Muhammad Zahid / Engineer

Full Stack Engineer · Rails · Python · DevOps

I build systems that cut cost and stay shipped.

Six years across FinTech, eCommerce, fleet management and SaaS. I take work end to end: architecture, API design, deployment, handoff. Then I measure what it changed. Every number on this page links to the thing that produced it.

  • Available for contract work
  • 6+ years shipping
  • Lahore, Pakistan · UTC+5
  • 60%

    Administrative overhead removed for a 50+ vehicle fleet

    EasyForTrip · Rails + Stripe

  • 35%

    Query latency cut across 3 production apps, 1,000+ monthly users

    Devsinc · Redis + GraphQL

  • 4.8×

    Faster page loads after a WordPress → static rebuild

    amitramanuj.com · measured, 3-run average

Selected work

Outcomes, with the evidence attached.

Ordered by what changed, not by what I touched. Where a number came from a client system I could not measure myself, I say so.

  1. Own product · Open source

    ShopFlare

    A self-hosted alternative to Shopify Basic: storefront, admin, Stripe checkout, cash-on-delivery and WhatsApp ordering, installable as a PWA. It runs on Cloudflare's free tier, so the hosting bill is nothing.

    2,084

    unit tests at 95% coverage, plus integration tests against real workerd and full end-to-end, accessibility and visual-regression suites. 22 architecture decision records. 657 commits.

    Role: sole author, architecture through deploy.
    Notable: deliberate two-Worker split. The SSR worker holds zero database bindings; a separate Hono API worker owns every binding and secret. That is a real trust boundary, and the cross-origin cookie problem it creates is solved with Bearer auth and written up in ADR-0014.

    • Next.js 16
    • React 19
    • TypeScript
    • Cloudflare Workers
    • Hono
    • Drizzle / D1
    • R2 + KV
    • Stripe
    • Vitest
    • Playwright
    ShopFlare storefront showing a product grid of apparel and accessories.
  2. Multi-tenant SaaS · Private

    Gymplex

    Independent gyms need software, but each one wants its own subdomain, its own branding, and its own money. Gymplex is one Rails monolith serving all of them. Members book classes and pay, staff run check-ins and schedules, and the platform operator administers every gym from one place.

    One codebase, isolated tenants

    Tenant resolution happens in Rack middleware before the router: the subdomain maps to a gym, and every gym-owned model carries a default_scope bound to it. Cross-tenant leakage takes a deliberate, documented bypass, not an accident.

    Role: sole author: product, architecture, build.
    Notable: Stripe Connect with one Standard account per gym. Owners connect their own Stripe by OAuth and get paid directly; the platform takes a configurable application fee. Exactly three scope bypasses exist, each written down and defended: the platform operator, Stripe webhooks resolving tenant from event.account, and background jobs restoring tenant from a job argument.
    Scale: 303 commits over 5.5 weeks, 35 models, 28 migrations, 428 tests.

    • Rails 8.1
    • Ruby 4.0
    • PostgreSQL
    • Stripe Connect
    • Hotwire
    • Slim
    • Tailwind
    • Solid Queue
    • Minitest
    Gymplex staff dashboard listing gym members with roles, join dates and active status, branded for the tenant gym.
  3. Fleet management · Contract

    EasyForTrip

    A car rental and chauffeur operator was scheduling a 50+ vehicle fleet by hand and could not take money online. I architected an automated booking system and wired in a Stripe payment gateway, so the business could collect revenue on the web for the first time.

    60%

    less administrative overhead, and 15+ hours a week of manual scheduling gone. Checkout sits behind authentication, so the payment flow is not publicly verifiable. The booking platform itself is live.

    Role: architecture, build, deploy.
    Verified: Rails confirmed in response headers; Heroku behind Cloudflare.

    • Ruby on Rails
    • Stripe
    • PostgreSQL
    • Heroku
    • Cloudflare
    EasyForTrip booking platform homepage with a vehicle booking interface.
  4. SaaS · Contract

    Kleptofinder

    Artists and photographers had no practical way to find their work being used without permission, and checking by hand took days. I built a reverse image search platform on BingAI that does it while you wait. Two surfaces: a marketing site, and the authenticated app at app.kleptofinder.com, which is white-labelled per client subdomain.

    Days → seconds

    Detection time for unauthorised use of an artist's work.

    Role: full stack: Angular front end, C# Azure Functions backend, Python services, CI/CD.
    Verified: Angular confirmed from the app's build output. The C# / Python / Azure layer sits behind login, so it is not publicly inspectable.

    • Angular
    • C#
    • Azure Functions
    • Python
    • BingAI
    • CI/CD
    Kleptofinder marketing site hero explaining reverse image search for artists.
  5. eCommerce · Contract

    Craftfoxes

    A craft marketplace running on an ageing Rails stack. I shipped product listing, order management and Stripe payments, then led the Rails version upgrade that closed out security debt.

    Zero downtime

    On a framework upgrade for a live marketplace the client reports serves 5,000+ active sellers. Covered with RSpec before the cutover.

    Role: feature development and upgrade lead.
    Note: the seller count is the client's figure, not something published on the site.

