What this is
I’m building an internal material-planning / MRP-style system for SGJ Electronic. They were running material planning and production tracking in spreadsheets, and I offered to build something internal to replace it. This was supposed to be quick. It wasn’t (isn’t?). The MVP scope was pretty clear and small, but I kept telling myself “just one more small feature.”
It covers the stuff you’d expect from an MRP setup — parts inventory, BOMs, production orders linked to projects, shortage tracking, supplier registers. But it’s shaped around how SGJ actually works, not how a generic SaaS thinks they should work, which is why they ignored other MRP solutions in the past.
Some problems I had to solve
I started on SQLite because it was fast to prototype with, then migrated to PostgreSQL via Prisma quite quickly due to increased requirements and a growing scope. By growing scope I mean I started building before even having the first meeting with the production manager.
Deployment is Docker Compose on a dedicated server. I wrote a four-layer backup strategy with documentation because this is production data for a client that actually needs it, not a hobby project I can just nuke and rebuild.
What this taught me about security
Neither this nor Meetingflow are security projects, but building them has given me a perspective I don’t think I’d get from labs alone. When you’re pushing features for a real client, even without a hard deadline you start to feel exactly how security holes happen. Scope creeps, you cut corners to ship, and suddenly there are parts of the system you didn’t think through properly.
I’ve caught myself doing it. And I think understanding that pressure from the developer side is genuinely useful if you’re going to be the person auditing or breaking other people’s systems later.
Stack
Next.js 16 (App Router), TypeScript, Prisma + PostgreSQL, Tailwind CSS, Docker Compose. Tests with Vitest and Playwright.
Current status
Active development. I’m iterating directly with SGJ on requirements, so the scope keeps growing from “simple inventory tool” toward something closer to a real internal production system. Source is private since it’s tied to their operations.