How is it engineered?
Measured from the source repository, not estimated. As of Oct 2026.
Architecture
Next.js 16 App Router on Vercel (Singapore region) with Supabase Postgres; 36 server-action modules, a signed payment webhook and a secret-guarded daily cron; single-institution app with admin, trainer and candidate portals across 18 programmes.
Data and isolation
Postgres via 77 SQL migrations defining 53 tables, all with row-level security (126 named policies plus 8 generated in a loop); money stored as integer sen (117 *_cents column references) with private storage buckets for candidate documents.
Security and privacy
- Payment webhook fails closed: no configured key or a bad RSA-SHA256 signature is rejected before the body is read.
- Server-side Zod validation in 37 files; lead form uses a honeypot, minimum fill time and per-phone throttle that all return a silent success.
- Versioned PDPA consent: the exact consent sentences and version are stored with each application.
- Deletions go through one transactional admin function with a table allow-list and a privacy-minimal deletion log that never copies the deleted row.
Regulatory rules in code
Implements PDPA consent snapshots and deletion requests, and JPK skills-certification rules (age derived from the NRIC for the assessment check, eligibility thresholds stored per programme); HRD Corp, SST and e-invoicing logic are absent.
Quality evidence
| Automated test cases | 223 in 35 test files | Vitest it/test calls in tracked test files (unit logic plus one component test) |
|---|---|---|
| Commits | 259 (Aug 3 to Oct 8, 2026) | git history of the main repo |
| Schema migrations | 77 | versioned SQL migration files |
| Scheduled parity check | Daily | CI job re-checks the live eligibility questions against the official form, on push and every day |
Operations
Deployed to Vercel in the Singapore region with a daily cron for AI-drafted articles behind a bearer secret and a validator test suite; errors route through a single reportError rail to platform logs (Sentry not wired); no backup config in the repo; lint and typecheck exist as scripts but are not in CI.
The problem
MITE ran on a Webflow brochure site. Leads arrived by form and lived in inboxes, programmes had no proper salespages, and enrolment, payments and credential checks happened outside the website.
My role
Agency lead for the rebuild: design, architecture and the full build.
Approach
- Sell every programme properly. A marketing site with 18 programme salespages for JPK, SKM, DKM and DLKM pathways, in BM.
- Leads into a pipeline. A lead wizard that feeds a CRM, so no enquiry sits in an inbox.
- Portals for everyone involved. Candidate, trainer and admin portals, credential verification and CHIP-based finance.
- Security you can count. 118 row-level security assertions, PDPA consent, and payment and AI settings the admin can edit without a developer.
- Measured from day one. GA4 and a GEO admin page for AI search visibility.
Outcome
The new platform is live at https://mite.edu.my, replacing the Webflow site with enrolment, CRM and finance in one place.