hi. I build the part of the application nobody sees until it breaks.
backend-focused developer working with APIs, databases, authentication, security, performance, and the occasional production fire.
about me (philosophy, skills & stack)
/* tech-agnostic // battle-tested // click any stack item for rationale */
Backend Visionary (3+ Years)
Building highly-resilient backend ecosystems with 3+ years of high-impact engineering. My code transforms complex requirements into scalable, AI-driven logic.
AI Frontier & Agentic LLMs
Deep exposure to the AI frontier: Orchestrating LLMs with Ollama, LMStudio, and Antigravity. I bridge the gap between human intent and machine execution.
Logical & High-Velocity Execution
Logical and results-driven full stack developer dedicated to building and optimizing user-focused applications with a calm and focused demeanor.
Uncompromising Quality
Warning: I am the candidate your recruiter warned you about. The good one.
TECHNICAL TOOLBELT & INFRASTRUCTURE MATRIX
engineering resume (experience & project post-mortems)
Structured by company experience. Each role details the exact systems architected, production challenges solved, and full code deliverables.
Freelance & Independent Client Engineering
// Full Stack & Backend Specialist
"Architecting custom, production-grade enterprise backends, real-time collaboration engines, e-commerce platforms, and specialized B2B/B2C workflow systems for tech startups and international clients."
🛒 E-Commerce Platform
/* High-concurrency fashion e-commerce backend with multi-variant catalog, session-bound inventory reservation, and resilient checkout pipelines. */
Engineered a robust e-commerce engine designed to prevent race conditions during high-concurrency checkout waves while ensuring flawless media payload consistency across cart and payment steps.
- Designed a multi-variant product catalog schema mapping complex SKU attributes (size, color, material, stock counts)
- Implemented session-bound inventory reservation locks in Redis (`SETNX` with 30s TTL) to eliminate stock overselling during flash checkout rushes
- Created a standardized `resolveImageUrl` media fallback utility ensuring nested variant thumbnails are cleanly resolved across instant 'Buy Now' and persistent cart flows
- Engineered idempotent Stripe webhook handlers with event log tracking for automatic order fulfillment and automated inventory reconciliation
🏢 HRMS Lite (hrms-v1)
Human Resource Management System/* Lightweight HRMS backend with biometric attendance ingestion, granular RBAC, automated payroll calculation, and instant JWT session revocation. */
Built to solve high-frequency morning rush bottlenecks when thousands of employees check in simultaneously via biometric devices, preventing database deadlock crashes while keeping employee data strictly governed.
- Engineered a biometric punch-in ingestion queue using Redis lists, buffering 10,000+ morning 9:00 AM check-in events into 5-second transactional PostgreSQL batch inserts (`INSERT ... ON CONFLICT DO NOTHING`)
- Implemented granular Role-Based Access Control (RBAC) middleware enforcing strict permission boundaries across Admin, HR Manager, and Employee roles
- Designed automated payroll calculation engine evaluating tax deductions, leaves, unpaid mark-offs, and net monthly payouts
- Built a JWT session revocation blacklist in Redis for instant employee offboarding and immediate credential invalidation
🧵 Garment Production & Invoicing Engine
/* Multi-currency B2B bulk invoicing engine, automated tax/GST routines, transactional garment production workflow tracker, and asynchronous PDF rendering workers. */
Designed for garment manufacturing factories to manage complex production cycles (cutting -> stitching -> QC -> packing) and generate multi-tier tax invoices without blocking server HTTP threads.
- Engineered multi-currency B2B bulk invoicing engine with automated GST, regional tax, and volume discount calculation routines
- Built transactional garment production workflow tracker tracing raw fabric rolls and trim materials through to finished unit inventory ledgers
- Decoupled heavy 300DPI PDF document rendering from HTTP request handlers using Redis & BullMQ background job queues, streaming completed invoices via presigned download URLs
- Created audit-logged inventory ledger maintaining historical cost snapshots for every fabric batch
/* Real-time emergency blood donation matching platform connecting seekers with nearby verified donors, donor health cooling state machine, and GIS radius search. */
A mission-critical life-saving application built for rapid emergency response, enforcing donor health safety while guaranteeing zero duplicate claims when emergency notifications trigger.
- Built WebSocket real-time push notification service dispatching immediate emergency alerts to matching blood donors within a specified geographic radius
- Implemented an automated 90-day donor cooling period state machine to enforce health safety and restrict re-donations before eligibility
- Engineered Redis atomic locks (`SETNX`) on emergency donation requests to prevent duplicate acceptances when multiple donors respond simultaneously
- Built an administrative verification dashboard for authenticating medical requests and managing user access
/* Generative AI technical interview simulator with architect-level feedback, local LLM GPU fallback, and candidate communication analytics. */
An AI-powered interview simulator designed to conduct real-time technical and behavioral interview rounds, providing deep architect-level feedback on clarity, confidence, and system design.
