Mudhaxk Services

Our Portfolio

Showcasing our expertise in software development and cybersecurity through successful client projects.

Full Stack

Ecommerce Storefront

A full storefront — auth, product catalog, cart, orders, checkout, and a seller dashboard — built entirely on our own custom BaaS platform, with zero hand-rolled backend. Shipped as a reference implementation across 9 languages (TypeScript, Python, Go, Ruby, Java, C#, PHP, Swift, Dart) plus native iOS and Android, the first showcase built this way and the template every later reference app followed.

Technologies

  • Next.js
  • Custom BaaS
  • Payments
  • TypeScript

Results

Live web app + 9-language/platform reference implementation, zero custom backend

View detailsLive demo
Full Stack

Realtime Social Platform

A social micro-blog app — feed, likes, comments, follows, realtime updates — built entirely on our own custom BaaS platform, with zero hand-rolled backend. Shipped as a reference implementation across 9 languages (TypeScript, Python, Go, Ruby, Java, C#, PHP, Swift, Dart) plus native iOS and Android, proving the platform's client-SDK layer against a genuinely varied stack rather than a single happy-path demo.

Technologies

  • Next.js
  • Custom BaaS
  • WebSockets
  • TypeScript

Results

Live web app + 9-language/platform reference implementation, zero custom backend

View detailsLive demo
Full Stack

Team Kanban Board

A multi-role team task board — lists, cards, drag-free accessible card movement, and a realtime activity log — built entirely on our own custom BaaS platform, with zero hand-rolled backend. Shipped as a reference implementation across 9 languages (TypeScript, Python, Go, Ruby, Java, C#, PHP, Swift, Dart) plus native iOS and Android, exercising the platform's role-based access control (owner/member/viewer) end-to-end in every stack.

Technologies

  • Next.js
  • Custom BaaS
  • WebSockets
  • RBAC

Results

Live web app + 9-language/platform reference implementation, RBAC enforced server-side in every port

View detailsLive demo
Full Stack

Freelance Marketplace

A two-sided freelance marketplace — job listings with search/filtering, proposals, accept/reject, and per-listing messaging scoped to the client and accepted freelancer — built entirely on our own custom BaaS platform, with zero hand-rolled backend. Shipped as a reference implementation across 9 languages (TypeScript, Python, Go, Ruby, Java, C#, PHP, Swift, Dart) plus native iOS and Android, with strict server-side ownership checks (IDOR-hardened) verified in every port.

Technologies

  • Next.js
  • Custom BaaS
  • Search
  • RBAC

Results

Live web app + 9-language/platform reference implementation, IDOR-hardened ownership checks in every port

View detailsLive demo
Full Stack

Event Booking & Ticketing

An event scheduling and ticketing app — capacity-aware booking with automatic waitlisting, cancellation-triggered promotion, QR-code check-in, and a realtime activity log — built entirely on our own custom BaaS platform, with zero hand-rolled backend. Shipped as a reference implementation across 9 languages (TypeScript, Python, Go, Ruby, Java, C#, PHP, Swift, Dart) plus native iOS and Android, with row-level ownership permissions verified in every port.

Technologies

  • Next.js
  • Custom BaaS
  • QR Codes
  • RBAC

Results

Live web app + 9-language/platform reference implementation, row-level ownership enforced server-side

View detailsLive demo
Full Stack

AI Knowledge-Base Search

A document knowledge base with keyword search and an Ask AI assistant — a real deployed serverless Function ranks retrieval candidates inside our BaaS platform's own sandbox, then the smallest possible server-side surface makes the LLM completion call — built entirely on our own custom BaaS platform, with zero hand-rolled backend. Shipped as a reference implementation across 9 languages (TypeScript, Python, Go, Ruby, Java, C#, PHP, Swift, Dart) plus native iOS and Android.

Technologies

  • Next.js
  • Custom BaaS
  • Serverless Functions
  • Claude

Results

Live web app + 9-language/platform reference implementation, serverless retrieval + LLM completion pipeline

View detailsLive demo
Security

Mudbase Security Audit & Penetration Test

An ongoing, deep security review and live penetration test of our own BaaS platform's backend — authentication, session management, multi-tenant data isolation, WebSocket/Socket.IO channels, webhook signature verification, wallet/custodial transaction paths, and serverless Function execution. Found and fixed critical issues including a 2FA-bypass path through the refresh-token flow, cross-tenant WebSocket subscription leaks, a serverless Function sandbox escape, and multiple cross-tenant IDOR vulnerabilities in wallet and chat data.

Technologies

  • Penetration Testing
  • OWASP
  • Auth/Session Security
  • Multi-Tenant Isolation

Results

Dozens of critical/high-severity findings fixed — auth bypass, IDOR, SSRF, RCE-class sandbox escape, secret leaks

View detailsLive demo
Security

Greatminds Security Review

A security-focused code review of Greatminds' fintech mobile app and backend ahead of app store submission. Found a live payment-processor secret key hardcoded directly into the compiled mobile app bundle (extractable by decompiling the APK/IPA), user PINs and payment tokens being written to production logs, and account-deletion flows that retained KYC/BVN/NIN data after a user requested deletion. All flagged issues were remediated before submission.

Technologies

  • Mobile Security
  • Secret Management
  • PII/Compliance
  • App Store Review

Results

Hardcoded payment secret, PII/PIN log exposure, and data-retention gaps found and fixed pre-launch

View details
Security

Viteg Security Review

A security review of Viteg's creator-content platform backend. Found and fixed a cross-user IDOR that let any authenticated user pull another user's personalized content feed by supplying their user ID in a query parameter, an account-enumeration flaw in password reset that let an attacker confirm which emails had accounts, a live database credential hardcoded into source as a fallback connection string, and patched a disclosed Next.js/React CVE (CVE-2025-55182) within days of publication.

Technologies

  • IDOR
  • Auth Security
  • Dependency/CVE Patching
  • Secret Management

Results

Cross-user data exposure, account enumeration, and a hardcoded DB credential fixed; CVE patched same week as disclosure

View detailsLive demo