    • Ruby on Rails
    • Stripe
    • RSpec
    • AWS
    • Passenger
    Craftfoxes craft marketplace homepage showing seller product listings.
  6. Performance · Contract

    amitramanuj.com

    A game designer's portfolio was carrying a full WordPress install to serve pages that never changed, carrying the hosting bill, the update treadmill and the plugin attack surface that come with it. I rebuilt it as plain HTML on GitHub Pages.

    4.8×

    faster to first byte: 0.34s against 1.64s for the equivalent WordPress stack, three-run average. Hosting went to zero, and so did the plugin attack surface.

    Role: migration and rebuild.
    Verified: measured directly. server: GitHub.com, 86KB, 16 asset requests.

    • HTML
    • CSS
    • GitHub Pages
    • WordPress migration
    Amit Ramanuj game design portfolio, rebuilt as static HTML.
  7. Reference build · Open source

    Stripe subscriptions + PDF invoicing

    Two-tier subscription billing done properly, so I never have to solve it from scratch again: hosted Checkout and embedded Elements, webhooks, plan changes with correct proration, PDF invoices, and a read-only admin panel. Bilingual end to end.

    100%

    line coverage across 98 tests, measured by SimpleCov. Not a target, the actual recorded figure. Invoice tests assert extracted PDF text, not just that a file rendered.

    Role: sole author.
    Notable: plan changes proration correctly instead of stacking a second subscription, and the client-secret lookup walks Stripe's Basil API field rename with a fallback chain, so it survives an API version drift that breaks most tutorials. Devise runs two isolated scopes so an admin session can never become a user session.
    Honest framing: a reference build, not a product. Small on purpose.

    • Rails 8.1
    • Ruby 4.0
    • Pay + Stripe
    • HexaPDF
    • Devise + Pundit
    • ActiveAdmin
    • Hotwire
    • i18n en/fr
    • Minitest
    Subscription management screen showing an active Pro plan with renewal dates and billing portal actions.
Feature work & upgrades

Live sites I shipped features into.

Existing products where I added functionality, moved versions forward, or kept things running. Not builds from scratch, and worth saying plainly because the difference matters.

gaming.dk, a Danish esports and gaming news platform.
gaming.dk Rails · Esports news
zsolnay.hu, a Hungarian porcelain manufacturer storefront.
zsolnay.hu Shopify · Porcelain, est. 1853
migamake.com, a Singapore developer tools company.
migamake.com Jekyll · Developer tools
outlawsolutions.com, aerosol and chemical packaging.
outlawsolutions.com Wix · Aerosol packaging
sunrisenv.com, an industrial chemical manufacturer.
sunrisenv.com Wix · Industrial chemicals
Card 1 of 5
Drag a card, or use the arrows

Five live products I shipped features into. Throw the top card and the next one rises. Every card links to a site that is running right now.

Devsinc, 3 production apps

Redis-backed ActiveRecord query caching for GraphQL APIs. Cut query latency 35% and server-side errors 20% for 1,000+ monthly active users.

Tools & in progress

Things I built because they annoyed me.

Small tools, mostly for my own use. Some are public, some are not. Included because what someone builds unpaid tends to say more than what they build on a brief.

16 Chrome extensions

A private collection of Manifest V3 extensions built to scratch my own itches: blurring WhatsApp Web messages until hovered, capturing ChatGPT and Claude text-to-speech audio, copying YouTube transcripts, sorting PSX portfolio tables, opening new tabs where they should open, and a dozen more.

Know-Heritage · in build

A React Native app teaching children about cultural heritage sites through a story-driven roadmap. Content lives on-device in SQLite, so it works with no signal and no account. Client pilot, currently in build.

Image to PDF

A browser-only converter that never uploads your files. It is running live further down this page. Try it rather than trust it.

In their words

What clients said, verbatim.

Pulled from Upwork, unedited. Spelling and phrasing are theirs, including the typos. Every one is a 5.0.

Clients picked these words: Reliable

Our company hired Muhammad Zahid R. to build our new website and put us in all the top search engines monthly. We now receive a solid 30% more quality mortgage approvals per week. This website developer did a quality clean corporate website that brings us in 23 more closed and funded mortgages per month since our new website went live. Our average commission per funded mortgage is $3,827.93 USD. Thank you Wholesale Direct Mortgages

Gary G. Wholesale Direct Mortgages · Nov 2021 · Verified
  • Muhammad optimised the speed of my website and dropped the page load speed by 60%! The work was fast and well communicated.

    Clifton R. CEO · Jan 2022 · Verified
  • I've hired Muhammad a few times, I'd highly recommend him. He's reliable, professional and gets the work done to the highest standard every time. He even gave me a few pointers outside the scope of the job to clean up parts of the app we were working on, which was greatly appreciated. All code Muhammad did for me was the highest quality and had no issues. His attention to detail and high standards meant that everything worked first time and as it should. Communication was also very good, he would reply very quickly which is always so important when working on an app as a team. I'd recommend him for anything Ruby on Rails related.