- Orchestrated Generative AI multi-agent workflows using Antigravity and Gemini Pro APIs for adaptive interview simulation
- Integrated local LLM backup fallback via Ollama / LMStudio running on dedicated GPU nodes to ensure 100% operational uptime when cloud quotas exhaust
- Built streaming response parser evaluating candidate answer clarity, technical depth, and communication nuances in real-time
- Designed adaptive difficulty algorithms scaling question complexity dynamically based on candidate performance
/* Real-time room-based whiteboard application with Fastify WebSockets, Redis room state persistence, coordinate delta broadcasting, and canvas archives. */
A multiplayer canvas collaboration platform allowing isolated private rooms to draw, erase, chat, and store drawings without latency degradation.
- Built Fastify WebSocket room server handling sub-5ms multi-user canvas drawing synchronization
- Reduced WebSocket broadcast payload size by 94% by switching from full canvas frame snapshots to coordinate delta vector streams
- Integrated Redis for in-memory room state storage, allowing instant canvas state recovery upon user page reload
- Engineered long-term PostgreSQL snapshot archival service for preserving completed whiteboard sessions
/* Multi-device authentication system using QR codes, 1-hour session timeout, 3-minute single-use Redis nonces, and CryptoJS encryption. */
Designed to provide seamless multi-device linking for banking and secure enterprise applications by scanning single-use QR codes from primary mobile sessions.
- Designed multi-device authentication protocol allowing users to securely pair up to 2 secondary devices per active session
- Implemented short-lived 3-minute QR code validity powered by dynamic single-use Redis TTL nonces to prevent replay attacks
- Built CryptoJS payload encryption for secure device handshake exchanges over public networks
- Enforced strict 1-hour session expiration and automatic token revocation
Zeksta Technology Pvt Ltd
// Software Engineer (Fintech Lead)
"Lead Backend Engineer for the Sangamam Cooperative Banking Ecosystem. Single-handedly architected and delivered core financial modules under crushing time constraints with extreme velocity."
🏦 Sangamam Core Banking Platform
Customer & Agent Mobile Backend Ecosystem/* Architected and delivered 4 core banking modules from scratch, shipping 20+ major features, 45+ REST APIs, and 50,000+ lines of code within 3 months. */
Demonstrated high-velocity execution by maintaining a relentless 173-commit cadence across 50 active engineering days under crushing deadlines. Built the entire backend infrastructure powering mobile customer onboarding, agent collection apps, fund transfers, and administrative reporting.
- ⚙️ Mobile Onboarding & Device Security: Designed and shipped customer and agent mobile app backends with Aadhaar OTP verification, MPIN setup, account linking, and strict device binding for maximum security.
- 💸 Fund Transfer Engine: Built intra-bank transfer flow utilizing a two-phase commit pattern in PostgreSQL transactions, atomic debit+credit execution, Redis rate-limiting, counterparty visibility, and automated commission calculations.
- 📊 Admin Reporting & Accounting Engine: Built a comprehensive reporting engine from scratch (4,000+ lines of logic) serving as the data backbone for admin dashboards with granular branch-level RBAC.
- 📒 General Ledger System: Engineered full double-entry General Ledger (GL) voucher accounting system requiring multi-step balancing workflows and document attachments.
- ☁️ Cloud Infrastructure & AWS ECS: Orchestrated resilient containerized microservices on AWS ECS, utilizing S3 for compliance document storage, behind secure API gateway load balancers.
- 🛠️ Standards & Documentation: Established baseline database migrations, standardized TypeScript types, and 100% Swagger API documentation adopted across the entire platform scale.
Quantela & Innovation Lab
// Associate Software Engineer
"Engineered mission-critical backend modules for major government civil court web applications (eNibandan) and land transaction systems (MPWebGIS)."
📜 Civil Court Marriage Registration Engine
eNibandan Govt Civil Court Web Module/* Government civil court web application module handling the full lifecycle of legal marriage applications, multi-tier officer approvals, and automated 30-day notice objection periods. */
Active lead backend engineer on the second largest civil court module (following land registration), handling complete workflow automation, notice period scheduling, and biometric eKYC verification.
- ›Citizen Role: Bride and bridegroom details registration, secure application payment processing.
- ›Assistant to Sub-Registrar: Document verification, authority to approve or send back for corrections.
- ›Sub-Registrar (SRO): Comprehensive review, approval/rejection authority, entering approved applications into mandatory 30-day notice objection period.
- ›Operator to Sub-Registrar (OSR): Biometric verification (eKYC) and final marriage certificate record issuance.
