Build something real
Projects
Non-template builds that exercise what you've learned. Pick one, ship it, then push it to senior.
51 shown · 26 runnable starters
B2B Order & Billing Platform Architecture
Design the architecture of a B2B order and billing platform end-to-end: carve bounded contexts from the problem space, assign a structural style to each (layered, hexagonal, or clean/onion), decide where CQRS, event sourcing, and event-driven sagas are warranted, choose between a modular monolith and a set of services while explicitly avoiding the distributed monolith trap, and justify every significant decision with an Architecture Decision Record backed by a fitness function you can actually measure.
architecture-patternsOpen project →At-least-once job queue
Build a durable job queue on Postgres with visibility timeouts and idempotent consumers, so a crashed worker never drops a job.
● RunnablequeuesdistributedOpen project →Authorized Recon-to-Remediation Lab
Stand up an intentionally-vulnerable target you own — a deliberately-broken app in a local container or a CTF box on your own machine — and run a full offensive engagement against it, end to end, on a scope you signed off yourself. You recon the box, pick one class of vulnerability, prove it with a working exploit in the lab, and then turn around and write the fix and the detection. The point isn't to 'pop a box'; it's to live the whole loop a real engagement runs — scope, evidence, impact, remediation — on a target where nobody gets hurt.
security-offensivesecurity-defensivesecurity-foundationsOpen project →Bloom filter
Build a space-efficient probabilistic set that answers membership queries in O(1) with a tunable false-positive rate — and understand exactly why it can never produce false negatives.
● Runnabledata-engineeringbackendOpen project →Cache stampede lab
Reproduce a thundering-herd cache miss under load, then kill it with single-flight and early-expiry recomputation.
● RunnablecachingOpen project →Circuit breaker
Build a circuit breaker that stops hammering a failing dependency, probes it safely with a half-open state, and resets automatically — the exact pattern that keeps microservice cascades from turning one bad node into a full outage.
● RunnablebackenddistributedOpen project →Cloud Hardening Lab
Take a cloud account you own and drag it from 'it works' to 'it's defensible'. You'll measure the posture you actually have, tighten IAM to least privilege without breaking the app, lock down the network and secrets, and prove every change with a before/after diff. This is the core of cloud security work: not adding features, but removing the standing access and quiet misconfigurations that an attacker would have used.
security-cloudsecurity-foundationssecurity-defensiveOpen project →Collaborative cursors
Show every connected user's live cursor and selection in a shared document, conflict-free, over WebSocket.
networkingfrontendreactbrowserdistributedqueuesperformanceobservabilityOpen project →Command palette
A ⌘K command palette with fuzzy ranking, async action sources, and complete keyboard control (arrows, Enter, Escape, scoping) — the interaction layer every power-user tool needs.
● RunnablefrontendOpen project →Consistent hashing ring
Build a virtual-node hash ring that remaps only the minimum set of keys when a node joins or leaves — the foundational primitive behind Dynamo, Cassandra, and every sharded cache that must survive node churn without a full reshuffle.
● RunnabledistributedbackendOpen project →Feature-flag service
Build a small flag service with targeting rules, percentage rollouts, and a typed SDK that evaluates flags client-side from a cached ruleset.
backendapisOpen project →A concurrent Go ingest service
Build a concurrent ingest/fan-out worker in Go — then operate it: bound the work, apply backpressure, make downstream calls survive failure, ship it in a minimal container, and work a goroutine-leak incident before it eats your memory.
gobackendperformanceobservabilitydeploymentOpen project →Grounded RAG Service
A RAG demo that answers from a corpus is easy; a RAG service you'd trust in front of users is not. The hard part isn't retrieval, it's grounding: making the model say only what the retrieved text supports, attaching citations the reader can check, and proving with an eval set that the answers don't drift into confident fiction. You'll build the whole loop — chunk, embed, store, retrieve top-k, ground, cite, score — and feel exactly where it leaks.
