Current overall reads as a strong-build / weak-operations profile: the engine is impressive, but it isn't tested, monitored, or hardened. Every score below moves with the same handful of changes — depth over features. Targets are realistic within 1–2 months of student effort.
At-a-glance — current → target
| Dimension | Now | Target | Trajectory | Single biggest lever |
|---|
| Backend Engineering |
7.5 |
9.0 |
|
Add tests + DLQ/queue dashboard around the async tier |
| Database Design |
6.5 |
8.5 |
|
Feed composite index + EXPLAIN proof; transactional counters |
| System Design |
7.0 |
8.5 |
|
ARCHITECTURE.md + load-test numbers + scale story |
| Product Thinking |
4.5 |
7.0 |
|
Cut gamification/AI sprawl; frame one sharp product story |
| Production Readiness |
3.5 |
8.0 |
|
Fix log-leak crits → tests → observability → distributed rate limit |
| Resume Impact |
7.0 |
8.5 |
|
Quantified bullets (req/s, p95) backed by load tests |
| Interview Potential |
7.5 |
9.0 |
|
Be able to whiteboard the Lua like-counter & cache invalidation |
| Frontend Engineering |
N/A |
7.0 |
|
Attach a real client app — or rebrand as "Backend" portfolio |
Per-dimension playbook
Backend Engineering 7.5 → 9.0
Already the standout: atomic Redis Lua like-counter, 10-queue BullMQ tier, clean route→controller→service→repository layering. What's missing is proof it's robust, not just built.
- medium Add a dead-letter queue + Bull-Board dashboard; drain workers on
SIGTERM (currently jobs can be killed mid-flight).
- big lift Tests on the async paths — prove the like-counter reconciles Redis→DB correctly under concurrent likes. This single test is an interview talking point.
- quick win Add
npm run typecheck + lint to CI so the build gate is real, not just a Docker push.
Database Design 6.5 → 8.5
Good normalization (43 tables), 62+ indexes, keyset pagination. Held back by a missing hot-path index and non-transactional denormalized counters.
- quick win Add
@@index([isDeleted, isHidden, visibility, createdAt, id]) on Post and capture an EXPLAIN before/after screenshot — cheap, and recruiters love measurable wins.
- quick win Wrap follow-state +
followersCount writes in doInTransaction (you already use this pattern in post-create).
- medium Document the deliberate denormalizations (
userSnapshot, counters) in a short DB design note — shows intent, not accident.
System Design 7.0 → 8.5
Sound modular-monolith + async split + Soketi realtime. The architecture is good but invisible — there's no document or numbers that let a reviewer see it without reading code.
- medium Write
ARCHITECTURE.md: request lifecycle, sync vs async boundaries, cache layers, failure modes. One diagram beats 1,000 lines of code in a review.
- medium Load test the feed (k6/autocannon) and record "X req/s @ p95 Y ms". Numbers turn architecture into evidence.
- quick win Make concurrency cluster-aware in the writeup (note BullMQ concurrency is per-instance) — shows you understand horizontal scaling, not just configure it.
Product Thinking 4.5 → 7.0
Lowest score, and it's about focus, not effort. Gamification (soul stones, HP decay, badges = 23% of module code), 4 AI providers, and a museum module signal breadth-chasing for an app with no users.
- quick win Freeze & de-emphasize gamification + 3 of 4 AI providers in the README narrative. Keep the code; stop leading with it.
- quick win Write a one-paragraph product vision: who is this for, what's the core loop (post → feed → engage). Tie every kept feature to it.
- medium Pick one "smart" feature (semantic search) and frame the user problem it solves — depth of story beats quantity of features.
Production Readiness 3.5 → 8.0
The biggest gap and the highest-leverage fix area. Two critical credential-in-logs bugs, zero tests, no monitoring, and an in-memory rate limiter that contradicts the horizontal deploy.
- quick win Stop logging
req.body + add pino redact; delete the webhook token log lines. ~1 hour, kills a real breach path.
- medium Redis-backed rate limiting + a strict
/auth/* limiter; require HOOK_SECRET_KEY (no public default) with timingSafeEqual.
- big lift Observability: request-ID middleware,
/metrics (prom-client) + Grafana screenshot, Sentry, real /health/ready probing Redis+DB+queues.
