Muhammad Awais · Full-Stack Engineer & Architect

I build systems that survive contact with production.

Six years turning business requirements into running software — 20+ websites and 5+ full-stack applications in production — architecture, backend, frontend, databases, infrastructure, deployment, and the debugging that happens at 2am when something upstream breaks.

Multi-tenant platforms NestJS · PostgreSQL React · TypeScript Docker · AWS MCP & AI tooling

Most engineers stop at the feature. I own the whole path to production.

My work centres on systems where the backend carries real business rules rather than shuttling database rows — billing and subscription lifecycles, multi-tenancy, background processing, audit trails, and integrations that fail in interesting ways.

I design for the second year of a codebase, not the first sprint. Shared contracts so an API change breaks the build instead of production. Composable feature bundles so the tenth feature costs less than the third. Cross-cutting concerns built once as infrastructure, not re-implemented per feature.

And I stay responsible after the deploy — containers, certificates, DNS, database migrations against live data, and the failures that look like application bugs until you trace them down a layer.

Selected work

Payback Billing

Architect & lead engineer

A multi-tenant billing and business-operations platform serving multiple businesses from one system, owned from first architecture decision through to live operation.

  • Runs the full commercial cycle — clients, subscriptions, invoicing, multi-currency pricing, purchasing, inventory, staff and support.
  • Every business's data and permissions kept fully separate, with access control built once and inherited everywhere.
  • Stays responsive under load: long-running jobs and large uploads process in the background with live progress reporting.
  • Deployed on AWS and migrated between hosting providers with no data loss and minimal downtime.
TypeScriptNestJSPostgreSQLRedisReactAstroDockerAWS

DragSense

Creator · Independent

A platform that lets non-developers build working applications — CRMs, dashboards, internal tools — by describing their data and rules instead of writing code.

  • Users define entities, relationships, fields and permissions once; the interface builds itself from those definitions at runtime.
  • Each organisation gets an isolated workspace with its own roles, branding and access rules.
  • Relational and document databases used side by side — structural integrity where it matters, flexibility where users define the shape.
NestJSPostgreSQLMongoDBReactTailwind

Commercial work

Multi-tenant SaaS

Client-facing platforms with isolated workspaces, role-based access and their own marketing sites.

Data & reporting systems

Scheduled file-transfer and reporting services with queue-backed jobs and operations dashboards.

Shared platform foundation

A reusable monorepo, deploy CLI and container setup, so each new product starts with deployment already solved.

Team engineering

GitHub organisation, review workflow, environments and releases across the product portfolio.

Client and product names withheld. Happy to walk through specifics in conversation.

Platform foundation

One contracts-first monorepo, reused as the starting point for every new product.

Five packages share a single type system. A contracts package holds every domain's types, enums and schemas; the API and the client both compile against it. Break an API shape and the build fails instead of production. Every other decision hangs off that one.

What it removes from day one of a new product: wiring up deployment, environments, auth, tenancy, permissions and access control. Those are solved in the foundation, which is why it became the shape the whole portfolio is built on rather than each product starting from scratch.

contracts
Shared types, enums, Zod schemas and list helpers — the single source of truth both sides compile against.
server
NestJS API with TypeORM and versioned migrations.
client
React Router v7 application.
website
Astro marketing site for the product.
mcp
MCP server with HTTP and stdio transports, exposing typed tools, resources and prompts.
tooling
CLI, Docker, deploy, environment and host-Nginx packages.

A platform layer, not a folder layout SERVER

Tenancy, RBAC, caching, events, activity logging, file upload with pluggable storage providers, security, validation and HTTP error shaping are built once in a shared layer. A feature opts in with a decorator instead of reimplementing the concern — roughly twenty subsystems a new product never has to write again.

Operations that compose CLIENT

Features export pure operation cores, then publish bundles that pages compose. A section — list, filters, row actions, modals, import, backups — is defined once and mounted wherever it is needed, scoped differently each time, with duplicate registrations rejected at compose time. This is the part that stops the tenth feature costing more than the third.

One gateway, one command OPS

Nginx fronts everything and a single port is published on the host; the rest stays internal to Docker. One CLI drives bootstrap, start and stop, build, migrations, adding packages and SSH deploy. Compose covers the full service set with several client delivery modes, and environment config splits local from per-host.

Legible to agents AI

The conventions are written down as the stated source of truth — README, docs and agent-readable rule files — so AI agents working in the repo converge on the existing patterns instead of drifting into their own.

