Development Team
The people, disciplines and decisions behind PEFY
Development lead
RxCodz
PEFY is designed, built, secured and maintained by RxCodz — one developer covering every discipline listed below, from the colour tokens to the payment ledger.
What the team covers
Eight disciplines, one developer, one codebase
Product & architecture
Deciding what gets built, in what order, and where the seams go — so a change to payments never means rewriting the catalogue.
Design system
A single token source of truth: colour, radius, shadow and motion as CSS variables, with light and dark structurally identical rather than duplicated.
Frontend engineering
React Server Components, hydration-safe providers, keyboard-navigable controls and responsive layouts verified from 390 px to 1440 px.
Backend engineering
Route handlers behind one response envelope, one validation path, and a repository layer that is the only code allowed to write SQL.
Payments
Integer-cent arithmetic, server-side re-pricing, atomic settlement, and two live rails — cryptocurrency and PromptPay — sharing one fulfilment path.
Security
scrypt hashing, permission-based RBAC, CSRF double-submit, rate limiting, AES-256-GCM at rest, and an audit trail that records the denials too.
Internationalisation
Four languages across the entire storefront and admin panel, resolved on the server so the first paint is already correct.
Quality assurance
Adversarial testing from the customer’s seat: price tampering, injection, role escalation and broken flows, each fixed rather than filed.
Built with
Chosen for zero-setup local use and a clean path to production
How it is built
Money is never a float
Every amount is an integer in the smallest unit. Totals are recomputed on the server from the catalogue, so a tampered price is simply ignored.
Authorisation lives in one matrix
Handlers ask for a permission, never a role. That keeps “who can do this” in one table instead of scattered checks that drift apart.
Light and dark are structural
There is not one dark: variant in the codebase. Swapping a single class on the root element re-themes the entire application.
A form that does nothing is worse than no form
Anything that looks like it takes payment, sends mail or deletes data either does it for real or is removed.
Work with the team
Questions about licensing, a deployment, or a feature this platform does not cover yet — the address below reaches the developer directly.