- big lift A test suite (Vitest + Supertest + Testcontainers) as a CI gate before the Docker build.
Resume Impact 7.0 → 8.5
The material is strong; the phrasing is generic. Recruiters skim for numbers and scope.
- quick win Rewrite bullets with metrics: "Cut feed query latency from X→Y ms via a covering composite index (EXPLAIN-verified)"; "Sustained N req/s @ p95 M ms".
- quick win Lead with the rare signals: Lua atomic counter, keyset pagination, OIDC CI/CD — not "built a CRUD API".
- medium Add a 60-second Loom demo + the
ARCHITECTURE.md link at the top of the README.
Interview Potential 7.5 → 9.0
Strong stories already exist — the risk is not being able to defend them live, or getting caught by the in-memory-limiter contradiction.
- quick win Rehearse whiteboarding the like pipeline (Redis Lua → event queue → DB sync) and cache invalidation (version-bump). These are your differentiators.
- quick win Prepare honest answers for the known gaps: "why no tests yet", "why Bloom filter vs unique index", "how would you scale the rate limiter".
- medium Fix the limiter + tests so the obvious "gotcha" questions become strengths instead of weaknesses.
Frontend Engineering N/A → 7.0
No client exists in this repo, so a "Fullstack" reviewer scores this as missing. Two valid paths:
- big lift Build a focused Next.js/React client for the core loop (auth, feed, post, realtime notifications) — consume your own API, with its own architecture story.
- quick win Or rebrand honestly as a Backend Engineer portfolio piece and target backend roles — your strengths are backend anyway.
Top 5 levers — most score per hour
1
Log redaction (the 2 criticals). ~1 hr. Lifts Production Readiness off the floor and removes the one finding that's outright disqualifying if shipped. Prod ReadinessInterview
2
A real test suite + CI gate. ~1 week. The #1 thing reviewers grep for; moves Backend, Production Readiness, and Interview together. BackendProd Readiness
3
Observability stack (metrics + tracing + Sentry + readiness probe). ~1 week. Turns "can build" into "can operate" — the junior→mid boundary. Prod ReadinessSystem Design
4
Feed index + load test + ARCHITECTURE.md. ~2 days. Produces the EXPLAIN and req/s numbers that power quantified resume bullets. DBSystem DesignResume
5
Cut the sprawl + write a product vision. ~half day. The only thing that meaningfully moves Product Thinking. ProductResume
Effort × Impact quadrant
| High impact | Lower impact |
|---|
Low effort
do first | Log redaction · feed index + EXPLAIN · transactional counters · CI typecheck/lint gate · quantified resume bullets | JWT algo pinning · CORS prod lockdown · remove empty stub class |
High effort
plan for | Test suite · observability stack · load testing + ARCHITECTURE.md · frontend client | More features (gamification, extra AI providers) — actively avoid |
Additional feedback — beyond the scores
- Your ceiling is operations, not ability. The build quality already signals mid-level instincts. What caps you is everything around the code: tests, monitoring, security hygiene. That's good news — it's a smaller, well-defined surface than "learn to build better".
- Less is more, loudly. A reviewer's time-per-repo is ~3–5 minutes. 27 modules with no tests reads worse than 12 modules that are tested, monitored, and documented. Pruning raises your perceived seniority.
- Make the invisible visible. Your best work (keyset pagination, Lua counter, version-bump cache) is buried in code no one will read. A README that names these decisions, with a diagram and numbers, is worth more than a month of new features.
- Tell the truth about trade-offs. "I chose a modular monolith over microservices because X; here's where it would break and what I'd do next" is a senior signal. Confident honesty about limits beats pretending there are none.
- One clean demo > ten half-features. A 60-second video of the core loop + a live Swagger link removes all friction for a busy reviewer.
- Sequence the work: Phase 1 security hotfix (today) → Phase 2 tests + CI gate → Phase 3 observability → Phase 4 load test + docs → Phase 5 trim sprawl / optional frontend. Each phase is independently shippable and resume-bullet-worthy.
Net: you do not need more features. Doing levers 1–5 over 1–2 months realistically moves the overall profile from "strong junior, gets interviews" to "credible mid-level, passes them" — without writing a single new endpoint.