Security

Defence in depth, built as shared infrastructure.

Security lives in the platform layer rather than in individual features, so it applies by default and every exception is an explicit, greppable opt-out on a single route. Most codebases have two or three of these layers; the value is in having the set apply consistently.

Encryption in transit and at rest CRYPTO

AES-256-GCM encryption of API responses between server and browser — PBKDF2-derived keys, additional authenticated data binding, and an envelope carrying a timestamp, version and checksum so tampering and replay are detectable. Applied by an interceptor, with a decorator to skip routes that must stay plaintext. Sensitive database columns are encrypted at rest too, with round-trip tests over the crypto itself.

Request integrity INPUT

CSRF protection by double-submit token held in a signed, httpOnly, SameSite cookie, with a mismatch rejected outright. Parameter-pollution guarding, HTML sanitisation of input, and correct client IP resolution behind the reverse proxy.

Browser hardening HEADERS

A Content Security Policy tuned per environment — frame ancestors and object sources denied, base URI and form action locked down, insecure requests upgraded in production. HSTS for a year with subdomains and preload, frame deny, no MIME sniffing, a referrer policy, a permissions policy, and the server signature removed.

Layered access control ACCESS

Three guards in sequence — authentication, permission, then tenant scope — so a route cannot quietly skip tenant isolation. JWTs with refresh-token rotation, OTP flows, API keys and bcrypt hashing, behind a strict CORS allowlist with explicit allowed and exposed headers.

How I work

Composable feature bundles REUSE

Each feature exposes pure operation cores and publishes self-contained bundles — list, filters, actions, forms, import and export — that any page can compose. A feature is built once and reused wherever it is needed, scoped to its context rather than copied and adapted.

Contracts before code SAFETY

One shared package holds every domain's types and schemas. Server and client both compile against it, so a breaking API change shows up as a failed build rather than a support ticket.

Concerns as infrastructure LEVERAGE

Tenancy, permissions, caching, audit logging, events, validation and file storage live in one shared layer with pluggable providers — a decorator away from any feature, never re-implemented.

Debugging down the stack OWNERSHIP

Tracing symptoms that look like application bugs to their real layer: container networking, migrations against live data, TLS certificates, reverse-proxy and DNS misconfiguration, malformed third-party payloads.

AI engineering

Agent tooling I've shipped, not just prompted.

I built a Model Context Protocol server as a first-class package inside a production platform — dual HTTP and stdio transports, a tool registry, and typed tools, resources and prompts that reach the API through an authenticated client. It gives AI agents a governed interface to the product instead of raw database access.

Day to day I work with Claude, Claude Code and Cursor for implementation, architecture exploration and debugging unfamiliar systems, with repo conventions written as agent-readable rules so humans and AI converge on the same patterns. n8n for AI-backed workflow automation.

The useful framing: conventional engineering judgement, accelerated — from problem definition to working implementation in less time, without giving up on knowing why it works.

Exploration

Procedural character animation, in Unity.

An ongoing side build for a cricket simulation, where the character's body adapts to its actual environment instead of replaying fixed clips — layered inverse kinematics for foot placement and ground adaptation, hand targets, head aim, and driven hip, chest and shoulder adjustment.

It means working directly in quaternion rotation, transform-space conversion and runtime interpolation to keep joint chains stable through movement, jumping and diving. I keep it going because the hard problems there are nothing like the ones at work.

Stack

Languages
TypeScript · JavaScript · SQL · C#
Backend
NestJS · Node.js · TypeORM · REST · OpenAPI · Socket.IO · Bull queues · JWT & RBAC · Zod
Web
HTML5 · CSS3 · responsive design · accessibility · REST & WebSockets · authentication flows · SSR & static generation · web performance
Frontend
React · React Router v7 · Angular · TanStack Query & Table · Zustand · React Hook Form · Tailwind · shadcn/ui · Vite · Astro
Data
PostgreSQL · Redis · MongoDB · relational modelling · JSONB · migrations · backup & restore
Infrastructure
Docker & Compose · Linux · Nginx · AWS EC2 · DNS · SSL/TLS · Let's Encrypt · SSH · GitHub Actions
AI
MCP server development · Claude · Claude Code · Cursor · prompt engineering · n8n
Practice
monorepo architecture · pnpm workspaces · shared contracts · GitHub org management · code review · release & environment ownership · Vitest
Simulation
Unity · Animation Rigging · procedural inverse kinematics

Get in touch

Have a system that needs to reach production and stay there?