← Portfolio
Startup · backend engineering

The backend behind a live recruitment platform.

Elite Talents lets a manager certify a candidate's real skills, turning a declarative CV into verifiable proof attached by QR code. I designed and built the whole backend: a 165-endpoint Next.js 14 API, the Postgres schema and the security model. The founder drives product and interface. It's live, Toulouse-based, and now onboarding students from recognised business schools.

My scope API layer Business logic Postgres schema RLS & auth Payments Product Frontend
165
API endpoints
App Router route handlers
6
Actor roles
candidate → admin
50
Postgres tables
one schema, owned
100%
Under RLS
nothing open by default
01The backend

A Next.js 14 App Router backend I designed and built in full: 165 route handlers spanning six actor types, each with its own flows and dashboards. Well past CRUD: it carries the real logic that makes the product work, in TypeScript, with inputs validated by Zod.

API surface
165 route handlers across candidate, manager, school, company, professor and admin, with dynamic REST segments ([id], [token], [candidateId]) and role-aware access on every one.
Scoring engine
Manager-ranking and composite-index calculators (with persistence) that turn raw evaluations into comparable, ranked candidate scores.
Matching & eligibility
Candidate-to-role compatibility scoring, eligibility validation, and anti-fraud quota enforcement to keep evaluations honest.
Automation & documents
Scheduling, email and automation services, cron endpoints, and multi-template PDF generation (brochures, commercial pitches) rendered server-side.
02Data & security model

The data layer rests on a two-tier design. The browser reaches Postgres through an anon-key client, where row-level security decides which rows it sees; privileged work runs server-side through a service-role client that bypasses RLS and never reaches the browser. Every table is under RLS, so anything without a policy is closed by default.

Supabase access model The browser uses an anon-key client that passes through row-level security policies to reach scoped rows in Postgres; server-side API routes use a service-role client that bypasses RLS. Browser client anon key API routes service role RLS policies Postgres 50 tables RLS on all scoped rows service role · bypasses RLS

Every table has RLS enabled. 22 carry no client policy and are reachable only through the service-role backend (default-deny); the remaining 28 apply per-user and public-read policies.

Two-tier clients
An anon-key client for user-scoped access under RLS, and a service-role client kept strictly server-side, with httpOnly / secure / sameSite session cookies.
Passwordless & abuse-resistant
WebAuthn passkeys, rate limiting on login and registration (5 per 15 min, 3 per hour), CSRF protection, bcrypt, and JWT via jose.
Secrets & headers
The Stripe key lives in Supabase Vault, encrypted and never in the codebase. Hardened headers: HSTS with preload, X-Frame-Options: DENY, nosniff, no production source maps.
03Notable engineering
Stripe through Postgres
Payments run through the Supabase Stripe Wrapper: Stripe objects read as foreign tables directly from the database, with the API key held in Vault.
Matching at two tiers
Trigram fuzzy search in Postgres (pg_trgm) and in the app (Fuse.js), with OpenAI for candidate-to-role matching.
Certification pipeline
PDF and DOCX CV parsing into structured profiles; manager evaluations issued as QR-linked, verifiable proof, renewable every three months.
04Built with
Backend
Next.js 14App RouterRoute HandlersTypeScriptNodeZod
Data
SupabasePostgreSQLRLSpgcryptopg_trgm
Auth & security
NextAuthWebAuthnJWT (jose)bcryptrate-limiterCSRF
Integrations
Stripe (Wrapper + Vault)OpenAIResend
Ops
PM2Playwright (E2E)

Founded by Etienne Bourrinet I own the backend, database and security; the founder owns product and frontend. Live at elitetalents.fr. Toulouse, founded 2025, onboarding business-school cohorts.