ai-llmbackenddatabasesobservabilityOpen project →Homelab Secure Stack
Stand up a self-hosted media and home-server stack on nas01.example where five services share a single VPN container's network namespace — the kill-switch drops all traffic the moment the tunnel dies, a split-tunnel whitelist carves out LAN access, and three layered access rings (localhost / LAN 10.0.0.0/24 / mesh-VPN 100.64.0.30) keep the right doors open to the right people. Harden the host with SSH key-only auth, fail2ban, and unattended security upgrades; write a rotating, age-encrypted off-site backup; and walk away knowing the stack stays dark if anything breaks.
dockernetworkingsecurity-defensivecliOpen project →Hot-Path Profiler Lab
Take a deliberately slow piece of JavaScript and turn it into a controlled experiment. You'll build a micro-benchmark harness you actually trust, profile the hot path until you can name what the engine is doing, and apply engine-aware fixes — monomorphism, killing megamorphic call sites, cutting allocations — proving each win with numbers instead of vibes. This is the whole discipline of performance work in miniature: measure, form a hypothesis about the engine, change one thing, measure again.
js-enginenodetypescriptOpen project →Huffman coding
Build a lossless compressor from scratch: construct the optimal prefix-free code tree bottom-up, derive the bit strings, and prove the round-trip is exact and the output is shorter than fixed-width encoding.
● Runnablealgorithmsdata-engineeringOpen project →Idempotent ETL Pipeline
Pipelines don't fail gracefully — they fail at 3 a.m., halfway through a load, and someone re-runs them. This project teaches the one property that separates a hobby script from production data engineering: a run you can repeat any number of times and still land exactly one copy of each row. You'll build batch ingestion, an idempotent load, a watermark for incremental pulls, and the data-quality gates that stop bad data before it poisons everything downstream.
data-engineeringbackenddatabasessql-postgresOpen project →Job scheduler
A cron + backoff job runner with at-least-once delivery, idempotent handlers, and visibility timeouts — so no job is silently lost even when workers crash mid-execution.
backendqueuesOpen project →JSON parser from scratch
Write a spec-correct recursive-descent parser for JSON — tokenizer, value dispatcher, escape handler, number decoder — and watch every edge case in RFC 8259 become a concrete code path.
● RunnablealgorithmstypescriptOpen project →LRU cache
Build a Least-Recently-Used cache that evicts in O(1) by combining a hashmap and a doubly-linked list — the canonical interview problem that teaches you exactly why cache eviction is harder than it looks.
● RunnablebackendcachingOpen project →A Service systemd Trusts
Anyone can write a script that runs. The job is to make it a service the operating system will keep alive, restart sanely, log honestly, and box in when it misbehaves. You take a small daemon from 'works when I run it in my terminal' to a real systemd unit — started at boot, watched by PID 1, its logs in journald, its blast radius capped. This is the difference between code and a service.
linuxOpen project →Mini CRUD API
Build your first real backend: a tiny HTTP API that creates, reads, updates, and deletes notes — backed by SQLite so the data survives a restart. You go from a one-line 'hello' server to a small service that validates input and stores rows, one honest step at a time.
● RunnablenodebackenddatabasesOpen project →Production-Shaped Nest Service
NestJS rewards you for structure and punishes you for skipping it. Build a service the way a team would ship it: feature modules with real boundaries, DTOs that validate at the edge, guards and interceptors that own cross-cutting concerns, a typed config you can't typo, and an e2e suite that boots the whole app. This is the difference between knowing Nest's decorators and knowing why they exist.
nestbackendnodeOpen project →A Next.js app to production
Build a multi-tenant content app on the App Router — then run it: lock down auth and secrets, layer the caches, decide every edge-vs-node call, and work the incident when one tenant poisons a shared ISR page.
nextjsfrontendsecurityobservabilityperformanceOpen project →Numeric Toolkit
Build the small library every numerical program secretly depends on: vectors, matrices, a linear-system solver, and descriptive statistics — written by you, checked against answers you can verify by hand. This is where the algebra you learned stops being homework and becomes code that other code calls. You'll feel why floating-point arithmetic lies a little, why solving Ax = b is harder than the textbook suggests, and how to prove your own numbers are right.