- Engineered complete 4-role state machine managing transitions between Citizen -> Assistant -> Sub-Registrar -> OSR eKYC
- Automated 30-day objection notice tracking using node-cron schedulers, automatically transitioning un-objected applications to appointment-ready status
- Integrated secure biometric eKYC verification data handling and digital certificate record generation
- Optimized PostgreSQL database schemas for legal compliance and auditability
MAP MP Land Transaction Premutation System
MPWebGIS / IGRS Department Module/* MP Government land transaction system facilitating land partition sales, GIS visual selection, real-time availability validation, and automated payment deadline releases. */
Facilitates seller and buyer land partition transactions by integrating GIS visual land sketch selection with real-time double-transaction prevention.
- Developed and maintained the Premutation Module verifying land sketch transactions submitted to the IGRS department
- Integrated GIS-based visual land selection enabling users to select partition boundaries directly via GIS interfaces
- Integrated real-time availability checks preventing concurrent transaction attempts on the same land partition
- Enforced 48-hour payment validation rules: if payment is incomplete after 48h, cron automatically releases the land back to the public pool; if left un-submitted for 72h, it is auto-rejected
- Optimized high-volume land record database queries using Knex.js and Redis temporary caching, handling peak loads of 1M+ active records
🧠 Enterprise AI Search & IaC Infrastructure
/* Local LLM integration with Ollama and Terraform cloud automation for enterprise microservices. */
Integrated local LLMs (Ollama) into internal developer tools, reducing search time by 60% and automating infrastructure deployment across cloud environments.
- Integrated local LLM runtime (Ollama) for internal code and documentation search, speeding up dev search by 60%
- Automated infrastructure provisioning across AWS using Terraform, reducing deployment lead time significantly
- Optimized PostgreSQL query layer for 40% improvement in AWS cloud resource utilization
how I think (principles from the trenches)
/* 9 rules I live by when building backends */
1. Build the API first
// contract > UIDecouple backend contract design from UI implementation. A clean API doesn't care if the caller is React, a mobile app, or a curl command.
2. Understand data before writing queries
// EXPLAIN ANALYZE alwaysDraw the ERD diagram and query execution plan before writing complex joins. Indexes exist because databases also get tired.
3. Validate input at the boundary
// input = suspect until proven validNever trust frontend validation. The client is an untrusted remote CLI. Validate schemas with strict Zod parsing at the API gateway.
4. Assume users will send weird requests
// expect the unexpectedIf your endpoint accepts a string, someone will send a 40MB PDF or a SQL payload. Handle edge cases defensively with explicit limits.
5. Authentication is not authorization
// roles are not vibesKnowing WHO someone is (Authentication ✅) does not mean they get to touch or delete the requested resource (Authorization ❌).
6. Logs are part of the product
// debug-ready logsLogging 'Error: request failed' is useless. Log structured context: correlation ID, user ID, payload digest, latency, and stack trace.
7. Performance must be measured, not guessed
// p99 > average latencyDon't guess where the latency bottleneck is. Run JMeter stress suites, inspect p99 distributions, and profile socket queues.
8. Security is an architectural constraint
// zero trust by defaultSecurity is not a checkbox you review before launch. Rate limits, CORS, TLS, least privilege, and parameter sanitization belong in core architecture.
9. Production is the final exam
// local host = optimismYour system works on your machine? Great. Production is where real concurrency, network drops, and unexpected edge cases evaluate your code.
How Requirements Become Code (the engineering pipeline)
Good developers do not immediately start writing controllers. Here is how feature requests are analyzed, modeled, secured, and implemented for production systems.
/* requirements → architecture → code */
END-TO-END ENGINEERING PIPELINE
Money Transfer Architecture (₹10,000 Case Study)
Tracing a real financial transaction through business rules, DB row locks, idempotency, security, outbox events & observability.
Business Statement: "Customer transfers ₹10,000 to Beneficiary"
Real Requirement Transformation
Tracing a simple business sentence through all 10 engineering stages.
Business Requirement
What the stakeholder saidBefore I Touch the Keyboard
Essential questions clarified before writing a single line of API code.
"Who is the user?"
Customer, Admin, Partner API client, or internal background job?
"What problem are we solving?"
Are we solving a real operational pain point or building an unnecessary abstraction?
"What is the expected behavior?"
What does success look like, and what data payload should be returned?
"What happens when it fails?"
Do we return 4xx/5xx errors, trigger retries, or fail gracefully with fallbacks?
"What happens when the same request arrives twice?"
Will duplicate POST requests create duplicate orders or be safely deduplicated via Idempotency-Key?
"Who is allowed to perform the action?"
What role bitmask or policy is required to access this endpoint?
"What data is required?"
What fields are required in the payload, and what are their strict Zod constraints?
"What data should never be collected?"
Are we accidentally storing raw credit cards, unhashed passwords, or PII?
"What are the expected traffic levels?"
Is this 10 requests per hour or a 5,000 req/sec flash sale?
"What happens under concurrency?"
Will simultaneous requests cause SQL race conditions on stock or account balances?
