Authorisation at the boundary
Permissions enforced where the data is reached, never only in the interface. Hiding a button is presentation. Checking the caller is security, and the difference is what a penetration test finds first.
Application development
Software SurvivesContact With UsersOr It Does Not.
A demo proves a feature works when everything goes right. An application has to keep working when two people edit the same record, when a session expires mid form, and when someone finds the route you forgot to protect.
What is web application development at The Cubas?
The Cubas builds custom web applications with authentication, role based access, dashboards, background jobs and reporting. Work covers the full stack from data model and typed API through to the React interface, with security handled at the authorisation layer rather than in the user interface.
When people call us
The Moment This Becomes Urgent
A process being held together by spreadsheets and goodwill, a tool that worked for ten users and breaks at a hundred, or software a previous developer left behind without documentation.
Built by
Ashraful Islam Hridoy, Lead Engineer
Ashraful builds the systems behind The Cubas engineering work, from typed REST APIs and data models to the React interfaces on top of them. His focus is the part most builds skip: secure access, reliable background jobs, and what happens to a system after launch.
What people search before they call
- custom web application development UK
- internal tool development agency
- SaaS MVP development
- dashboard and reporting application
- replace spreadsheet with web app
We rank for these ourselves. That is the shortest demonstration available that the search side and the build side are the same team.
How we approach it
What Actually Decides A Web Apps Project
Four decisions that separate a build which holds up from one that needs rescuing inside a year.
State that survives concurrency
Two people acting at once is normal, not an edge case. Write paths are designed so the result is predictable rather than dependent on which request arrives first, which is exactly the class of bug behind the SwiftCart cart race.
Background jobs with observability
Scheduled work, queues and retries that report their own state. A silent job is indistinguishable from a working one until the day it matters.
Loading and empty states designed up front
Skeletons, empty states and error states built with the feature rather than added at the end. They are most of what a user actually experiences on a slow connection.
Deliverables
What You Actually Receive
No tiered packages with features withheld to force an upgrade. Every engagement covers what the project genuinely requires.
Stack for this work
- Next.js
- TypeScript
- Node.js
- PostgreSQL
- Prisma
- MongoDB
- Redis
- Zod
Data model and migration strategy
Authentication, roles and permission system
Typed API with validation at the boundary
Background jobs, scheduling and queue handling
Dashboards, reporting and export
Evidence
Builds That Prove This
Not a capability list. Systems in production, described by what was genuinely hard about each one.
ProductionEcommerce · 2025
Buynux
Multi-vendor marketplace running in production
A bilingual storefront, vendor dashboards and an admin back office in one marketplace, running in production on its own domain.
- Next.js
- React
- TypeScript
- PostgreSQL
- Prisma
- +5
ProductionEcommerce · 2025
SwiftCart
Home and decor store, hardened after launch
A home and decor storefront with customer and admin dashboards, Chart.js reporting and PDF invoices, maintained in production across more than 200 commits.
- Next.js
- Tailwind CSS
- TanStack Query
- MongoDB
- Mongoose
- +2
Questions
What Clients Ask First
Can you rescue an application another developer built?
Yes, and it is a common request. We start with an audit covering security, data model, dependency health and test coverage, then report what is worth keeping. Occasionally the honest answer is a rebuild, and we will show the reasoning rather than simply recommending the larger project.
Do you build minimum viable products?
Yes, with one condition: minimum applies to scope, not to security or data integrity. Cutting features to ship sooner is sound. Cutting authorisation checks or getting the data model wrong creates work that costs more to undo than the original build.
What happens after launch?
Ongoing engineering support covers dependency updates, security patching, monitoring and feature work on an agreed cadence. Most of the interesting problems in any application appear after real users arrive, which is the part of the job that actually tests a build.
Other engineering services
Tell Us What You Need Built
Send the brief, the existing codebase or just the problem. We will tell you what it takes, what it does not need, and whether we are the right people for it.
Prefer to skip the form? Message us on WhatsApp or email yousuf@thecubas.com