Own product — lukeduff.co.uk
Software Project
More and more buying research now happens inside ChatGPT, Google AI Overviews, Perplexity and Gemini rather than on a page of blue links. A brand can rank perfectly well in traditional search and still never be named in the answer a customer actually reads. AEO Autopilot was built to make that visibility measurable, and then to do something about it.
The product runs a five-step loop: track whether a brand is cited for the questions its buyers are asking, diagnose which prompts it is losing and to whom, generate a publish-ready fix, push that fix live to the customer’s WordPress site, and re-check afterwards to see whether the answer changed. The intended positioning is that most tools in this space stop at monitoring — the fix and publish steps are the reason this one exists.
This is my own product rather than client work, and it is written up here as an engineering case study. The application is built, hardened and deployed, and is currently running in a keyless demonstration mode. It is not yet transacting: the production database wiring is outstanding and authentication is still on test keys.
| Problem | Solution Implemented |
|---|---|
| Four answer engines, four different APIs, and no shared idea of what a citation is | Built one engine interface over Perplexity’s sonar model, the OpenAI Responses API with web search, Gemini with Google Search grounding and Google AI Overviews via DataForSEO, then normalised every response into a single citation record with a cited / mentioned / absent status and the competing domains extracted. |
| Classifying answers with a language model makes the whole product fail the moment a key is missing or an engine errors | Wrote a deterministic fallback judge — word-boundary and subdomain aware — that classifies citations without any model call. Every layer degrades rather than breaks, which is why the app can run live with no engine keys wired at all. |
| Scan quotas are the billing boundary, and a failing background job plus a stale-scan reaper can easily refund the same scan twice | Moved quota accounting into atomic Postgres functions — one to consume a scan, one to fail and refund it — so a refund happens exactly once regardless of which process gets there first. Verified against the real database, along with a self-healing monthly period rollover so free accounts are never locked out. |
| Publishing means holding a customer’s WordPress credentials and fetching a URL they supplied — a textbook server-side request forgery risk | All WordPress traffic goes through a guarded fetch that re-runs the private-address check on every redirect hop, drops the Application Password header on any cross-origin redirect, and blocks loopback, private, link-local, CGNAT, IPv6 ULA and cloud-metadata ranges. Stored credentials are encrypted at rest with AES-256-GCM and never returned to the browser. |
| WordPress strips JSON-LD script tags for any user without the unfiltered_html capability, so schema silently vanishes | Detects each site’s schema capability on connect and picks the right path automatically — admin Application Password, the RankMath schema field, or a companion mu-plugin that prints the block in the head regardless of role. Fixes publish as drafts behind an atomic claim so a double-click cannot create duplicate posts. |
| A multi-tenant product that handles payments needed more scrutiny than a single developer can give it in one pass | Ran several independent adversarial review passes across tenancy, the scan pipeline, WordPress publishing, billing and the code paths that only behave differently once real keys are present. Over twenty issues were fixed and re-verified — quota races, duplicate citations on retry, errored engine calls being scored as absences, and webhook idempotency among them. |