m.arab

Pune, India · UTC+5:30 · Open to remote

Muhammad Arab

Software Engineer · Full-Stack Product & Backend

Four years in, delivering whole products: a marketplace app carrying both the consumer and the provider side, built solo from first scaffold to both app stores in under four months, the order-processing engine at the core of an 11-module SaaS platform, and a live geo-search product serving 27,000+ verified locations. Comfortable with payments, multi-tenant security, and zero-downtime migrations.

01

Experience

Bee Logical Software

Sep 2023 – Present

Software Developer · Remote, clients in the US and EU

Three years, three client products, growing ownership: platform architecture for Saralux M360, a cross-company design system for Irys Cloud, then a marketplace app shipped solo. Along the way, a mentor to junior developers.

Dog go · Dog-care marketplace for the EU market, consumer and provider sides in one app

May 2026 – Present

Sole developer on the React Native app: 60 screens covering both the consumer and provider sides, scaffold to App Store and Play Store submission in three and a half months.

  • Built the payments experience on the app side of Stripe Connect: card collection, provider onboarding with deep-link returns, and the consumer and provider flows behind payouts and commission accounting.
  • Built the React admin portal, with provider verification, trust scoring, and GDPR account deletion. Contributed targeted endpoints and fixes to the Node and PostgreSQL API (127 endpoints across 35 tables), which was owned by a separate backend team.
  • Handled release engineering solo: EAS build profiles, store assets, a version-gate endpoint, and the client handover runbook. Closed 66 QA defects across the three surfaces.
  • React Native
  • Expo
  • Node.js
  • PostgreSQL
  • Stripe Connect

Saralux M360 · 11-module association-management SaaS

Sep 2023 – Present

Architected the platform's order-processing engine, which replaced the legacy web-order flow and now handles every transaction. Orders break into steps and tasks, retry on failure, separate critical from non-critical errors, and can be bulk-reprocessed when a batch goes bad.

  • Led the cutover to that architecture: feature toggles per module let us move ten product modules one at a time instead of in a single risky release.
  • Delivered 495 work items and 446 merged pull requests over 70 sprints at a 96% completion rate. Top four of twenty-plus contributors on both flagship repos.
  • Moved application submission to asynchronous processing, previously the slowest action on the platform.
  • Identified and fixed an insecure direct object reference on the multi-tenant boundary: customer IDs belonging to one tenant were reachable from another, so the lookup was rescoped to the session's own tenant rather than trusting the identifier the client sent.
  • NetSuite SuiteCommerce
  • SuiteScript
  • SQL
  • Azure DevOps

Irys Cloud · Commercial insurance agency-management platform

Nov 2025 – May 2026

Started the v2 track of the company's npm-published UI library, used by around thirty engineers across four companies.

  • Built the first v2 components, a shared Tailwind token preset, and a Rollup build with its own release pipeline.
  • Built a component showcase that generates live docs and interactive prop controls straight from typed component metadata.
  • Wrote reusable hooks that enforce business rules across opportunity and case workflows.
  • Next.js
  • TypeScript
  • Tailwind CSS
  • Rollup

Aonia Tech (MadScientist)

Dec 2022 – Sep 2023

Full-Stack Developer Intern · Remote

  • Second by commit count across both frontends of a science and technology social platform, and the only engineer who worked on both the React v1 product and the Angular 16 rewrite.
  • Added Google OAuth sign-in across the React client and the Node and MySQL backend, then fixed the password-reset flow for accounts that had never set a password.
  • Added comment pagination and a per-viewer like-status join in the model layer to cut client round trips. Removed password fields that were leaking into API responses.
  • React
  • Angular
  • Node.js
  • Express
  • MySQL
02

Selected Work

Masjidly

Feb 2024 – Present

Location-based masjid discovery platform

  • 27 months solo
  • 663 commits
  • 31 versioned endpoints
  • 12 tables

Designed, built, and run solo for 27 months: a pnpm monorepo on Next.js 15 and React 19, live in production with real users.

