Gazelle – Magento maintenance and security updates

The project at a glance

Magento maintenance your team can carry forward

A busy commerce platform needs more than occasional updates. For Gazelle, we combined interim Magento development with a structured approach to security releases, maintenance and backend performance.

Our role

9 months of interim Magento development

The challenge

Bring overdue updates under control

What we delivered

A repeatable patch workflow and documented handover

How the solution fits together

1. Understand the backlogReview the codebase, Magento versions and missing security patches.
2. Update in controlled stepsIntroduce Composer patches and deliver three major security updates during the engagement.
3. Make maintenance transferableDocument the workflow and improve caching, database queries and application code.

A schematic explanation of the approach described; not a live system view.

Where we went beyond implementation

Look beyond the feature backlog

The engagement started with platform development. Our technical review also identified an update backlog, so we raised patch management and maintenance alongside the existing development requests.

Turn technical issues into business decisions

We proposed both technical and financial improvements and explained the urgency of security updates to management. Updates were planned with the continuity of the store in mind.

Help the team continue independently

We documented the patch workflow so the internal team could continue tracking and applying updates after the interim engagement. The deliverable included a process the team could keep using.

The duration and results below refer to the engagement described.

The story

When Koninklijke Gazelle needed an interim Magento developer, the initial brief focused on developing new features. An initial assessment revealed a critical security issue requiring immediate attention. The e-commerce platform, serving millions of annual visitors, was three versions behind and missing important security patches.

The discovery

I began with a thorough review of the codebase and infrastructure. The team had no structured patch management process and did not actively track updates. For a platform handling customer information and payments, this created an immediate security risk. The backlog reflected a missing update process and insufficient prioritisation of security patches.

A security-first approach

Composer patches

Within one day, I implemented a composer patches workflow designed for rapid security updates. It allowed critical patches to be applied without requiring a complete version upgrade, which mattered for a platform with limited maintenance windows.

Proactive security monitoring

I introduced a process for assessing each new Magento security release. Whenever a critical patch became available, I proposed its deployment. Explaining the urgency to management was part of the work; the patch workflow made quick implementation practical.

A structured update cycle

Over nine months, I carried out three major security updates, bringing the platform from its outdated version to the security standards applicable during the engagement. Each update was planned to minimise disruption to business operations.

Technical improvements

Backend performance

Alongside the security work, I addressed performance tickets from the existing backlog. This included application-level optimisation, better caching and simpler database queries to improve response times.

Proactive improvement proposals

I also proposed technical and financial improvements to existing systems. Some were implemented during my engagement; others remained in development when the assignment ended.

Results

Security maintenance

The platform's three-version security backlog was addressed. The composer patches workflow enabled the team to respond more quickly to new security advisories instead of allowing updates to accumulate.

Operational improvements

The previously missing patch management process was implemented, giving the team a way to monitor and apply updates after the interim assignment.

Performance

Backend optimisation addressed existing performance bottlenecks and improved the experience for visitors using Gazelle's platform.

Long-term impact

Risk reduction

The work addressed the critical security risks identified in the initial review. This was particularly important for a business processing customer data and payments every day.

Process improvement and knowledge transfer

The composer patches workflow became part of the development process. Although there was no formal training programme, the update process was documented and implemented so that the internal team could continue it.