Look beyond
the screenshot.
These are independently built portfolio applications with AI-assisted development. The notes describe the implementation that is deployed, including its limits. They do not claim that these architectures were used at Jio or GoldJar.
A repository investigation pipeline.
Request flow: React client → Worker endpoint → D1 cache → GitHub REST / raw repository files → normalized report. Exact dependency versions → OSV batch API → timestamped advisory results.
What is implemented
- Repository input validation restricts requests to public GitHub owner/repository names.
- Independent calls retrieve metadata, file tree, languages, commits, issues, README and root npm manifests. Partial failures are reported.
- Successful repository snapshots are cached for one hour in D1. A failed refresh can return the last successful snapshot with a stale label.
- Source previews support text files up to 120 KB. The file tree is bounded at 5,000 entries; the explorer shows the first 300 matching paths.
- Dependency resolution uses package-lock.json versions or exact pinned declarations. An unresolved range is shown as unresolved.
- OSV audits up to 60 exact root npm dependencies and caches results for six hours. Each returned advisory links to its original record.
Limits that matter
Anonymous GitHub access has upstream rate limits. When metadata is unavailable, the app can inspect the public jsDelivr source-file index and GitHub raw files instead. That mode clearly omits metadata counters and activity; the source index can lag the default branch. This is a snapshot of the default branch, not a complete clone or static-analysis engine. Filename heuristics do not prove code quality. npm auditing covers root direct dependencies and does not recursively inspect monorepo packages or every lockfile format. No advisory returned is not a guarantee of security.
Why this design
A read-only public workflow removes onboarding friction. Server-side integration centralizes validation, caches expensive requests and prevents the interface from pretending that failed calls succeeded. Exact-version handling keeps the security results reproducible.
Interview discussion
How would conditional requests and ETags reduce quota usage? How would you pin metadata and source to the same commit? What would a distributed cache-lock prevent? How would you extend dependency resolution to pnpm workspaces?
From raw events to an incident brief.
Data flow: local file → CSV / JSON / NDJSON parser → normalized event contract → row validation → filter pipeline → statistics / service groups / time buckets / trace groups → downloadable CSV and Markdown.
What is implemented
- Imports up to 10 MB or 50,000 events, including quoted CSV fields and multiline messages.
- Normalizes common timestamp, service, severity, status, duration and trace field aliases.
- Rejects malformed rows with an import-quality report. Valid rows remain usable.
- Composes service, severity, text, error-only and time-window filters across all views.
- Computes error ratios with visible event counts, nearest-rank P95 duration, service summaries and time-bucket charts.
- Groups event durations by trace ID for a waterfall. Trace bars do not invent parent-child relationships.
- Highlights candidate leads around deployment events using five-minute before/after windows. Correlation is explicitly distinguished from causation.
- Exports the filtered evidence and an investigation brief. Log content is processed on the device and is not sent to the backend.
Limits that matter
Events are not necessarily requests, so event error rate is not a formal availability SLO. Missing duration becomes zero and can affect percentiles. Timestamps need consistent clocks. This is not an OpenTelemetry collector or a production incident management service. Browser memory limits bound data size; very large datasets need streaming or a backend query engine.
Interview discussion
How would you stream a multi-gigabyte file? How should a trace model represent parent spans? Which metric denominator is appropriate for an SLO? How can sampling distort a percentile?
Analytics with a real database.
The Worker records anonymous session-scoped page views and selected interactions in D1. Country comes from approximate edge metadata or the country code in the same-origin Cloudflare trace. Only the country code is used; the trace response is not retained. Only the referrer domain and coarse device category are retained. No raw IP addresses or imported log content are stored.
The public dashboard aggregates the last 30 days. Event records expire after 90 days. A session is a browser-origin session, not a verified person; visits across subdomains can count separately. Verification visits appear in the initial totals. There are no invented historical counters.
Tests that exercise failure cases.
- Reject invalid repository names and arbitrary fetch destinations.
- Distinguish exact dependency versions from unresolvable ranges.
- Cite real inspected filenames in architecture signals.
- Parse quoted, escaped and multiline CSV fields.
- Reject invalid event rows without losing valid rows.
- Normalize epoch seconds and status aliases.
- Verify nearest-rank percentiles and empty datasets.
- Preserve commas and quotes when exporting CSV.
Run node --test tests/core.test.mjs from the downloaded source. The implementation uses React, TypeScript, Cloudflare Workers and D1, built on the Sites Vinext starter. Public repository content remains owned and licensed by its original authors; GitHub and OSV are the external data providers.