Listing apps

A production-oriented directory and listings marketplace built with Next.js 16, React 19, TypeScript, Tailwind CSS, Prisma, and PostgreSQL. It ships complete buyer, seller, and administrator journeys: category-led discovery, text and map search, listing detail pages, seller profiles, favourites, saved searches, enquiries, messaging, review moderation, listing management, onboarding, reporting, account privacy controls, audit logs, and installable PWA support. Authentication uses secure cookie sessions with refresh rotation, same-origin mutation protection, rate limiting, email verification, password recovery, and role-aware authorization. The database includes migrations and realistic seed data; Vitest and Playwright cover the core API and browser journeys. Docker targets separate migrations, workers, build, and runtime services, while the CI workflows run type, unit, browser, dependency, and security checks. Stripe billing, S3-compatible media storage, Mapbox maps, email delivery, and web push are integrated but require the buyer's own production credentials. Ideal for agencies, local-business networks, trade directories, service marketplaces, and founders launching a niche classifieds or discovery platform.

Hireloop is a self-hostable, production-grade job board built on Next.js 15 (App Router), Postgres 16, and Drizzle ORM. Candidates browse, filter, and bookmark roles; employers create a free account, post a job, and manage their listings from any device; admins moderate the board. The auth layer uses bcryptjs work-factor-12 password hashes and opaque session tokens (raw bytes in an HttpOnly cookie, only sha256(token) stored server-side) with a 30-day sliding expiry. Email verification and password reset use atomic UPDATE ... RETURNING tokens so replay is impossible, with Resend in production and Mailpit/SMTP in dev/CI. Self-serve account deletion soft-deletes the user, scrubs PII, and closes every owned posting (GDPR-aligned). Every /api/auth/* and /api/me/* endpoint sits behind in-memory rate limits and is wrapped in a top-level handler that emits structured JSON logs (request id, route, method, ip, status, ms) and returns a sanitised 500 so Drizzle internals never leak through. Security headers (HSTS, CSP, X-Frame-Options: DENY, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) are set in next.config.ts and apply to every route. /api/health and /api/ready expose liveness + readiness probes for any load balancer or orchestrator. Sentry integration is one env var (SENTRY_DSN) away; the SDK is dynamically imported so a deploy without it pays zero cost. Tests: 80 unit (Vitest), integration suite against an ephemeral Postgres (testcontainers), and Playwright E2E that round-trips the verify-email and password-reset flows through Mailpit in CI. SEO: per-listing schema.org JobPosting JSON-LD (Google for Jobs ready), canonical URLs, OG image, sitemap, robots disallow on every gated route, and a bundle-size budget enforced in CI. Ideal for indie founders launching a niche job board, agencies building white-label boards for clients, internal hiring portals at companies that want first-party data, and developers learning a modern Next.js + Postgres + auth-from-scratch stack.