The product was older than its repository. Four services were scattered across three separate repos — and one existed only as a single file sitting on the production server, with no version control of any kind.
What I did about it
Consolidated all four into one monorepo, so a change that spans the API and the media processor is one reviewable commit rather than a coordination problem.
Brought the unversioned production service under git without downtime, reconstructing its history from the deployed artefact.
Hardened auth on the way through — bcrypt, OAuth, JWT-secured APIs and per-site session isolation.
What I rejected, and why
A rewrite would have been cleaner and would have taken months during which the live product got no fixes. Consolidation-then-harden kept the revenue running.
Local development runs against the production database because no dev database was ever stood up. It worked because the team is one person, but it is one careless migration away from a very bad afternoon.