"What must be audited?"
Do financial, security, or data mutations need immutable audit log records?
"What must be reversible?"
Can orders be canceled, payments refunded, or inventory reservations released?
"What are the external dependencies?"
Are we relying on Stripe, Twilio, SendGrid, or third-party webhooks?
"What are the regulatory constraints?"
Does GDPR, PCI-DSS, or SOC2 compliance dictate data retention policies?
"What happens if a third-party service is unavailable?"
Do we have circuit breakers, fallback queues, or timeouts in place?
Functional vs Non-Functional Requirements
Core features, business capabilities, user inputs, and output behaviors.
- ›Create customer order and record cart items
- ›Update user profile & delivery addresses
- ›Process payment charge via credit card gateway
- ›Generate monthly PDF invoice reports
System qualities, performance limits, security boundaries, and operational constraints.
- ›Response Time: p99 latency < 200ms
- ›Availability: 99.9% uptime SLA guarantees
- ›Security: OWASP Top 10 + RBAC bitmask enforcement
- ›Auditability: Immutable audit logs for state changes
Acceptance Criteria (Given-When-Then)
Turning vague business requests into testable engineering behavior.
Valid Reset Request
Expired Reset Attempt
Rate Limit Exceeded
API Protocols & Communication Styles
Knowing when to use REST, GraphQL, gRPC, WebSockets, SSE, or Webhooks.
REST
DECISION MATRIXUniversal browser support, HTTP caching (ETags), simple status codes.
Over-fetching / under-fetching entity graphs.
Building clean resource-oriented endpoints with standard HTTP caching.
Advanced HTTP & Resiliency Patterns
// 1. Idempotent Deduplication (Redis key 24h TTL)
const idempotencyKey = req.headers["x-idempotency-key"];
const cachedResponse = await redis.get(`idemp:${idempotencyKey}`);
if (cachedResponse) return res.json(JSON.parse(cachedResponse));
// 2. Optimistic Concurrency Control (Version Check)
const updatedRows = await db("accounts")
.where({ id: accountId, version: currentVersion })
.update({ balance: newBalance, version: currentVersion + 1 });
if (updatedRows === 0) throw new ConcurrentUpdateConflictError();// 1. Timeout external requests after 5000ms
const response = await fetch("https://gateway.payment.com", {
signal: AbortSignal.timeout(5000)
});
// 2. ETags & Conditional 304 Not Modified
const etag = generateHash(responseData);
if (req.headers["if-none-match"] === etag) {
return res.status(304).end(); // Zero payload transfer
}
res.setHeader("ETag", etag);Turn Nouns into Data. Turn Verbs into Behavior.
Extracting domain entities and relationships from real-world business requirements.
Customer (1)
└── Order (1..N)
├── OrderItem (1..N)
│ └── Product (1)
└── Payment (1)Domain modeling dictates table foreign keys, invariant rules, and cascade deletes.
Architecture Is a Decision, Not a Buzzword
1. Layered Architecture
Strict separation of HTTP, business logic, and database access
Controller → Service → Repository → DatabaseMonolithic applications, REST APIs, domain-driven CRUD apps.
Easy to reason about, low overhead, clear code organization.
Can encourage heavy database reliance if service logic spills into SQL.
Why Did I Choose This Architecture? (ADRs)
Engineering means choosing trade-offs, not collecting buzzwords.
ADR-001: SQLite (WAL Mode) vs PostgreSQL for Local Portfolio Storage
Use SQLite with Write-Ahead Logging (WAL) via `better-sqlite3`.
Portfolio site needs lightning-fast reads without heavy external database server overhead.
Zero operational configuration, single-file deployment, sub-millisecond local reads, full SQL query support.
Limited concurrent write throughput (not an issue for portfolio read workloads).
Coding Principles (Rules I Follow)
A module should have one clear reason to change.
Keep HTTP routing, business calculations, and SQL queries in separate files.
HTTP → Business Logic → Data Access.
Never write raw database SQL directly inside API request handlers.
High-level policy should not depend on low-level details.
Core business logic imports interfaces, not specific cloud SDK packages.
"DRY doesn't mean turning 2 lines of code into a 400-line generic framework."
Avoid duplication, but prefer duplicate code over the wrong abstraction.
Prefer the simplest design that satisfies requirements.
Don't build complex Kubernetes cluster configs when a single VM works.
"Future scale is not a feature request."
Don't write infrastructure for hypothetical features that don't exist yet.
Compose small reusable functions.
Chain focused middleware instead of inheriting deep class hierarchies.
"If I need a decoder ring to review your function, something went wrong."
Readable, obvious code wins over hyper-clever one-liners every time.
Why Is This Query Taking 4.2 Seconds? (EXPLAIN ANALYZE)
Senior backend engineers profile execution plans with EXPLAIN ANALYZE instead of adding more servers.