  • Built a resumable ingestion pipeline over OpenStreetMap and Google Places. It seeded 27,714 verified locations across 930 grid cells in 65 minutes with no errors, and caught 623 duplicates through a tiered PostGIS and trigram matching cascade.
  • Designed the PostgreSQL schema with 9 triggers and 6 stored functions, including a faceted geo-search that resolves nine optional parameters in one query.
  • Centralized routing so auth gating and robots.txt both derive from route groups. Locked down the deployment with a strict content-security policy and versioned service-worker caching, and reworked OAuth account-linking so two identities cannot be silently merged.
  • Next.js 15
  • React 19
  • PostgreSQL
  • PostGIS
  • Supabase
  • pnpm

Khatabook

Jul 2026 – Present

Billing, inventory, and customer credit for a hardware store

  • In daily counter use
  • 7 tables, 3 derived views
  • 6 invariants in the schema

An internal system for a cement, steel, paint, and plumbing retailer, used every day on a phone behind the counter. Every number the shop acts on is derived rather than stored: balances, stock on hand, and the full customer statement are database views over immutable sale, payment, and stock-movement rows, so there is no running total that can drift away from the transactions underneath it.

  • A line total cannot disagree with its own arithmetic. Amount is a generated stored column of quantity times rate, rounded at two decimals, with money held at numeric(12,2) and quantity at numeric(12,3) so half a ton of steel or a part bag of cement stays exact.
  • Business rules are check constraints rather than form validation: a credit sale must name a customer while a cash sale need not, a GPay payment must carry the account it landed in, a cheque must carry its number. Customers onboard with an opening balance, so an existing paper ledger moves across without inventing transactions that never happened.
  • Built for the actual point of use: installable on the shop phone, rupee amounts in Indian digit grouping with DD/MM/YYYY dates throughout, a print stylesheet that turns a customer statement into a PDF to send over WhatsApp, and a single-file JSON export of every table.
  • React 18
  • TypeScript
  • PostgreSQL
  • Vite
  • PWA

Agentic Delivery Pipeline

2026

Spec-driven development process for LLM coding agents

  • 5 stages
  • 108 database tests
  • 23 self-corrections

A five-stage pipeline (planning, data layer, UI, review, retrospective) built around a written spec as the single source of truth, with acceptance criteria on every task.

  • Review stages run migrations, isolation tests, typechecks, and secret scans before auditing the build against each acceptance criterion.
  • Retrospectives feed what went wrong back into the pipeline's own instruction files: 23 changes so far.
  • Ran it end to end on FinanceTracker, a personal finance tracker on Supabase. Shipped with 108 database tests, 21 of them cross-tenant RLS isolation probes covering every tenant-scoped table.
  • Claude Code
  • Supabase
  • PostgreSQL RLS
  • Vitest
03

About

The unit of work I take on now is the whole product: the architecture call, the migration that carries ten modules across it, the store submission, and the runbook the client gets at handover. What changed between my first year and this one is not the stack. It is that I am the one who decides, and the one the decision comes back to.

The decisions I trust most are the ones that cost something up front. Breaking orders into steps and tasks made the first version slower to write and made every failure recoverable and every bad batch reprocessable. Moving ten M360 modules one at a time behind per-module toggles meant ten cutovers instead of one, and none of them needed a maintenance window or a rollback.

I am opinionated about three things. A critical error and a retryable one are different events and should not share a branch. Multi-tenancy is a security boundary rather than a WHERE clause: I have found and fixed the insecure direct object reference that proves it, and I now write the isolation probes first, which is why 21 of the 108 database tests on my latest build do nothing but try to read across tenants. And anything the database can guarantee should not be guarded in application code, which is how Masjidly ended up with 9 triggers and 6 stored functions instead of a service layer everyone has to remember to call.

I mentor the junior developers on my team. I keep Masjidly running because I wanted one system that was entirely mine: 27 months solo, live, with real users, and the place I make the calls I would not test on a client timeline. The same instinct produced the delivery pipeline I use to hold LLM coding agents to a written spec.

Backend
Node.js, TypeScript, Express, PostgreSQL (PostGIS, RLS, stored functions), Drizzle ORM, MySQL, REST design, Stripe Connect, OAuth 2.0, webhooks, batch processing
Frontend & Mobile
React, Next.js, React Native (Expo, EAS), Redux Toolkit, TanStack Query, Tailwind CSS
Infra & Tooling
GitHub Actions, Azure DevOps, Vercel, AWS (S3, SES), GCP Maps, Firebase, Supabase, Vitest, Jest
Education
B.Tech, Computer Science and Engineering
MIT World Peace University, Pune
2019–2023 · CGPA 9.02/10
Recognition

Innovative Excellence 2025, Bee Logical: for the M360 order-processing architecture

Collaborative Spirit 2024, Bee Logical: for mentoring junior developers