Things I’m building, and what they cost me.

Fewer, harder projects. Each one lists the decision I had to get right and the one I got wrong first.

PROJECT 01 · ACTIVE · PRIVATE REPO

Xylodesk

An all-in-one career platform. Recruiting orgs get an ATS shaped around their real hiring workflow with role-based access; job seekers get one account, a real public profile, a resume builder, and fit-based matching instead of applying into a void. Built solo, from schema to UI.

For job seekers
  • One account across every org — track applications and follow-ups in one place, not scattered across employer portals.
  • A real public profile and resume builder instead of retyping the same résumé into every form.
  • AI-assisted resume writing on your own content, opt-in and consent-gated.
  • Fit-based job discovery with an explained breakdown of why a role matches, not just a score.
For hiring teams
  • One ATS workflow for the whole hiring team with role-based access: admin, HR, recruiter, hiring manager.
  • Employee directory and reporting structure, with compensation gated by role.
  • Every organization's data strictly isolated from every other's, by design.
  • On the roadmap: retention-risk and internal-mobility signals the data already supports.
Decisions worth defending
Fail-closed tenancy

acts_as_tenant configured so an unscoped query raises rather than returning nothing — silence is the dangerous failure mode. Deliberate cross-tenant paths carry an explicit record-level authorization check.

Two models, not one

Public candidate profile and internal HR record split early, so compensation data can never leak into a public page through a shared field.

Compliance by design

GDPR erasure that also respects employer retention duties: a 30-day window anonymizes retained records in place instead of deleting rows other data still references.

AI behind one gate

Every AI feature runs only after data-processing consent, checked at a single chokepoint rather than repeated — and possibly missed — at each call site.

Rails 8 (API-only)GraphQLMySQLReactNext.jsTypeScriptSolidQueueGeminiRepo private while in development — happy to walk through the code.
PROJECT 02 · IN USE DAILY

A review pipeline that gates my own pull requests

Working solo means nobody catches what you miss. So I built four specialized Claude Code subagents that review my work before it ships — AI as a second set of eyes, not a faster typist. Nothing non-trivial gets pushed until a hunt → fix → re-hunt loop comes back clean.

Architect

Reviews a design or open issue before any code exists: what's missing, what conflicts with the architecture, what's underspecified.

Bug-hunter

Line-level review of every diff for real defects — tenant-isolation leaks, authorization gaps, data-integrity and compliance risks.

PR-reviewer

Merge-readiness pass: does the change do what it claims, does it break something that worked, can each user see exactly what they should.

Flow-verifier

The dynamic check — actually runs the system against real flows like sign-in, applying, and data erasure to catch what static review can't.

PROJECT 03 · SHIPPED

This site

Built with Next.js and Tailwind CSS on a customized base template, hosted on GitHub Pages. The exercise was less the scaffolding and more everything on top of it: real content instead of placeholder copy, and a deliberate pass on type scale, spacing, and getting a dense layout to survive a phone screen.

github.com/BtaluW ↗