+ records by late September.
Scale problems surfaced on day one and were fixed on day one: a missing index meant the sync never finished at 56,000 records, and a filter dropdown with 3,681 options made each dashboard page 789 KB until it became a type-ahead search. Enforcement launched in dry-run mode, so nobody was removed until the owner switched it on.
A 7,000-person rush froze the botSame-night fix, then a redesign that makes it impossible
One process was running the full sync, the bot and a browser-based fallback, and every re-login under load stalled replies. A database-only bot mode cleared the backlog in about 90 seconds. The permanent fix split the bot into its own browserless, concurrent service. Over the next 19 hours the engine re-logged 59 times under the same pressure and the bot's backlog stayed at zero.
Server migration with zero data lossChecksum-verified, count-checked, rollback kept
Production moved to a larger AWS server: writers frozen, a checksum-verified backup, restore, and every collection count-checked against the old server before DNS switched, with the old server kept for rollback. Then hardening: automatic restarts, daily backups, TLS auto-renewal, durable queue storage and capped logs.
Removing the wrong people is worse than removing nobodyA completeness guard and three fixes for a rejoin loop
When the broker feed once dropped by half in a single cycle, a new payload completeness guard started pausing "no longer under the IB" removals whenever the feed shrinks well below its baseline. A rejoin loop was traced with data and closed with three fixes, including a rule that an IB removal only fires after several consecutive absent syncs. Two independent adversarial reviews then audited every admit, retain and exclude path.
The broker rebuilt its login page overnightFrom crash loop to alert-and-stay-up
Every login failed after Vantage moved its portal to a new component library. A diagnostic tool saved the live page and ruled out an IP ban, the CAPTCHA, resources and the browser profile one at a time. Login now uses ordered fallback selectors tested offline against a saved copy, and the engine stays up and alerts instead of crash-looping.
The client came back: a login for every sub-IB, isolated by design.
Each sub-IB sees only their own clients and their network beneath them. One IB must never see another's book.
The IB tree is imported, not typed in
A read-only probe of the Vantage portal returned the real tree: about 2,000 IBs, 12 levels deep. "Autofill from Vantage" pre-fills each parent, and nothing is saved until the owner confirms.
Names are never keys
41 IB names appear on more than one node. Scope uses exact numeric account matching, resolved per person, so someone with several accounts sees their whole book and nobody else's.
Authorization fails closed
Every route must declare its roles or the code does not compile, and a test checks every route against a permission matrix. Out-of-scope records return "not found", so their existence is never confirmed.
Tested at production shape
A fixture rebuilt production's structure with no real identities and caught bugs that only appear at scale, such as a 47,000-pixel page. Viewer queries now run in 3 to 35 ms.
The first demo of the new role was turned down as confusing because it opened with internal plumbing. The second opened with what an IB actually sees and was approved. It went live on 2 September 2026.