Customer Portal Refresh
Problem
Georgia’s Customer Portal (gateway.ga.gov) was built incrementally over years, resulting in inconsistent UI patterns, poor mobile experience, 200+ critical security vulnerabilities in legacy JSP code, and accessibility gaps preventing citizens with disabilities from applying for benefits independently. The state mandated WCAG 2.2 compliance and adoption of Georgia’s new Orchard design system.
Context
The Customer Portal is the primary interface for millions of Georgia citizens applying for health insurance, SNAP, Medicaid, childcare assistance, and other critical services. Any modernization effort had to occur without downtime, maintain backward compatibility during transition, and coordinate across multiple development teams, state stakeholders, and the ADA validation team.
Challenges
Retrofitting accessibility into complex multi-step flows without redesigning underlying business logic. Resolving 200+ Snyk-identified JSP vulnerabilities while maintaining functionality. Extending Orchard components to meet portal-specific needs not anticipated by the design system. Making the portal fully responsive when original designs assumed desktop-only usage. Coordinating validation with the State ADA team to ensure genuine compliance, not just automated scan passage.
Solution
Led modernization using Orchard as the foundation, extended components for accessibility and business needs, codified JS/CSS/JSP standards to prevent regression, resolved vulnerabilities through secure coding patterns and input sanitization, partnered with state ADA SMEs to validate WCAG 2.2 compliance through manual testing, delivered fully responsive mobile-first design, and standardized Orchard components as reusable CP “Tags” for consistency across state sites.
My Contribution
Technical lead and architect. Made design decisions balancing state design system requirements with portal constraints. Wrote code for critical components. Conducted accessibility design reviews. Partnered with security team to analyze vulnerabilities and design remediation approach. Coordinated implementation across teams. Validated final implementation with state ADA team.
Results
Enabled accessible, mobile-first self-service validated by state ADA team. Resolved 200+ critical security issues, dramatically reducing attack surface. Increased mobile adoption as citizens could complete applications on phones. Standardized reusable components used across other Georgia state sites. Reduced support volume as clearer UI patterns reduced citizen confusion.
Lessons Learned
Accessibility validation requires human testing. Automated scans caught obvious failures but missed nuanced issues like confusing tab order, unclear error messaging for screen reader users, and cognitive load problems. Partnering with ADA SMEs and conducting manual screen reader testing revealed the real gaps.
Design systems need project-specific extensions. Orchard provided strong foundations but wasn’t built for complex multi-step benefit applications. Rather than fighting the design system, we extended it respectfully, then contributed those extensions back for other state projects.
Security remediation at scale requires patterns, not point fixes. Fixing 200+ vulnerabilities one-by-one would have taken months. Instead, we identified common patterns (unescaped output, SQL injection risks, XSS vulnerabilities) and created secure reusable components. This turned hundreds of individual fixes into dozens of pattern applications.