Zain Ul Abdain

A B2B aviation parts marketplace where buyers and sellers transact across borders. I owned the payments platform end to end — the part of the system where a bug doesn't throw an error, it loses someone's money.

• Marketplace split payments with Stripe Connect. Connected-account onboarding, platform commission, and scheduled transfer releases to sellers — the multi-party settlement problem, solved in production.
• Escrow.com integration for high-value transactions, including a reconciliation job that continuously re-syncs escrow state against local records rather than trusting a single webhook to have arrived.
• Five gateways behind one interface. Stripe, Stripe Connect, PayPal, Escrow.com and Wise sit behind a single contract — checkout, order retrieval, transaction lookup, refund — with a resolver that picks the right gateway per payment and region.
• Idempotent webhook processing. Every inbound event is signature-verified per provider, persisted with a uniqueness constraint on provider + event_id, and marked processed exactly once — so duplicate deliveries and retries can't double-credit an account.
• Sanctions and country validation on payment methods, because an aviation parts marketplace has export-control exposure that most e-commerce doesn't.

A multi-tenant school management SaaS — schoolninty.com — built and operated single-handedly. One deployment serves many schools from a shared database and codebase, every query scoped by tenant.

• Multi-tenancy done at the data layer, not bolted on: shared schema with per-school scoping across students, teachers, attendance, fee invoicing, exams, timetables and announcements, plus a separate super-admin plane for school and subscription management.
• 1,486 tests. Fee invoicing and attendance are the kind of thing parents notice when it's wrong, so the suite is the product's actual safety net.
• Five dedicated queue workers — default, high, emails, sms, reports — under Supervisor, so a slow report run never delays a fee reminder.
• Modern stack, deliberately: Laravel 13 on PHP 8.4, Inertia with Vue 3, PostgreSQL with pgvector, Redis for cache and queues.

Every payment provider redelivers webhooks — routinely, not occasionally. The obvious guard is a race condition, and on a handler that moves money that race is a double credit:

• The bug most codebases ship: if (exists) return; else insert; has a gap between the check and the insert. Two concurrent redeliveries both pass the check and both process.
• The fix: let the database arbitrate. A unique constraint on provider + event_id, with the constraint violation treated as the duplicate signal rather than as an error. No window, because no gap.
• Plus the parts that bite in production: verification before any write, timestamp tolerance against replay, constant-time comparison, secret rotation, content fingerprinting for providers that send no event id, stale-claim takeover when a worker dies mid-handler, and deliberate replay instead of silent retries.
• 18 tests covering concurrent redelivery, tampered and replayed signatures, rotation and stale claims — CI across PHP 8.2–8.4 and Laravel 11/12.