Projects DevQuill case study
My public developer journal. A full MERN app I took from a blank PRD to production, then hardened with refresh tokens and CI.
The pinned post on DevQuill.
I was reading Medium a lot and wrote a few articles there. But I wanted something of my own: a place I built myself, to track what I learn and to build in public.
It was also a deliberate learning project: take a product from idea to production on my own, with a written PRD, real deployments and a pipeline I can explain.
And it would double as my personal website, built by me from the first line.
An npm-workspaces monorepo. Vercel serves the React app as static files, and the browser calls the Express API on Render directly. Both platforms deploy on their own when I push to master.
Press a step or let it play.
01 · Log inbcrypt checks the password. The API returns a 15-minute access JWT and a 30-day refresh token.
I launched with a single 7-day JWT, then replaced it with this design, which cuts the exposure window from 7 days to 15 minutes. Existing logins were migrated on first load, so nobody got logged out.
What I chose, what I gave up for it.
Why: zero cost, auto-deploy from GitHub, very little DevOps. I compared Railway, Netlify and DigitalOcean first.
Trade-off: Render sleeps after 15 minutes idle and needs ~30 seconds to wake, fixed that with Uptime Robot. Two origins also mean configuring CORS.
Why: posts are full of code, and Markdown renders safely without storing HTML. No dangerouslySetInnerHTML anywhere. The editor has Edit, Split and Preview modes.
Trade-off: no image uploads yet, only external image URLs.
Deployment is separate. On every push to master, Vercel builds the client and Render builds and restarts the API.
Not there yet: a red CI run doesn't block a deploy, because branch protection isn't enforced on a free private repo. Next steps are deploying only after tests pass, and adding lint and a production build to the pipeline.
When the access token expires, several requests fail together. Without care, each one would start its own refresh and they would revoke each other's tokens. An isRefreshing flag and a queue make sure only one refresh runs.
The API returned { data: { user } }, but the client read response.user. A page reload looked like a logout. It's the bug that made me want shared types.
Right after launch, opening any page other than the home page directly returned a 404. The fix was an SPA rewrite rule, so every route serves the app and React Router takes over.
One step used a tsc flag that doesn't exist. Then Vitest found compiled copies of the tests in dist/ and ran them twice. Both are fixed now.
You're welcome to read the blog. The repository is private for now, and I'm happy to walk you through the code in an interview.
I'm looking for my first role as a junior full-stack or backend developer, remote or in Belgrade. Let's talk.