SELECT * FROM orders WHERE customer_id = 'c_8810' AND status = 'PENDING' ORDER BY created_at DESC;Seq Scan on orders (cost=0.00..18450.00 rows=420 width=128) (actual time=12.400..4185.320 ms) Filter: ((customer_id = 'c_8810'::uuid) AND ((status)::text = 'PENDING'::text)) Rows Removed by Filter: 4,999,580 Sort (cost=18490.12..18491.17 rows=420 width=128) (actual time=4198.100..4202.400 ms) Sort Key: created_at DESC Execution Time: 4205.80 ms <-- ⚠️ 4.2 SECONDS (Table Scan across 5,000,000 rows!)
❌ Root Cause: Missing index forces PostgreSQL to read 5 Million disk blocks sequentially into RAM.
PostgreSQL & Relational DB Mechanics
PostgreSQL writes new tuple versions on UPDATE instead of locking readers, keeping reads non-blocking.
Read Committed (default), Repeatable Read (phantom read protection), Serializable (strict serializability).
Transaction-level connection pooling prevents backend process memory exhaustion under 10,000 clients.
NoSQL Placement Matrix
Redis Caching & Stampede Defense
An API is a Contract
Predictable REST resource endpoints & uniform error payloads.
{
"code": "ORDER_NOT_FOUND",
"message": "Order does not exist or has been deleted.",
"requestId": "req_99182374",
"timestamp": "2026-08-17T14:50:00Z"
}Includes request correlation IDs for instant distributed log tracing without leaking stack traces.
Database Engineering & Layered Rules
What Happens When Step 3 Fails?
Backend engineering involves handling failure scenarios, not just happy paths.
❌ Transaction automatically aborts. Inventory reservation is released, order state is marked `PAYMENT_FAILED`, and no partial orphan records remain in PostgreSQL.
Errors Are Part of the Design
Messaging Platforms & Event Streams
Decoupling synchronous operations into scalable background streams.
Partitions, offsets, consumer groups, immutable log retention for event streaming.
AMQP exchanges, topics, headers, acknowledgment, dead-letter exchanges (DLX).
Pub/Sub fanout (SNS) to isolated worker queues (SQS) with redrive policies.
Failed messages isolated after 3 retries for developer inspection without blocking pipeline.
What Happens If Service A Succeeds but Service B Fails?
Handling distributed transactions across microservice boundaries without 2PC locking.
Guarantees that database state changes and message publishing succeed atomically in 1 transaction.
BEGIN TX → Update Order State → Insert Event to Outbox Table → COMMIT TX → Worker Relays Outbox to KafkaAWS Production Cloud Infrastructure Topology
Secure VPC network segmentation, edge CDN, load balancing, container orchestration, and KMS encryption.
Internet → CloudFront CDN → AWS WAF → Application Load Balancer (ALB)
↓ (Private Subnet)
[ ECS / EKS Cluster ] (HPA)
├── ElastiCache (Redis Cluster)
└── Aurora PostgreSQL (Multi-AZ Read Replicas)Docker & Kubernetes Production Primitives
Compiles TypeScript in build stage and copies only node_modules into dist, reducing image size from 1.2GB to 85MB.
Readiness probe `/api/health` ensures traffic is routed only after DB connections are warm.
Automatically scales Pod replicas from 3 to 30 when CPU utilization exceeds 70%.
Automated Security Gates
Logs, Metrics & Distributed Traces
The Backend Testing Pyramid
Multi-tiered test coverage from isolated unit functions to 5,000 user JMeter load tests.
When Is a Feature Actually Finished?
Not just "the API works on localhost".
The 4 Pillars of Observability
Structured JSON events with request IDs and timestamps.
Counters, histograms, and p99 latency distributions.
Distributed span propagation across microservices.
Immutable security record of data mutations.
CI/CD Pipeline Flow
Environment Isolation
Security by Design & Threat Modeling
What I Look For in a PR
Experienced backend questions asked during code review before approving merge requests.
There Is No Perfect Architecture
"Before I write code, I ask better questions."
“Good code starts before the first line of code.”
"The hardest part isn't writing the endpoint. It's deciding what the endpoint is actually allowed to do."
selected work (backend-focused case studies)
/* click any project to view technical post-mortem */
Sangamam Backend (Core Banking Ecosystem)
2025Cooperative banking platform backend, 45+ REST APIs, multi-branch RBAC, two-phase fund transfers, double-entry General Ledger engine.
Concurrent intra-bank wallet fund transfers caused double-debit balance mismatches under simultaneous mobile app requests.
E-Commerce Platform
2025Modern e-commerce backend platform featuring dynamic multi-variant catalog, inventory reservation locks, persistent cart, and checkout flow.
Cart items lost image thumbnail URLs during checkout transitions due to mismatched nested product data structures.
