The proposed Minimum Viable Project (MVP) approach offers London Cycling Campaign a pragmatic and low-risk path to rapidly relaunch the Cycle Buddies platform while retaining full ownership and control of the solution. By delivering a focused, working core using modern reusable components and open technologies, LCC can restore essential functionality for users in weeks rather than months, while ensuring that all source code, data structures and platform decisions remain fully within the organisation’s control. This avoids dependency on a single external supplier and enables the platform to evolve incrementally in line with user needs, funding opportunities and strategic priorities.
In contrast to commissioning a fully outsourced build, this approach emphasises transparency, adaptability and long-term sustainability. Building the MVP in collaboration with an experienced volunteer creates an opportunity to shape the platform organically, learn from real user behaviour, and avoid over-engineering early features. It also mitigates common risks associated with third-party delivery, such as vendor lock-in, limited flexibility for future enhancements, ongoing licensing or support costs, and reduced visibility of underlying implementation. The result is a lean but extensible foundation that can be scaled, enhanced or even re-platformed in future without constraint.
The project will follow a pragmatic Agile delivery model, combining structured analysis with modern “vibe coding” techniques to accelerate development. Work will be broken into short iterations focused on delivering usable features end-to-end, with an experienced (retired) IT Business Analyst shaping requirements, maintaining a prioritised backlog, and defining clear acceptance criteria.
Vibe coding tools (AI-assisted development - see AI enabled coding with Mammouth Code) will be used to rapidly prototype, iterate and refine functionality, enabling faster turnaround from idea to working feature. Regular demos and feedback loops will ensure that this speed is balanced with control, allowing stakeholders to continuously validate direction and usability. This approach blends discipline with experimentation—keeping scope grounded while taking advantage of modern tooling to deliver value quickly and efficiently.
As the AI is now “part of the team”, the proposal is to start learning to bridge the divide between Microsoft Teams and GitHub. Check out AI enabled coding with GitHub
Supporting resources
-
🎥 Agile explained simply (very accessible):
https://www.youtube.com/watch?v=Z9QbYZh1YXY -
🎥 Scrum overview in practice:
https://www.youtube.com/watch?v=9TycLR0TqFA -
📘 Atlassian Agile Coach (practical guides and examples):
https://www.atlassian.com/agile -
📘 The Scrum Guide (official reference, concise):
https://scrumguides.org/
0. Sandbox Release
(free, hosted on my home server via Cloudflare tunnel at lcc.mohinika.com) ↑ Top
The immediate goal is a working sandbox environment — a proof of concept that:
- Demonstrates the revived platform running with anonymised test data
- Supports cost estimation and sponsorship pitching with something concrete to show
- Provides a reference point for any future tender
- Proves the viability of an AI-assisted development approach (with me as the human-in-the-loop BA/developer)
This release carries no hosting cost and can be stood up quickly once the GitHub repo is available.
1. MVP Objective
Deliver a working, safe, and usable platform that:
- reconnects starters with helpers
- restores core functionality lost in March 2026
- supports a controlled relaunch with real users
- establishes a technical foundation for future scaling
Once the sandbox validates the vibe coding approach to deploying the existing code base, a decision can be made about hosting. The natural starting point would be to assess whether LCC’s existing hosting provider (used for lcc.org.uk) can support the platform, avoiding the need to onboard a new supplier.
The MVP scope would include:
- Quick fixes for known defects from the previous platform
- Minor field additions or configuration changes identified during sandbox testing
- A stable, publicly accessible service for LCC members and volunteers
Scope and cost to be confirmed after successful sandbox release.
2. Wider Platform Development
A more ambitious phase — covering reporting enhancements, new features, and deeper integrations — will require more substantial funding. The sandbox and MVP releases will generate the evidence needed to make a credible cost-benefit case to funders and stakeholders.
Why This Approach Makes Sense
The combination of AI-assisted development tools and a lean volunteer-led model means LCC does not need to wait for a large budget to get something working. A low-cost sandbox can be live quickly, de-risking the sponsorship conversation and giving LCC something tangible to show prospective funders — before committing to a full tender.
