Case study · Custom web app
PGA Strategic Input Survey: A Confidential Survey App With Its Own Results Dashboard
A self-contained survey and password-protected results dashboard built for a PGA of America leadership campaign, with no third-party survey vendor holding the responses.
- Client: Russ Libby '26, campaign for PGA of America Secretary
- Location: National
- Year: 2026
- Built with: HTML and JavaScript, Netlify Functions, Netlify Blobs, QR codes
The Problem
The campaign needed to gather strategic input from PGA Section leaders across the four PGA North Stars, keep every response confidential, and give the candidate a live view of the results with a spreadsheet export. Off-the-shelf survey tools meant handing member responses to a vendor and living with their branding, their limits, and their data policies.
What We Did
- Built a 14-question survey in four sections with a progress bar, pick-up-to-three and ranking question types, and a closing reflection, on the campaign’s navy and gold.
- Stored each submission through a serverless function into Netlify Blobs; the survey page itself can never read responses back.
- Built a results dashboard with charts, individual responses, collapsible "Other" explanations, and CSV export, gated by a password that is checked only on the server.
- Hardened the deployment: HTTPS with HSTS, security headers, escaped user text, a CSV formula-injection guard, internal files returning 404, and both pages kept out of search indexes.
- Produced print-ready QR codes in campaign colors and covered the backend with 13 automated tests.
- Turned around three rounds of client question revisions at the same URL, so the QR codes already in circulation stayed valid.
Results
| Measure | Before | After |
|---|---|---|
| Third-party services holding responses | n/a | 0 |
| Question revisions shipped before launch | n/a | 3 rounds, same URL |
| Backend tests | n/a | 13 passing |
Outcome
Launched on August 4, 2026 after a full end-to-end check: every question type round-tripped into the dashboard, the password gate rejected bad attempts, and the security headers were live. The candidate reads results in a browser and exports a spreadsheet whenever he wants one.