HRMS Lite (hrms-v1)
2025Lightweight Human Resource Management System, employee attendance tracking, role-based access control, and payroll calculations.
Biometric punch-in devices burst 10,000 requests in a 15-minute window every morning at 9:00 AM, causing database locks on the attendance table.
Garment Production & B2B/B2C Invoice Generator
2025B2B bulk order management, B2C invoice generation engine, automated tax rules, and fabric stock tracking.
B2B bulk invoices with 50+ line items and custom tax tiers were causing PDF rendering to timeout and block concurrent API requests.
BloodLink (Life-Saving Platform)
2024Real-time blood donation platform connecting donors with seekers, donor 90-day cooling period enforcement, and geo-location search.
Seekers were receiving duplicate emergency notifications when multiple nearby donors clicked 'Accept' simultaneously.
AI Interview Coach (LLMs / Antigravity / Ollama)
2025Generative AI technical interview simulator with architect-level feedback, local LLM backup, and real-time streaming analysis.
Cloud LLM API rate limits caused interview evaluation drops during peak user practice sessions.
Collaborative Whiteboard
2024Real-time room-based whiteboard, Fastify WebSocket server, Redis room state persistence, and canvas sync.
Broadcast lag increased linearly as room participant count grew above 50 concurrent drawers.
Add Secondary Devices with QR Auth
2024Multi-device authentication system using QR codes, 1-hour session timeout, 3-minute QR validity, and Redis session caching.
Replay attacks were possible if a generated QR code image was photographed and scanned after the primary user logged off.
Marriage Registration Module (Civil Court e-Services)
2024Government civil court e-services module, multi-tier approval workflow (Assistant -> Sub-Registrar -> OSR eKYC), and 30-day objection notice automation.
Applications entering the 30-day objection period required precise automated status transitions without missing notice deadlines.
Premutation & MP Land Transaction Module (MPWebGIS)
2024MP Government land transaction system, GIS-based land partition selection, real-time double-transaction checks, 48h payment validation cron.
Users selected land partitions but abandoned payment, locking land parcels indefinitely and preventing legitimate buyers from purchasing.
Sangamam Backend (Core Banking Ecosystem)
Non-atomic database updates allowed two overlapping debit requests to evaluate balance checks simultaneously.
Implemented a two-phase commit pattern in PostgreSQL transactions combined with Redis atomic rate-limiting and row-level locking.
Sequelize ORM transactions with PostgreSQL guaranteed ACID compliance, while AWS ECS provided zero-downtime auto-scaling.
"Financial transactions require zero trust in timing; every balance mutation must be atomic and audit-logged."
- ›Architected and shipped customer & agent app backends with Aadhaar/MPIN auth and strict device binding
- ›Engineered intra-bank fund transfer flow utilizing two-phase commit pattern and Redis rate-limiting
- ›Built comprehensive 4,000+ line reporting engine and full double-entry General Ledger (GL) system from scratch
- ›Orchestrated containerized microservices on AWS ECS with S3 compliance document storage
things I learned the hard way (the complete backend tool wall)
/* tools aren't badges; they are solutions to past disasters */
# Node.js & Event Loop
FRAMEWORK"The workhorse runtime engine powering asynchronous, high-concurrency backend services."
# TypeScript
LANG & SPEC"Static type checker ensuring runtime payload shape errors fail during build time instead of 3 AM production calls."
# Fastify
FRAMEWORK"Express's faster, schema-driven cousin engineered for raw API throughput and low latency."
# Express.js
FRAMEWORK"The classic, un-opinionated backend web framework for rapid REST API development."
# NestJS
FRAMEWORK"Enterprise TypeScript framework enforcing clean architectural boundaries across large backend engineering teams."
# PostgreSQL
DATABASE"The rock-solid relational database of choice for financial ledgers, transactional ledgers, and complex queries."
# SQLite & Write-Ahead Logging
DATABASE"Zero-network overhead embedded database that runs in-process with ultra-fast responses."
# MongoDB
DATABASE"Document database ideal for rapidly changing document schemas and unstructured audit logs."
# Redis & BullMQ
CACHE / QUEUE"Ultra-fast in-memory cache and queue engine that sits in front of databases to handle traffic bursts."
# Apache Kafka
CACHE / QUEUE"Event streaming backbone for publishing microservice events asynchronously with zero message loss."
# Elasticsearch
DATABASE"Dedicated search engine for instant full-text search across millions of complex records."
# AWS Cloud (ECS, S3, Lambda)
INFRA / DEVOPS"Cloud infrastructure platform providing resilient compute, elastic scaling, and compliance storage."
# Docker & Containers
INFRA / DEVOPS"Packages application dependencies into isolated containers so code runs identically anywhere."
# Kubernetes (K8s)
INFRA / DEVOPS"Container orchestration system that keeps microservice clusters healthy and autoscaled."
