Full Stack

Mero Najik - Nepal's Celebration Marketplace

A marketplace connecting Nepali families with trusted vendors for weddings, Bratabandha, Pasni and every celebration, built on Next.js and Supabase.

Marketplace

Supabase

Row-Level Security

Security Audit

Phone OTP

Bookings & Invoices

Programmatic SEO

Nepal

Live Demo

Project Overview

Mero Najik ("Near Me" in Nepali) is a marketplace for Nepal's celebration economy. Families describe their event through a questionnaire for each service and get quotes from local vendors, across 60 occasions and 782 locations.

I joined as a full-stack engineer in April and May 2026 and was the top committer in that period. I built the vendor claim flow, phone OTP verification and the booking, contract and invoice flows, redesigned the customer and vendor dashboards, and wrote 57 of the platform's Supabase migrations.

I also ran a security audit and shipped the fixes: a signup whitelist that closed a self-promotion-to-admin hole, private signed-URL storage for identity documents, and owner-scoped storage policies. The codebase runs on an AI-agent workflow (CLAUDE.md build protocols, architecture decision records and a phased build log), and my work shipped within it.

782

Locations with SEO Pages

Occasions Covered

Supabase Migrations Authored

Critical Vulnerabilities Fixed

Key Features

Core functionality and capabilities that make this project stand out

Vendor Claim Flow

Vendors imported from Google Maps can claim their listing. A transactional Postgres RPC creates or merges the profile, attaches the portfolio and links any customer interest already captured.

Phone OTP Verification

After Google sign-in, every user verifies a Nepali mobile number with hashed, expiring codes, attempt and send limits, and delivery through Sparrow SMS.

Security Audit & Hardening

Audited the codebase and closed a signup path to admin, moved ID documents to a private bucket with signed URLs, and scoped storage policies so vendors can't overwrite each other's photos.

Bookings, Contracts & Invoices

Quotes, manual quotes, venue bookings, contracts, invoices and disputes, kept in sync across the customer and vendor dashboards.

Dashboards & Setup Wizard

A redesigned customer dashboard, a guided vendor setup wizard, one shared vendor layout and profile layouts tailored to each category.

Programmatic SEO

Every service and occasion gets a page for each of 782 Nepali locations, kept out of the index until real vendors cover it.

Technology Stack

Key Technologies I Used on This Project

Frontend

Next.js 15 (App Router)React 19TypeScriptTailwind CSSshadcn/ui

Backend & Data

SupabasePostgreSQL + RLSServer ActionsZod

Integrations

Sparrow SMSSendGridNPS OnePG (eSewa, Khalti, ConnectIPS)Web Push

Testing

VitestPlaywright

Hosting

Vercel (ISR + cron jobs)

Challenges Overcome

• Closing privilege-escalation and storage-policy holes in a live schema without breaking existing flows.

• Making claim merges safe under races, with slug-collision retries and attempt caps.

• Adding mandatory phone verification on top of a Google-only sign-in.

• Shipping quickly in a large codebase built around an AI-agent workflow.

Key Learnings

• RLS policies and storage paths are the real security boundary; checks in app code alone are not enough.

• Aggregates such as review stats belong in database triggers, not app code.

• Audit findings written with file and line citations are far easier to verify and fix.

• Strict conventions (Zod, then auth, then role, then ownership) let a team move fast safely.

Interested in This Project?

This project showcases practical development skills and problem-solving experience. Explore the features, review the implementation, or get in touch to discuss similar work.

Get in Touch