Our Engineering Standards
We don't ship shortcuts
Every asset meets a fixed bar before delivery: strict TypeScript, verified test coverage, automated CI/CD, and hardened security defaults.
TypeScript — Strict Mode
Full type coverage, zero compromises
Every codebase we ship uses TypeScript with strict: true. No implicit any. All function parameters and return types are explicitly declared. We use discriminated unions for state management and exhaustive checks with never.
- strict: true in all tsconfig.json files
- No implicit any — anywhere
- Explicit return types on all functions
- Discriminated unions for complex state
- Path aliases configured (@/* → src/*)
- Type-only imports where applicable
Test Coverage — 90%+ Floor
Unit, integration, and E2E baseline
Every Standard and above tier includes a configured testing setup. We enforce a 90% coverage floor for branches, functions, and lines via the CI pipeline. Tests fail the build if coverage drops.
- Vitest configured with coverage reporting
- 90% branch + function + line coverage floor
- Testing-library for component tests
- MSW for API mocking in tests
- CI pipeline fails on coverage drop
- Example test file for every component
CI/CD — GitHub Actions
Lint → Test → Build → Deploy in < 3 min
All packages ship with a multi-stage GitHub Actions workflow. The pipeline enforces lint, test, and build in isolation. Production deployments are gated behind all stages passing. Rollback is one git revert away.
- Multi-stage workflow (lint → test → build → deploy)
- Separate staging and production environments
- Secrets managed via GitHub encrypted secrets
- Deploy to VPS via SSH with zero-downtime swap
- Slack/Discord notification on success + failure
- Automatic rollback on failed health check
Security Defaults
Hardened out of the box
Security isn't an afterthought. Every deployment blueprint includes nginx security headers, rate limiting, fail2ban configuration, UFW firewall rules, and environment variable validation at startup.
- nginx: X-Frame-Options, HSTS, CSP headers
- Rate limiting: 10 req/s per IP on API routes
- fail2ban with SSH + nginx bad-actor rules
- UFW: only ports 22, 80, 443 open
- Environment variable validation on startup (zod)
- No hardcoded secrets — .env.example always provided
Performance — 100 Lighthouse
Core Web Vitals ready by default
Astro-based templates ship with perfect Lighthouse scores by default. Zero unused JS on initial load. Images are optimised, fonts use font-display: swap, and CSS is purged by Tailwind's content scanner.
- Astro static generation — 0KB runtime JS default
- Tailwind CSS purge — only used classes shipped
- Font-display: swap on Google Fonts
- Proper meta viewport and charset
- Semantic HTML5 for accessibility score
- Gzip compression configured in nginx
Documentation Standard
README-driven development
Every package ships with a structured README: setup steps (under 5 commands), environment variables table, architecture decision records, and a deployment checklist. Code comments explain why, not what.
- README: setup in < 5 commands
- .env.example with all variables documented
- Architecture overview diagram (mermaid)
- JSDoc on all exported functions
- CHANGELOG.md format (keepachangelog)
- Deployment checklist included
Our Standards Guarantee
If any delivered codebase fails to meet the standards listed on this page — type errors, failing tests, missing CI/CD config — we'll fix it or refund you. No arguments.
Start with Standards on WhatsApp