# Terraform
INFRA / DEVOPS"Defines cloud servers, networks, and databases as version-controlled code rather than manual UI clicks."
# Ollama & Local LLMs
AI FRONTIER"Runs AI language models locally on dedicated hardware for private, rate-limit-free AI workflows."
# Antigravity & Agentic Frameworks
AI FRONTIER"Framework for designing multi-step AI agents that can reason, run commands, and execute code safely."
# Apache JMeter
LOAD TEST"Load testing tool used to hammer server APIs with high concurrency before actual users do."
# Postman & Newman
API TOOLING"The primary environment for crafting, testing, and documenting HTTP requests against raw backend routes."
# Burp Suite
SECURITY"Security tool for intercepting and inspecting raw HTTP traffic to catch authorization bypasses."
# Zod Schema Validation
API TOOLING"Validates incoming HTTP request bodies and parameters against strict schemas before executing business logic."
# WebSockets & Socket.io
INFRA / DEVOPS"Real-time bi-directional messaging protocol for live push notifications and multiplayer collaboration."
# Prisma & Sequelize & Knex
DATABASE"Database abstraction tools providing type-safe querying and automated database schema migrations."
# JWT & CryptoJS Security
SECURITY"Cryptographic token system for handling stateless user sessions securely across microservices."
# PM2 & Linux Systemd
INFRA / DEVOPS"Process management suite keeping backend server instances alive 24/7 on Linux VPS nodes."
# Python & Computer Vision
LANG & SPEC"Versatile language used for backend automation scripts, computer vision processing, and AI integrations."
# GraphQL
API TOOLING"API query interface allowing clients to request exact fields, eliminating REST over-fetching."
# Git & GitHub Actions
INFRA / DEVOPS"Version control and automated release engine ensuring every code push is tested and deployed safely."
# Vitest & Jest
API TOOLING"Automated test frameworks verifying backend functions, database queries, and API routes before shipping."
"What happens when 5,000 people hit the API at once?"
things attackers notice before users do (security learning 🕵️♂️)
/* defensive security principles & interactive RBAC engine */
🔐 INTERACTIVE RBAC MATRIX EVALUATOR
Role 'EDITOR' explicitly grants 'UPDATE' permission on resource 'Project'.
Untrusted string concatenation transforms user input into executable SQL code inside the database engine.
Authentication verifies identity. Authorization verifies permissions. Never mix the two.
Protect API infrastructure against credential stuffing, brute force, and runaway scraping bots.
how the backend actually talks to itself (architecture playground)
/* click any step to trace data payload execution */
1. Request Lifecycle
From HTTP payload to SQL row query and JSON response
Sends HTTP POST /api/orders with JSON payload.
{ "item": "Coffee", "qty": 2 }backend stack (human descriptions, no logo wall)
/* grouped by architectural purpose */
Languages
"strict types so runtime bugs hit the compiler, not production users."
"relational queries, indexing strategies, and transactional locks."
"async/await, promises, and Node.js event loop mechanics."
Backend & APIs
"non-blocking I/O runtime powering fast API gateways."
"fast API framework without turning everything into middleware soup."
"Server Components, Route Handlers, and backend-for-frontend APIs."
"clean OpenAPI specs, strict payload validation, and HTTP status codes."
Databases & Caching
"the gold standard relational DB with ACID guarantees and JSONB support."
"lightning-fast local embedded DB for zero-latency local state."
"in-memory caching, sliding window rate limits, and Pub/Sub queues."
Testing & Performance
"stressing APIs with 5,000 concurrent requests before launch."
"API payload exploration, header testing, and collection suites."
"unit tests and integration route testing with mock databases."
Defensive Security
"intercepting HTTP requests to test client-side security assumptions."
"role permission bitmasks, SQLi parameterized queries, and CORS."
"protecting endpoints from brute-force & denial-of-service bot waves."
Infrastructure & DevOps
"reproducible Linux containers so 'works on my machine' works everywhere."
"grep, tailing logs, systemd service units, and SSH remote administration."
"clean commits, GitHub Actions automated build and test pipelines."
what I use vs why I use it (engineering decision matrix)
Node.js & Event Loop
High-concurrency event-driven server runtime
"How to process thousands of non-blocking I/O API connections on minimal memory footprint."
TypeScript
Type safety & developer tooling overlay for JavaScript
"Catching contract mismatches and null pointer exceptions before code ever touches staging."
Fastify
Ultra-high performance HTTP web framework
"Eliminating HTTP framework routing latency spikes under high burst traffic."
Express.js
Standard REST API server framework
"Rapidly bootstrapping HTTP API routing pipelines with zero boilerplate."
NestJS
Structured enterprise microservice architecture
"Preventing large backend codebases from degrading into unmaintainable spaghetti."
