Engineering value · Lead Engineer
Working CodeIs The Easy Part.Systems That Hold.
Most builds are judged on the demo. Ashraful builds for the week after the demo, when real traffic, real money and people probing your endpoints all arrive at once. Typed APIs, authorisation enforced on the server, writes that survive two clicks, and a gate that runs before anything is called ready.
What value does Ashraful Islam Hridoy bring to a project?
Ashraful Islam Hridoy leads engineering at The Cubas. He designs typed APIs, data models, authentication and background jobs, then builds the Next.js and React interfaces on top of them. His value is the part most builds skip: proving how a system behaves under load, under concurrency and under someone calling the API directly.
What you get
What Ashraful Brings To The Table
Not a list of tools. The specific things that change about a project once this work is being done properly.
One person across the whole stack
Data model, API, authorisation, background jobs and the interface are decided together rather than negotiated across a handover. Nothing gets designed around a boundary two teams could not agree on.
Authorisation treated as a build step
The client never names its own role. Ownership is checked on the server, tokens and card details are never persisted or shipped to the browser, and a guard in the interface is treated as a convenience rather than a boundary.
Correct under concurrency
Writes go into the database as atomic operations instead of read, change in memory, then save. Two requests arriving together compose rather than quietly overwriting each other.
Performance argued from measurement
Bundle splitting, heavy libraries loaded on demand, data rendered on the server. Each claim is limited to what was actually measured, because an unmeasured number does not survive the first follow up question.
A gate before anything is called ready
Tests, lint, typecheck and build, then an end to end check against production. Some of the checks passing is not the checks passing, and that distinction has cost enough time to become a rule.
Handover without a hostage situation
Typed code, documented access, seed data and demo accounts, so the next engineer can run the system without a week of archaeology and you are never locked to one person.
Problems this removes
If Any Of These Sound Familiar
Each one is a problem people arrive with, what it quietly costs while it goes unaddressed, and what is actually done about it. Read the middle line first. That is the part that shows up in your numbers.
Tell Us Which OneIt is fine until it is busy
- What it costs
- Connections, memory or queue workers run out only under real load, so the failure never appears in staging and always appears in front of customers.
- What gets done
- Pool sizes set explicitly rather than inherited from a driver default, connections reused across invocations instead of opened per request, and background jobs bounded by retry budgets and trimmed retention.
Anyone can call your API directly
- What it costs
- A guard in the interface hides the admin screen and does nothing at all to the endpoint beneath it. The question is never what the page renders, it is what the route does when it is called on its own.
- What gets done
- Authentication and ownership checked at the routing layer, mounted where the whole class of routes is mounted, so the route added next month is safe on the day it is written.
Two clicks, one update lost
- What it costs
- A success message with nothing changed. Carts, stock counts and totals drift, it never reproduces on one machine, and support absorbs the difference.
- What gets done
- Read, modify and save replaced with atomic database operations, so every write is evaluated against the current state rather than a stale snapshot taken moments earlier.
Private data leaking through a legitimate feature
- What it costs
- An admin list, an export or a search result count can expose customer names, emails and addresses without anything being breached at all.
- What gets done
- Redaction applied once across the response rather than patched into each route, and the search oracle closed too, because a result count leaks an address just as reliably as a field does.
A correct check that never runs
- What it costs
- A missing validation upstream can neutralise a rule downstream that is written perfectly. Reviewing the rule on its own will never reveal it.
- What gets done
- Validation with typed schemas at the boundary, so an unexpected value is rejected before any rule that depends on it is reached.
Nobody can say why it broke
- What it costs
- Version control shows what changed and never why it failed, so the same class of fault returns in the next project with a different name.
- What gets done
- Incidents written up as symptom, mechanism, fix and lesson, each traced to a commit, so a fault costs the team time once rather than repeatedly.
How the work is done
Rules Earned The Expensive Way
These are not preferences. Each one exists because skipping it cost time, money or credibility once already, and the point of writing them down is that it only costs that once.
- Backend
- Node.jsTypeScriptPostgreSQLPrismaRedisBullMQExpressMongoDB
- Frontend
- Next.js 15React 19TypeScriptTailwind CSSTanStack QueryZustandRedux ToolkitReact Hook Form
- Tooling
- TurborepoVitestESLintnpm workspacesTesting LibraryGit
Run the gate CI runs
Tests, lint, typecheck and build before a pull request is called ready, then an end to end check against production. Some checks passing is not the checks passing.
Verify a finding before fixing it
Audit findings get reproduced first. Some turn out to be false positives, and some implied fixes would break features that already work.
Push back when a finding is wrong
A checkout that refetches price and stock before charging a card was flagged as wasteful. In a payment flow that is the correct behaviour, so it stayed, with the reason written down.
Defer loudly, never silently
When a fix needs an architecture change with more regression risk than it removes, it is listed as deferred with the reason rather than quietly dropped.
Fix the choke point, not the call site
A rule that applies to a whole class of routes is mounted where that class is mounted, so a new route cannot forget it.
Ways to work together
Three Shapes This Usually Takes
Pick the one closest to your situation. If none of them fit, say so and we will tell you honestly whether we are the right people.
Build it from nothing
A product, marketplace, store or booking system taken from data model to live interface, with the search architecture designed in rather than retrofitted.
Rescue something already live
Audit first, then fix what the audit proves, in the order that removes the most risk soonest. Findings that turn out to be wrong get pushed back on rather than implemented.
Extra engineering capacity
Feature work, dependency and security updates, monitoring and incident response on an agreed cadence, without the hiring cycle that usually comes with it.
Prefer to check independently? Personal site.
Common questions
What Clients Ask First
What does Ashraful actually do on a project?
Everything between the database and the screen. Data modelling, typed REST APIs, authentication and role design, background jobs and queues, then the Next.js and React interface on top. On engagements with a search component he builds to the architecture the search practice specifies.
Can he work on a codebase someone else wrote?
Yes, and that is a large share of the work. It starts with an audit of authorisation, data integrity and performance, then a prioritised fix list. Findings are reproduced before they are fixed, because some turn out to be false positives and some implied fixes would break features that already work.
How is security handled on a build?
Authorisation is enforced on the server, never in the browser. Roles are assigned by the server rather than accepted from a request body, ownership is verified on every mutating route, secrets stay out of client bundles, and rules that apply to a class of route are mounted where that class is mounted so new routes inherit them.
What will he not do?
Quote a performance or reliability figure that was never measured, and quietly drop a fix that proved harder than expected. Work that needs an architecture change with more regression risk than it removes is listed as deferred, with the reason written down, rather than disappearing from the report.
Send Him The Brief Or The Broken Thing
A new build, a codebase that needs auditing, or a failure that only shows up in production. You will get a straight answer on what it takes and whether it needs building at all.
Prefer to skip the form? Message us on WhatsApp or email yousuf@thecubas.com