Saif Al-Islam Tirab

Web development work usually lives in scattered, unauditable channels — chat threads, email chains, verbal promises. Scope drifts, payments get messy, incidents have no timeline, and the client has no honest view of progress. Coordination eats the engineering time, and trust erodes on both sides.

One Next.js application with TypeScript end to end — server-rendered public pages and client workspace alike. Prisma models the domain (roughly 37 entities: users, projects, requests, proposals, tasks, releases, deployments, incidents, invoices, ledger entries, products, licenses, posts, subscribers, notifications, audit activity) over SQLite on a Linux VPS behind nginx. Site content and platform settings are admin-controlled through a Setting-driven CMS, so the site evolves without redeploys. Secrets live only in the server environment — never in the database or the client bundle.

Authentication combines credentials, one-time codes and social sign-in (Google live, GitHub ready) with email verification; role-based access separates the admin console from client workspaces. The commerce engine covers fixed-price proposals, invoices, milestone funding, a double-entry-style ledger, and a digital market with instant license-key issuance. Operations get incident timelines, deployment records, an activity audit log, rate limiting and bot-resistant public forms, plus an email system with a template registry, event matrix, delivery log and signed unsubscribe links. An automated regression suite — 360+ checks across auth, payments, requests, operations and email — runs against every release.

Operating as both the builder and the operator means every shortcut is eventually paid for personally. The database evolved repeatedly while production traffic was live — schema changes executed as backed-up, step-by-step migrations. OAuth callbacks had to survive a reverse-proxy topology that rewrites request origins. Email had to earn deliverability on a young domain — proper provider wiring and template discipline rather than a bulk sender.

Strong conventions over configuration sprawl: one codebase, one design system, one source of truth per concern — settings in the database, secrets in the environment, uploads on disk with metadata in rows. Admin controls replace redeploys for content and branding. Honest infrastructure: a public health endpoint and status page reporting real checks, never hardcoded green.

The platform runs the business it was built for — requests, funding, builds, reviews, deployments and maintenance all happen inside it, live at backend.ly. It ships with truthful status reporting, a compliant newsletter loop, a documentation center for clients, and a regression suite standing guard over the next change.