Added 2026-06-13
Security and Reputational Assurance
A key concern raised was whether a volunteer-led, AI-assisted build could provide the same security assurance as an established third-party supplier — particularly given that LCC lacks in-house technical expertise and would be exposed to reputational risk in the event of a data breach or incident.
This is a legitimate concern, but the choice of who builds the platform and the question of _how it is secured and assured_are separable decisions. A large agency does not automatically mean a secure product — and a lean build does not mean an insecure one.
The proposed approach is to treat security assurance as a distinct workstream, commissioning specialist third parties specifically for:
- Penetration testing — an independent ethical hacking exercise against the live or staging environment, producing a formal report LCC can retain as evidence of due diligence
- Performance and load testing — verifying the platform holds up under realistic traffic, particularly around any campaign launches
This gives LCC the independent, credentialled sign-off it needs for governance and reputational purposes, without bundling that cost into the full build contract. Penetration testing from a CREST-accredited firm can typically be scoped for a few hundred to low thousands of pounds depending on the surface area — far less than the premium a large agency would embed in their overall fee to cover the same assurance.
The result: a lean build with independent security validation, rather than an expensive build with security assurance that is harder to scrutinise.
Open Source Codebase
A Future Option, Not an Immediate Decision
The current codebase is closed. Open source is not a decision that needs to be made now — but it is worth flagging as a natural conversation point after the sandbox release, and particularly as part of any wider funding discussion.
The case for opening the codebase grows stronger if national cycling organisations express interest in adopting the platform, or if a funder is sought who could support collective code hardening and wider rollout. At that stage, commissioning a third party to review and strengthen the codebase as part of a transition to open source would be a credible and fundable piece of work.
For now: deferred, and worth revisiting.
Advantages
- Wider adoption — national cycling groups or other behaviour-change charities could deploy their own instances, extending the impact of LCC’s investment without additional build cost
- Community contribution — other developers could submit improvements, bug fixes, or new features, reducing the long-term maintenance burden on LCC
- Transparency and trust — open code can be independently reviewed, which actually supports the security case: vulnerabilities are more likely to be spotted and reported responsibly
- Funder appeal — some grant-making bodies, particularly in the civic tech and NHS space, actively favour open source as it demonstrates public benefit beyond the commissioning organisation
- Avoids lock-in — LCC is not dependent on a single supplier; any competent developer can pick up and continue the work
- Credibility for the volunteer model — publishing the code publicly signals confidence in its quality and invites scrutiny, which is a stronger assurance than keeping it closed
Disadvantages
- Security through obscurity is lost — a closed codebase gives attackers less information; open source means anyone can study the code for weaknesses. This is largely mitigated by good security practice and penetration testing, but it does raise the importance of doing those things properly
- Configuration and secrets discipline — the team must be rigorous about never committing API keys, database credentials, or environment-specific configuration to the public repo. This is standard practice but requires explicit discipline
- Reputational exposure if code quality is poor — the code will be publicly visible. This is actually an argument for quality, not against open source, but it may feel uncomfortable early in the build
- Governance overhead — if external contributors start submitting code, someone needs to review and accept or reject it. For a small volunteer project this could become a distraction
- Competitor or misuse risk — low in this context, but theoretically another organisation could take the code in a direction LCC would not endorse. A licence choice (e.g. GPL, AGPL, or Creative Commons for non-code assets) can manage this
Recommendation to consider ↑ Top
Open source is likely medium to long term net positive for a project of this type — it aligns with LCC’s charitable mission, reduces long-term dependency risk, and strengthens the case with funders. The practical risks are manageable with standard discipline and an appropriate transition plan. An important decision at the tie is choosing the right licence: if LCC wants to ensure that any organisation deploying the code must also publish their modifications (preventing proprietary forks), the AGPL licence is worth considering. If broader adoption with fewer restrictions is the priority, MIT or Apache 2.0 are simpler choices.
cycling buddies ground up build is a proposal that was made assuming no access to previous code. This was confirmed as not necessary by Mike on Friday 12th June