---
title: "Comment by Code with Disloyal on \"I Almost Lost Commerza: The Brutal Reality of Building an Ecommerce System Without a Framework\" | Hashnode"
description: "Great deep dive into Commerza, Ahmer! Building a security-first engine from scratch is no small feat, especially in e-commerce where trust is everything. I have"
url: "https://hashnode.com/posts/building-commerza-security-first-ecommerce-engine/69e52e7d13e74eec58461400/comment/69e72ed684846b95c5294d9c"
---

[Discussion](https://hashnode.com/posts/building-commerza-security-first-ecommerce-engine/69e52e7d13e74eec58461400)

Comment [I Almost Lost Commerza: The Brutal Reality of Building an Ecommerce System Without a Framework](https://hashnode.com/posts/building-commerza-security-first-ecommerce-engine/69e52e7d13e74eec58461400)

[Code with Disloyal](https://hashnode.com/@mrdisloyal)

[Apr 21](https://hashnode.com/posts/building-commerza-security-first-ecommerce-engine/69e52e7d13e74eec58461400/comment/69e72ed684846b95c5294d9c)

Great deep dive into Commerza, Ahmer! Building a security-first engine from scratch is no small feat, especially in e-commerce where trust is everything.

I have a question regarding the architecture: How did you balance these heavy security protocols with the overall performance and load times? Often, strict security measures (like complex middleware or heavy validation) can slow down the TTFB. Would love to hear your approach on keeping the engine lightweight while staying highly secure. Solid work on this!

[Syed Ahmer Shah](https://hashnode.com/@syedahmershah)

[May 7](https://hashnode.com/posts/building-commerza-security-first-ecommerce-engine/69e52e7d13e74eec58461400/comment/69e72ed684846b95c5294d9c#reply-69fc370a3d9a9c101972e1f7)

That is a great question. To keep the TTFB low, I focused on making the security layers as "thin" as possible. Instead of heavy middleware, I used optimized validation classes and prepared statements that add negligible overhead. I also made sure that security checks (like session validation) happen early in the execution flow to prevent unnecessary processing if a request is unauthorized. It’s definitely a constant balancing act.