DealDirect

Property portals in India are listing dumps run by broker networks — slow search, zero trust, and legal paperwork that still happens over WhatsApp and printouts. DealDirect cuts the intermediary out entirely.

• Live in production at dealdirect.in with separate buyer, admin and API deployments.
• Search across 50,000+ property records made fast with MongoDB compound indexes and aggregation pipelines — query latency down ~60%.
• Real-time buyer ↔ owner chat on Socket.io, plus a rewards ecosystem for engagement.
• AI-assisted agreement generation with a Puppeteer PDF pipeline — ~90% less manual legal paperwork.
• RBAC + JWT + OAuth 2.0 with a hardened API gateway: Helmet CSP, CORS lockdown, rate limiting.

• Layered service-oriented architecture: three frontends — Next.js SSR buyer app (40+ pages), a Vite SPA, and a 30+ page admin panel — over a single Express 5 API gateway.
• Eight domain services behind the gateway: auth, property, leads, agreements, chat, notifications, rewards and blog.
• 34 Mongoose models, 21 controllers and 21 route files on the backend; Sentry wired for production error tracking.
• Every request passes Helmet CSP, CORS lockdown, rate limiting and JWT auth before touching a service.

• Ran a full ~150-file security audit across the entire codebase before launch.
• Caught and fixed critical issues most platforms ship with: a broken payment-webhook auth chain, an IDOR on booking payments, a rewards double-spend race condition, and a non-functional idempotency key on agreements.
• Financial correctness treated as architecture, not an afterthought — atomic operations and ownership checks on every money path.