The challenge
Cybaverse needed one platform for two sides of its cybersecurity business. It had to connect organizations with vetted security services and run the Cyber Essentials audit, Qualys, and OWASP ZAP vulnerability-scanning workflows those organizations use to stay certified. A distributed team was already developing the large codebase, so new work had to fit the existing architecture without destabilizing it.
My work
I joined through the Founder & Lightning studio as a contract senior full-stack engineer from August to November 2024. I contributed roughly 200 commits to a codebase with 2,676 commits, around 20 contributors, and about 518 TSX files.
The platform uses Next.js 13 and a fully typed tRPC API with 25 routers. Hasura over PostgreSQL provides data access, while Zitadel and NextAuth handle SSO. Unlike the greenfield projects elsewhere in this portfolio, this work meant shipping inside a large, live, security-sensitive codebase alongside roughly twenty other engineers.
Key features
Compliance workflows
Cyber Essentials audit flows and integrations with Qualys and OWASP ZAP scanning bring vulnerability and compliance data directly into the platform. Scans are orchestrated through Windmill: tRPC routers call Windmill job endpoints to kick off Qualys external-IP scans and OWASP ZAP web-application scans, then poll and persist results back through Hasura, so organizations can track certification status alongside their actual security posture.
Marketplace and billing
The marketplace connects organizations with security service providers, and Maxio handles billing. Most client state runs through tRPC and React Query. Redux Toolkit is limited to the authenticated user and auth token rather than owning the marketplace domain.
Testing at scale
With around 20 contributors working in parallel, the project used Playwright, Cypress, and Storybook to catch regressions in a fast-moving, security-sensitive codebase.
Working in an established codebase
The project already had 2,676 commits when I joined, so consistency mattered across its roughly 518 TSX files. I followed its established conventions for tRPC procedures, Hasura permissions, and component structure instead of introducing parallel approaches.
Architecture
Frontend: Next.js 13 with TypeScript, styled with Tailwind CSS and shadcn/ui components. Redux Toolkit is limited to one session slice containing the current user and auth token. Everything else runs through tRPC and React Query.
API layer: tRPC provides end-to-end type safety across 25 routers between the Next.js frontend and backend services.
Data layer: Hasura exposes a GraphQL API over PostgreSQL. Zitadel and NextAuth handle SSO authentication.
Scan orchestration: Windmill runs the Qualys and OWASP ZAP scan jobs. tRPC routers trigger and poll the jobs over HTTP, then write the results back through Hasura.
Infrastructure: Vercel hosts the Next.js frontend and its API routes. DigitalOcean runs Hasura, Windmill, Zitadel, and PostgreSQL. Pulumi and Nix define the infrastructure so the team can reproduce each environment.
Testing: Playwright and Cypress cover end-to-end flows, while Storybook isolates and documents components during development.