● RunnablemathalgorithmsOpen project →Mini OAuth 2.0 + PKCE login
Implement the authorization-code + PKCE flow end to end against a real provider, so you understand every redirect and token instead of trusting a library.
securityapisOpen project →Offline PWA sync
Offline-first notes PWA: a local write queue (IndexedDB) that syncs on reconnect with last-writer-wins conflict resolution, a service worker for asset caching, and background sync for missed flushes.
frontendbrowserOpen project →Pathfinding Route Engine
Four search algorithms, one shared problem: get from A to B across a weighted grid. You'll build BFS, DFS, Dijkstra, and A* on a single graph model, then run them side by side and watch them disagree — DFS lunges into a dead end, BFS floods evenly, Dijkstra crawls outward by cost, A* leans toward the goal. This is where the algorithms unit stops being trivia and becomes a set of tools you choose between, with reasons.
● Runnablealgorithmsbase-csOpen project →Personal portfolio page
Build a one-page site about you with plain HTML, CSS, and a sprinkle of JavaScript — no framework, no build step, just files you can open in a browser. By the end you'll have something real to show, and you'll actually understand every line of it because you wrote it yourself.
frontendbrowserOpen project →Presigned upload flow
Direct-to-storage uploads via presigned URLs with size/content-type limits and a completion webhook that verifies the object actually arrived — so your API server never touches file bytes.
backendapissecurityOpen project →Async Python service, built and operated
Build an async FastAPI ingestion service that validates, pipelines, and survives load — then run it: package it, containerize it with correct PID-1 behaviour, and work the incident when a swallowed CancelledError quietly leaks tasks until the event loop starves.
pythonbackendperformanceobservabilitydeploymentOpen project →Query plan visualizer
Paste an EXPLAIN (ANALYZE, FORMAT JSON) and render the plan tree with per-node timing and row-estimate error, so a bad join jumps out visually.
databasesOpen project →Distributed rate limiter
Build a token-bucket limiter that holds across many app instances by keeping the counter in Redis, not in process memory.
● RunnableapisbackendOpen project →React feature at scale
Ship one real production React feature — a live collaborative activity dashboard — then operate it: optimistic edits, streaming updates, a frame budget, full a11y, and an incident drill when a render storm freezes the tab.
reactfrontendperformanceobservabilityOpen project →Regex engine
Build a regular expression engine from scratch using Thompson NFA construction and subset simulation — the same technique that makes grep and re2 immune to catastrophic backtracking.
● Runnablealgorithmsjs-engineOpen project →Reporting Schema Optimizer
Reporting is where a database earns or loses its keep: the queries are wide, the tables are big, and 'it's slow' is the most common bug in production analytics. You'll model a sales-and-events domain, write the honest slow versions of the dashboard queries, then make them fast with indexes and materialized views — and you'll read EXPLAIN ANALYZE to prove the speedup instead of guessing at it. This is the heart of the track: turning a vague 'the report is laggy' into a measured, defensible plan change.
sql-postgresdatabasesdata-engineeringOpen project →Signals mini
Build a ~100-line reactive signals library (signal/computed/effect) with automatic dependency tracking and glitch-free batched updates — the same model that powers Solid, Preact Signals, and Vue 3.
● RunnablefrontendOpen project →Skip list
Build a probabilistic ordered data structure that delivers O(log n) search, insert, and delete without the rotation bookkeeping of balanced trees — just layered express lanes through a sorted linked list.
