EduLinkUp — Learning & Developer Ecosystem Platform
Architecting a single Next.js platform that carries learners from their first course to their first job.
- Role
- Lead Developer
- Timeline
- Nov 2025 – Present
- Industry
- EdTech · Developer Tools
EduLinkUp had courses but no path after them. I designed and led the rebuild into one Next.js platform that unifies structured learning, in-browser coding practice, open-source programs, internships and a community app store — now serving 2,700+ monthly active users across 100+ countries with 300+ new signups a month.
By the numbers
The problem
Learners on EduLinkUp could finish a course, but the platform offered little momentum after the last lesson. Practice, open-source contribution, career applications and community tooling all lived in different places — or nowhere at all. The result was a leaky funnel: strong course completion, weak retention, and no reason to return once a certificate was downloaded.
The platform also had to answer a harder product question: what does a learner actually need between "I finished a course" and "I got hired"? We answered that with placement, practice and proof-of-work — and then built the systems to back it up.
Constraints that shaped the design
- One lead architect (me) and a small contributor base — every architectural choice had to be maintainable by a rotating team.
- A live product with existing users, so no big-bang rewrite was acceptable.
- Untrusted code would run on the platform, which rules out naive server-side execution.
- Infrastructure spend had to stay predictable while traffic grew unevenly around launches.
- Every certificate and premium entitlement had to be independently verifiable and abuse-resistant.
Architecture
I chose a deliberately boring, server-first stack so that the interesting engineering could go into the product rather than the plumbing.
- Application: Next.js App Router with React Server Components, TypeScript and a Radix-based component system, so data-heavy views render on the server and ship less JavaScript.
- Data and security: Supabase PostgreSQL with Row Level Security as the authorization backbone, plus storage and database-backed business logic close to the data instead of spreading rules across the client.
- Infrastructure: Google Cloud Run autoscaling behind Cloudflare, with Sentry for error visibility, rate limiting on sensitive routes, and SSO integration.
- Code execution: a Monaco-based editor wired to a pluggable multi-language judging system, with untrusted submissions isolated in sandboxed environments.
- Integrations: Razorpay for subscriptions, React Email with Brevo and Resend for transactional mail, and Playwright for end-to-end coverage of critical flows.
The hard parts
Running student code was the highest-risk surface. The judging layer treats every submission as hostile: execution happens in isolated sandboxes, resource use is bounded, and the editor is a front-end convenience rather than a trusted boundary. That separation is what made a public coding judge safe to ship.
Access control came second. Premium content, internships and admin tooling all need different rules, and enforcing them client-side would have been a permanent leak. Pushing authorization into Row Level Security meant the same rules apply whether a request arrives through the web app, an API route or an admin action.
Certificates need to survive scrutiny, so each one is generated as a verifiable artifact with QR-based validation rather than a static image — a hiring manager can confirm it against the database instead of trusting a screenshot.
What shipped
- Learning platform: chapter-based courses, progress tracking, test series, assessments and verifiable certificates with QR validation.
- ELUCode and Labs: an in-browser coding environment with submission judging, alongside hands-on Linux and Python labs.
- Developer App Store: community-driven discovery of tools, AI assistants, games and open-source projects, with bookmarks and store analytics.
- ELUSOC: an open-source contribution program with leaderboards, partner tiers, badges, bonus points and certificates.
- Careers and recruitment: internship and job listings, application workflows, offer-letter generation and role-based administration.
- Payments and entitlements: Razorpay-powered subscriptions, premium access controls and referral rewards with rate limiting and auditability.
- Community and content: blogs, events, a campus ambassador program, newsletters and DSA practice.
Results
EduLinkUp evolved from a course catalogue into a developer ecosystem. It now supports 2,700+ monthly active users across 100+ countries, absorbs 300+ new signups per month, and powers a hiring pipeline that has onboarded 100+ interns — with an internship acceptance rate of roughly 76% across 150+ applications.
Just as importantly, the platform stayed operable by a small team: server-first rendering, RLS-based authorization and managed infrastructure kept the surface area small enough that new contributors could ship without a long ramp-up.
What I would do differently
- Introduce a shared design token layer earlier — consistent spacing and state styles paid off the moment multiple contributors touched the same views.
- Treat observability as a first-class feature from day one; retrofitting tracing around a judging pipeline is far harder than starting with it.
- Model entitlements as explicit domain objects sooner, so new premium surfaces plug into one rule source instead of re-implementing checks.
Tech stack
Frequently asked questions
How is untrusted student code executed safely?
Submissions never run inside the application process. A Monaco-based editor hands code to a multi-language judging system that executes each submission in an isolated sandbox with bounded resources, so a malicious or runaway program cannot reach the platform or other users.
Why build on Supabase instead of a custom backend?
Supabase gave us PostgreSQL, authentication, storage and Row Level Security with far less operational overhead than a hand-rolled backend. Keeping authorization inside RLS means the same access rules hold across the web app, API routes and admin actions, which removes an entire class of security bugs.
How do you keep infrastructure costs predictable as traffic grows?
Google Cloud Run autoscales with demand behind Cloudflare, so capacity tracks real traffic instead of peak-provisioned servers. Combining server-side rendering with aggressive caching keeps the number of expensive requests low, and rate limiting protects sensitive endpoints from abuse.
How do you stop users from sharing premium access?
Premium entitlement is enforced in the database through Row Level Security rather than in the client, and sensitive actions are rate limited and audited. That means a shared link or tampered front-end cannot unlock content the account has not paid for.