Skip to content
Irvine "Irvs" Clark B. EbajanIrvs
Back to WritingThoughts

Lessons from My First Freelance Laravel Project

What I learned building and delivering a real client project — from scoping to deployment.

1

Scope in Writing, Not Conversation

The client wanted "a flight inquiry form." What they actually needed: airport autocomplete, country codes, email confirmations, admin notifications, reference numbers, spam protection, and an API for future mobile integration. We fixed this by writing a one-page spec document after the first call — features, non-goals, timeline, and acceptance criteria. Signed off before any code. Saved weeks of scope creep.

2

Charge for Discovery, Not Just Delivery

I initially quoted only for the build. The real work was understanding their workflow: how agents handle leads, what data they need, when they follow up. Next time: paid discovery phase (1–2 weeks) to map requirements, design data models, and agree on UX before quoting the build.

3

Security Is Not Optional for Client Work

The agency handles customer names, emails, phones, travel dates — PII. Even as a freelancer, you own the security of what you ship. I implemented: reCAPTCHA v3 + honeypot, encrypted casts for 7 PII fields, rate limiting, CSRF/XSS/SQLi protections via Laravel defaults. Documented all of it in a SECURITY.md for the handoff.

4

Deploy Early, Deploy Often

First deploy to Render was day 3. Every feature after: push to main → GitHub Actions tests → Docker build → Render auto-deploys. Client saw progress in staging every few days. No "big bang" release anxiety. Feedback loops were tight.

5

Documentation Is Part of the Deliverable

Handoff included: README (local setup, env vars, commands), SECURITY.md (threat model, encryption, rate limits), API.md (endpoints, auth, examples), Docker/Render deploy guide. Client's in-house dev could run it locally day one. That's the standard.

6

Set Boundaries on 'Quick Changes'

Post-launch: "Can we add a field?" "Can the email template change?" "Can we integrate with X?" First two free (under 30 min). After that: change request form, impact estimate, separate invoice. Protects both sides — client knows cost, you don't burn goodwill on unpaid work.

The Short Version

  • ✓Write the spec. Get it signed.
  • ✓Charge for discovery — it's the highest-leverage work.
  • ✓Ship security by default, not by request.
  • ✓Deploy to staging on day 3. Iterate in public.
  • ✓Documentation is a deliverable, not an afterthought.
  • ✓Boundaries protect the relationship.