WEB APPLICATION DEVELOPMENT
PROPELOO engineers production web applications — from architecture and data model design through API development, frontend implementation, security hardening, automated testing, CI/CD and deployment. We build to production standards from day one: no prototype that needs rebuilding, no technical debt that accumulates before you have customers.
Most web application projects do not fail because the technology is wrong. They fail because requirements were not clear before development started, architectural decisions were made for speed rather than correctness, and technical debt accumulated until the codebase could not be changed without introducing regressions. PROPELOO starts every web application engagement with a discovery phase: defining requirements, data model, API contracts, and technology decisions before writing production code. We deliver working software at the end of every sprint — not just completed tickets. Our projects are scoped realistically, delivered on milestone-based contracts, and the IP transfers to the client at each milestone.
A production web application is six distinct engineering domains working together.
Data model, API design, service boundaries, technology selection. Documented in Architecture Decision Records — every significant decision justified against requirements. API contracts specified before implementation begins.
Node.js/TypeScript (primary), Go for performance-critical services. REST API with OpenAPI spec. GraphQL where appropriate. Event-driven architecture with message queues for async processing. Background job processing.
React/TypeScript with Next.js for server-rendered applications or SPAs. TanStack Query for data fetching. Tailwind CSS for styling. WCAG 2.1 AA accessibility compliance. Performance budgets and Core Web Vitals optimisation.
PostgreSQL schema design with proper normalisation and indexing. Query performance profiling. Redis caching layer. Elasticsearch/Typesense for full-text search. Database migration strategy.
OWASP Top 10 mitigations. Parameterised queries. Input validation at API boundary. Secret management (no credentials in code). Dependency vulnerability scanning in CI. Auth with proper session management.
Unit tests for business logic. Integration tests for API endpoints. End-to-end tests for critical user journeys. Coverage enforcement for business-critical code paths. Performance testing before launch.
The most expensive code is the code that has to be rewritten because the architecture was wrong.
A sprint that starts with unclear requirements spends the first half of the sprint making decisions that should have been made before the sprint started. We invest 5-10 days at the start of every engagement in discovery: requirements clarification, data model design, API contract specification, and milestone planning. This investment reduces total delivery time.
Axiom: CLARITY BEFORE CODE
A sprint that produces 20 completed Jira tickets but no deployable software has not made progress that the stakeholder can see or test. Every sprint ends with a deployed, testable increment. Velocity is measured in working features, not story points.
Axiom: DEMO, NOT TICKETS
Security that is added after development is complete is expensive and incomplete. Input validation, parameterised queries, secret management and dependency scanning are built into the development workflow from sprint one — not a security phase at the end of the project.
Axiom: SECURITY IN EVERY SPRINT
These choices define maintenance cost, scaling capacity and development velocity for the life of the application.
Impact: Modular monolith unless there is a specific demonstrated need for microservices. We have seen more projects harmed by premature microservices adoption than by a well-structured monolith.
Impact: PostgreSQL for most web applications. MongoDB where the document model genuinely fits the data structure. DynamoDB for serverless event-driven applications with predictable access patterns.
Impact: Next.js with hybrid rendering is the correct choice for most modern web applications — public pages SSR for SEO and performance, authenticated app sections client-rendered for interactivity.
Impact: Managed auth (Auth0 or Clerk) for most projects — the engineering cost of a correct custom auth implementation exceeds the subscription cost in almost all cases.
Multi-tenant SaaS product — subscription management, onboarding flow, feature flagging, usage analytics, customer success tooling.
Custom business software replacing manual processes or off-the-shelf tools that do not fit — workflow, approvals, reporting, data management.
Customer portal, self-service dashboard, marketplace, or community platform built for external users with performance and reliability requirements.
Analytics dashboard, reporting platform, or data management application handling large datasets with complex queries and visualisation.
Rewrite of a legacy web application — strangler fig migration, database migration, zero-downtime cutover.
Our primary stack covers most web application requirements.
Stack: Node.js (TypeScript), Go (performance-critical), PostgreSQL, Redis, BullMQ (jobs)
Stack: React / Next.js, TypeScript, Tailwind CSS, TanStack Query, Radix UI
Stack: AWS / GCP, Terraform, Docker, GitHub Actions CI/CD, Datadog / Grafana
Stack: Vitest / Jest, Playwright (E2E), k6 (load testing), Snyk (security), OpenTelemetry
The most common web application vulnerabilities are all preventable with standard practices applied from day one.
All user input validated at the API boundary with schema validation (Zod). All database queries parameterised — no string concatenation. ORM (Prisma/Drizzle) prevents raw query accidents.
Managed auth (Auth0/Clerk) or NextAuth with secure defaults. HttpOnly cookies. CSRF protection. Session invalidation on password change. MFA support.
No secrets in source code or environment files committed to version control. AWS Secrets Manager or Doppler for secret storage. Rotation without downtime.
Dependabot or Snyk in CI pipeline. No known critical CVEs in production dependencies. Lock file committed. No unused dependencies.
Requirements, data model, API contracts, technology decisions, milestone plan. Output: architecture document.
Project setup, CI/CD, environments, auth, core data model, base API structure.
Feature delivery in 2-week sprints. Working software deployed to staging at each sprint end.
Third-party API integrations, payment processing, email, notifications.
Full test suite, performance profiling, security scan, accessibility audit.
Zero-downtime production deployment, monitoring setup, runbook.
Documentation, knowledge transfer, optional retainer for ongoing development.
Starting with a paid discovery phase (5-10 days): requirements workshops, data model design, API contract specification, technical decisions. Output is a milestone plan with feature scope and realistic timeline per milestone. We do not estimate work we have not scoped — discovery removes ambiguity before commitments are made.
Requirements change. Every scope change is documented as a change order: what is changing, estimated effort impact, timeline adjustment. Agreed and signed before any changed work begins. This keeps budget and timeline visible to both parties throughout the project.
You do, unconditionally. All code, documentation and design files transfer to you at each milestone invoice. No ongoing PROPELOO licence or dependency. The repository is in your account from day one.
Yes. We review the existing codebase before committing to scope — to understand the current state, technical debt and architecture. We are honest about what we find. Existing technical debt affects delivery timelines, and we communicate that in the discovery output.
We build production web platforms primarily with Next.js/React, TypeScript, Node.js or Go microservices, PostgreSQL with Prisma/Drizzle, Redis for high-speed caching, and Tailwind CSS for maintainable design systems. Our architecture prioritizes end-to-end type safety, modular microservices, and containerized cloud deployment.
We engineer applications for maximum performance: server-side rendering (SSR), incremental static regeneration (ISR), intelligent edge caching via Cloudflare/AWS CloudFront, automatic image optimization (WebP/AVIF), and aggressive JavaScript bundle tree-shaking to secure 95+ Google Lighthouse scores.
Every project includes continuous integration pipelines (GitHub Actions) executing automated unit tests (Jest/Vitest), component tests (React Testing Library), and end-to-end user journey tests (Playwright). Zero-downtime deployment pipelines deploy preview environments on pull requests and automate production staging.
We enforce strict security best practices: parameterized SQL queries to eliminate injection, Content Security Policy (CSP) headers, CORS controls, secure cookie authentication with HTTP-only flags, automated CSRF protection, rate limiting, and automated dependency vulnerability scanning in CI/CD.