● RunnablealgorithmsdatabasesOpen project →System Design Dossier
Pick one large system — a URL shortener that has to serve billions of redirects — and write the design document a staff engineer would defend in a review. No running code: the deliverable is rigorous prose, numbers, and diagrams. You move from a vague 'make short links' ask to scoped requirements, a back-of-envelope capacity model, a concrete data model and API, the one bottleneck that actually breaks under load, and an honest map of what you traded away to fix it.
system-design-casessystem-designOpen project →Text diff — Myers algorithm
Implement the Myers diff algorithm from scratch: compute the longest common subsequence, backtrack an edit script, prove minimality, and apply patches so any round-trip is byte-perfect.
● Runnablealgorithmsengineering-practiceOpen project →Threat-Model and Harden a Small App
Take a small app you fully own and run it through the loop a real security engineer lives in: first map how an attacker would actually break it, then close those paths one by one. You build an attack tree against your own service, then fix authentication, authorization, secrets handling, security headers, and input validation — and write down which fix kills which branch of the tree. This is the whole craft of defensive security in miniature: not a checklist, but a chain from threat to mitigation you can defend out loud.
security-foundationssecuritysecurity-defensiveOpen project →Three-Tier App on AWS, by IaC
Stand up a real three-tier system on AWS — a load balancer in front, a compute tier in the middle, a managed Postgres behind it, and S3 for objects — entirely from code you can re-run. The point isn't to click through a console once; it's to express the whole topology, its IAM, and its network boundaries as Terraform (or CDK) you could hand to a teammate, destroy, and recreate byte-for-byte. This is the project where 'infrastructure' stops being a pile of consoles and becomes a reviewable artifact.
awsdockersecurity-cloudOpen project →Tiny Stack VM
Build the machine that runs the machine. You define a small bytecode instruction set, write an assembler that turns readable mnemonics into bytes, and write the interpreter loop that fetches, decodes, and executes them one at a time. By the end you will have demystified the whole stack between a line of source and a running program — because you wrote every layer of it yourself.
● Runnablebase-csalgorithmsOpen project →Topological build scheduler
Build a DAG-based task scheduler — like Make or a CI pipeline — that orders jobs by dependency, detects cycles before they deadlock, and identifies which tasks can run in parallel.
● Runnablealgorithmsengineering-practiceOpen project →Trie autocomplete engine
Build a prefix tree that powers ranked autocomplete — insert words with weights, walk every prefix in O(prefix length + results), and handle tie-breaking deterministically without a database.
● RunnablealgorithmsfrontendOpen project →Truth-Table Prover
Turn the logic you learned on paper into a working engine: parse a propositional formula into a tree, walk every assignment to build its truth table, and decide whether it is a tautology, satisfiable, or equivalent to another formula. Logic is where rigor becomes mechanical — and writing the machine that checks an argument is the surest way to understand why the argument holds. By the end you'll have a small but honest theorem checker that you trust because you built every step.
● RunnablelogicalgorithmsOpen project →Type-Safe API SDK
Build the client other engineers will actually trust: a typed SDK over a real HTTP API where the compiler — not a runtime crash in production — catches the wrong field, the missing variant, the response that lied about its shape. You model the domain with discriminated unions and generics, validate every response at the boundary, and let inference carry exact types all the way to the call site, with zero `any` left to paper over the gaps.
● RunnabletypescriptapisbackendOpen project →Union-Find (Disjoint Set Union)
Build a disjoint-set structure from a naive parent array up to near-constant amortized time — then use it to drive Kruskal's MST algorithm on a weighted graph.
● RunnablealgorithmsdistributedOpen project →URL shortener at scale
Build a URL shortener that survives real traffic — then run it: deploy it, watch it, and work the incident when one hot link melts your cache.
● Runnablesystem-designapisdatabasesbackendcachingsecurityengineering-practiceci-cddeploymentobservabilityperformanceOpen project →Virtual data grid
Render and smooth-scroll 100k rows at 60fps with windowing/virtualization, sticky headers, and full keyboard navigation — no library, just math.
● RunnablefrontendperformanceOpen project →Crash-safe key-value store with a WAL
Build a tiny on-disk KV store that survives a kill -9 mid-write by appending to a write-ahead log before touching the main file.
● RunnabledatabasesdistributedOpen project →