PostgreSQL
Relational data persistence & transactional ACID integrity
"Storing complex financial & relational business data with zero corruption risk."
SQLite & Write-Ahead Logging
Embedded lightweight SQL storage
"Providing zero-latency, file-based relational storage without running a standalone DB server."
MongoDB
Flexible document storage
"Storing unstructured or dynamically evolving document attributes without running schema migrations."
Redis & BullMQ
In-memory high-speed data store & queue buffer
"Buffer high-frequency write traffic and answer repeated queries in under 0.5ms."
Apache Kafka
Distributed event streaming log
"Decoupling microservices with durable, replayable event queues at massive throughput."
Elasticsearch
Full-text search & log analytics engine
"Executing sub-second searches across millions of un-structured document records."
AWS Cloud (ECS, S3, Lambda)
Resilient cloud compute & object storage
"Deploying microservices with automated failover, auto-scaling, and secure storage."
Docker & Containers
Runtime environment containerization
"Eliminating environment drift bugs between development laptops and production servers."
Kubernetes (K8s)
Production container cluster orchestration
"Automating zero-downtime rolling updates, pod restarts, and load balancing across multi-node clusters."
Terraform
Infrastructure as Code (IaC) automation
"Making infrastructure provisioning repeatable, audit-logged, and peer-reviewable."
Ollama & Local LLMs
Local private LLM inference engine
"Integrating generative AI into backend applications without cloud rate limits or privacy leaks."
Antigravity & Agentic Frameworks
Agentic AI orchestration & tool-calling framework
"Executing complex multi-step reasoning tasks without human intervention loops."
Apache JMeter
API load & stress testing engine
"Uncovering database deadlocks and memory leaks under simulated extreme traffic."
Postman & Newman
API verification & testing suite
"Verifying backend API responses and error codes independently of UI implementations."
Burp Suite
Web security & penetration testing proxy
"Identifying RBAC flaws, unparameterized queries, and header vulnerabilities before attackers do."
Zod Schema Validation
Runtime data contract & schema validation
"Preventing malformed request payloads from causing silent runtime bugs deep inside business logic."
WebSockets & Socket.io
Real-time bi-directional web protocol
"Pushing server events to connected clients instantaneously without polling overhead."
Prisma & Sequelize & Knex
Type-safe database abstraction & ORM layers
"Bridging TypeScript code models with SQL databases safely and cleanly."
JWT & CryptoJS Security
Stateless authentication & cryptographic security
"Authenticating user requests across distributed services without database session lookups on every request."
PM2 & Linux Systemd
Production process management
"Ensuring zero downtime, automatic crash restarts, and full CPU core utilization."
Python & Computer Vision
Scripting, computer vision, and AI processing
"Handling complex image processing, computer vision algorithms, and AI scripting with ease."
GraphQL
Declarative API query layer
"Fetching complex nested relational data trees in a single client roundtrip without payload bloat."
Git & GitHub Actions
Version control & continuous integration
"Preventing code conflicts and automating test execution before code reaches production."
Vitest & Jest
Automated test execution suite
"Guaranteeing legacy code doesn't break when new features or refactors are merged."
things I'm currently learning (learning roadmap)
Backend Fundamentals & HTTP Specification
HTTP status codes, headers, method semantics (GET vs POST vs PUT vs PATCH vs DELETE), idempotent vs non-idempotent operations, body stream handling.
HTTP/3 QUIC protocol details & custom HTTP proxying layer tuning.
API Architecture & Gateway Design
REST principles, OpenAPI specs, validation schemas (Zod/TypeBox), routing overhead, middleware chains, error handling standardization.
gRPC proto contracts and Protobuf serialization speed comparisons against JSON.
Database Design & SQL Performance
Relational schema design, 3NF normalization, foreign key constraints, B-Tree index mechanics, EXPLAIN query planner output, connection pooling.
Sharding algorithms and PostgreSQL multi-region active-active logical replication.
Caching Patterns & Memory Stores
Cache-aside strategy, write-through caching, TTL policy selection, cache stampede prevention, Redis memory data types.
Memcached vs Redis cluster key distribution hashing under node failures.
notes from the backend trenches (developer sticky wall)
/* developer observations collected over years of production outages */
"Never trust frontend validation."
Client-side validation is for UX. Backend validation is for security and data integrity. Anyone can send raw HTTP requests with curl or Postman.
"Indexes exist because databases also get tired."
Scanning 1,000,000 unindexed rows for every user search query turns your database server into a space heater.
"Authentication without authorization is just knowing someone's name."
Verifying WHO the user is doesn't mean they are allowed to read, edit, or delete the resource they requested.
"Burst traffic shouldn't hit relational databases directly."
Buffer high-frequency write traffic in Redis memory queues first, then flush in transactional batches to PostgreSQL.
got a backend problem?
Tell me what is broken. I promise not to immediately blame DNS.
