Work on platforms, and the products that stand on them.

Each figure is a redrawn glimpse of the real interface. No screenshots and no customer data.

All projects

2023 to 2026 · 6 projects

P. 01

Alara Code

Turns a client brief into a complete, human-approved software delivery pack.

Role: Product owner and engineering lead
When: 2026
Stack: TypeScript, Node.js, Prisma, PostgreSQL, Redis, Next.js, Python, Playwright

Alara Code · Pipeline

Steps/rfpRequest for Proposal/scopeProject Scope/srsRequirements Spec/tadTechnical Architecture/sdsSystem Design Spec/apiAPI Contract/stsSystem Test Spec/planDelivery Plan/proposalClient Proposal

Pipeline chat

Technical Architecture Writing

Request changesContinue

Approved.

Document

Fig. 01 · every document waits for a human before the next one starts

A gated document pipeline: scope, requirements, architecture, API and test specs, plan, proposal and tickets, with an approval at every step.
Runs on hosted agents or a native multi-model engine, chosen per project.
A prototype generator that proposes design directions per product, renders every screen at desktop and phone width, measures it and repairs what fails.
Cut long document steps roughly threefold (one from 24 minutes to 8) by turning off model thinking where it did not pay for itself.
About 6,400 automated backend tests. Live on dev and production Kubernetes.

P. 02

PolyX

Identity, tenancy and access platform shared by every product in the company.

Role: Core platform engineer
When: Since 2023
Stack: TypeScript, Node.js, Express, MongoDB, Redis, Elasticsearch, Kubernetes

PolyX · Roles & Permissions

PolyXDashboardOrganizationsUsersModulesRoles & PermissionsTeamsAudit trail

Roles & PermissionsAdd permission

Role nameWorkspace Admin

ModulesCreateReadUpdateDelete

Wiki

Planner

Delivery

Billing

Fig. 02 · permissions are granted per module, per tenant

Designed and built the unified identity provider: one sign-in, single sign-on and cross-app sessions, with organisations, workspaces and per-tenant module and permission access control.
Five Node.js services (identity and access, notifications, API tooling, logging, sandboxed API execution) on one shared trust model.
Shadow identities, so platform staff can support a customer tenant without taking a seat or showing up in that customer's directory.
Found and closed a cross-tenant privilege escalation and an account-takeover path in password reset, then led the hardening that followed a client penetration test.
Traced platform-wide logouts to three causes: a token-expiry default, a race in refresh-token rotation, and Redis evicting session keys under an untrimmed log stream. Shipped all three fixes.

P. 03

PolyX SDK

TypeScript auth SDK on npm that puts the platform behind one typed client.

Role: Designer and maintainer
When: 2026
Stack: TypeScript, React, Next.js App Router, pnpm, Turborepo, Vitest
Link: @poly-x/sdk on npm ↗

Your app · sign-in with @poly-x/react

app/sign-in/page.tsx

import { SignIn } from '@poly-x/react'

export default function Page() {
  return <SignIn />
}

What the browser holds

Access tokennone
Session cookienot set

SSigned inThe session lives on the app server.

Fig. 03 · five lines of code, and the token never reaches the browser

Backend-for-frontend token custody. The browser never holds a token: the session lives in a sealed httpOnly cookie and every API call is proxied server side.
Cross-app sign-on by directed hand-off. A single-use, hash-stored ticket lands a user in a sibling app already signed in.
Single-flight refresh with a server-side rotation receipt, which closed a concurrent-refresh race that had been signing users out without an error.
Four packages versioned as one group with Changesets. 51 public releases through a human-approved publish pipeline, adopted by four products.

P. 04

Alara Space

Multi-tenant team wiki that AI agents can read and write through MCP.

Role: Built it and run it
When: 2026
Stack: Next.js, React, TypeScript, Prisma, PostgreSQL (ltree, pg_trgm), Kubernetes

Alara Space · Deploy checklist

Search or jump toRecentStarredPagesEngineeringRunbooksDeploy checklistRollbackOnboarding

Engineering / RunbooksShare

Deploy checklist

Image scanned, no HIGH or CRITICAL
Migrations applied on dev
Approval recorded for production
agent

CommentsFilesHistory

v4 · saved by agentv3 · savedv2 · savedv1 · created

Fig. 04 · an agent edits the wiki as the user it acts for

Spaces holding trees of pages, folders and whiteboards, with version history, comments and owner approval for edits.
An MCP server, so an agent can search, read and update the wiki as the user it acts for.
Dev to production on Kubernetes: three releases in about a month behind an approval-gated pipeline, rolling out with zero restarts.
Scale work: lazy page-tree loading, compression, paging, server timing and autoscaling from two to four replicas.

P. 05

Alara Plan

Project tracker with AI meeting minutes, support intake and an MCP server.

Role: Platform and production lead
When: 2026
Stack: TypeScript, Node.js, Prisma, PostgreSQL, Redis, BullMQ, Next.js, Microsoft Graph

Alara Plan · Board

Alara PlanDashboardProjectsTimelinesMeetingsTimeSettings

BoardBacklogTimelineCalendar

To DostorymediumNov 14bugmediumNov 14

In ProgressstorymediumNov 14

QAepicmediumNov 14

DonestorymediumNov 14bugmediumNov 14

Fig. 05 · one board per tenant

Moved the product to multi-tenancy across 32 tables and verified every row landed in an organisation.
Capability-based access control: module and CRUD grants only, no hard-coded roles, enforced on API and UI, with a lint that requires tenant scoping on every query.
Replaced a static secret and an OAuth server with per-user access tokens and rate limits for the MCP API.
Support intake over Microsoft Graph: mailbox to ticket, AI triage, SLA monitoring and replies in the client's own thread.
More than 2,300 backend and 1,480 frontend tests gate every change.

P. 06

ODIN

Omni-channel customer engagement platform on a microservices backend.

Role: Backend engineer
When: Since 2023
Stack: Node.js, Express, Socket.IO, MongoDB, Redis, BullMQ, Kafka, Python

ODIN · Conversations

ChannelsWhatsAppWeb chatEmailJourneysOrder updatesWin-back

Where is my order?It is out for delivery and arrives today.Great, thank you!

SentimentneutralDelivered3 of 3 messages

Fig. 06 · conversations across channels, in real time

Real-time messaging, campaign and journey tools, analytics and a Python sentiment-analysis service.
Scaled real-time traffic with Redis pub/sub behind NGINX load balancing.
Led security remediation after a third-party penetration test.

Freelance

Let’s work together on Upwork. For platform, identity and full-stack work with a clear scope.

Open my Upwork profile

Write to me

sharjeelafzaal123@gmail.com