    Tom G. Nov 2021 · Verified
  • Zahid has dilligently created a few beautiful web pages that have so far avoided maintenance for quite a time. I recommend him for such customer facing projects.

    Michal Migamake · Nov 2022 to Jun 2026 · 5.0
  • The requested work was completed sooner than expected time. Zahid understood the requirements well, he showed initiatives, and presented solutions. I'll definitely prefer to work with him again.

    Amit Ramanuj Mar 2025 · 5.0 · Reliable, Clear Communicator, Solution Oriented
  • Zahid was incredible from start to finish. Communication was great from start to finish. I've worked with a few developers and this we far and away, the best experience I have. Zahid and I will be working together in the near future!

    Todd J. Business Operational Manager · Apr 2022 · Verified
  • Zahid has been a thoughtful and helpful developer for our team. We'll continue to use him to work on our sites.

    Sunrise Environmental Jan 2026 · 5.0 · Collaborative, Accountable for Outcomes

Scroll, swipe or use arrow keys

The path

Six years, three chapters.

Where the numbers on this page came from.

  1. Apr 2022 – present

    Independent Consultant

    Upwork, contract engagements

    • Architected fleet booking and Stripe payments for EasyForTrip, cutting administrative overhead 60% and removing 15+ hours of manual scheduling a week.
    • Built Kleptofinder, taking artwork theft detection from days to seconds on Angular, C# Azure Functions and BingAI.
    • Shipped listings, orders and Stripe into Craftfoxes, then led a Rails version upgrade with zero downtime.
  2. Sep 2020 – Apr 2022

    Software Engineer

    Devsinc

    • Cut query latency 35% and server-side errors 20% across 3 production apps with Redis-backed ActiveRecord caching for GraphQL.
    • Moved deployments to Docker on AWS EC2 with automated CI/CD, shortening the release cycle across every client project.
  3. Mar 2019 – Jul 2020

    Co-Founder & Technical Lead

    Takhleeq

    • Took the MVP from idea to launch, reaching 200+ early adopters at 99.9% uptime on AWS EC2, S3 and RDS.
    • Owned every technical decision, from stack selection to production deploy.
Live, in this page

Try it rather than take my word for it.

This is my image-to-PDF tool, running right here. Everything happens in your browser. no upload, no server, no account. Open the network tab and check.

Drop images here, or choose files. They never leave this device.

    Why this matters commercially

    Most image-to-PDF sites upload your files to someone else's server. For anyone handling contracts, invoices, medical records or IDs, that is the whole problem. Doing the work client-side removes the liability instead of promising to look after it, and it costs nothing to run, because there is nothing to run.

    How it works

    pdf-lib assembles the document in memory from a FileReader stream, embedding each image and adding a page sized to it. The blob is handed straight to a download. No fetch call exists in this code path.

    • pdf-lib
    • FileReader
    • Zero backend
    • GitHub Pages
    Infrastructure

    Three unrelated apps, one box, one proxy.

    A reference topology I maintain for Kamal 2: a FastAPI service, a Rails 8.1 app and a WordPress install, each independently Dockerised, sharing one VM and routed by host header. It is a deployment pattern, not a production system. Worth being clear about.

    Kamal multi-app deployment topology Internet traffic reaches a single virtual machine. kamal-proxy routes by host header to three Dockerised apps on a shared Docker network: a FastAPI service at kamal-deploy.local with PostgreSQL 17 on port 5432, a Rails 8.1 app at rails8.local with PostgreSQL 17 on port 5433, and WordPress 6.9.1 at wordpress.local with MySQL 8 on port 3306 plus a phpMyAdmin sidecar on port 8081. Internet Ubuntu VM · 172.16.189.131 kamal-proxy :80 · host header FastAPI · :8000 kamal-deploy.local PostgreSQL 17 host :5432 Rails 8.1 · Puma rails8.local · Solid Queue PostgreSQL 17 host :5433 · no clash WordPress 6.9.1 wordpress.local MySQL 8 · :3306 phpMyAdmin sidecar :8081 shared docker network: kamal
    Stack

    What I reach for.

    Rails and Python are home. The rest is what the job needed.

    Backend

    • Ruby on Rails
    • Python · FastAPI
    • Next.js
    • GraphQL · REST
    • Sidekiq · Solid Queue
    • C# · Azure Functions

    Frontend

    • Hotwire · Turbo · Stimulus
    • React · TypeScript
    • Angular
    • Tailwind CSS

    Data

    • PostgreSQL · MySQL
    • Redis
    • MongoDB
    • Drizzle · D1
    • Firebase · Supabase

    Infrastructure

    • Kamal · Docker
    • Kubernetes · Helm
    • Terraform
    • AWS · Azure · Cloudflare
    • Hetzner · DigitalOcean
    • GitHub Actions · Jenkins

    Testing

    • RSpec · MiniTest
    • FactoryBot
    • Vitest · Playwright
    • axe-core

    Integrations

    • Stripe
    • Google OAuth
    • Twilio · SendGrid
    • Slack · BingAI
    Contact

    Tell me what is costing you money.

    I take contract work, and I am open to the right full-time role. If something is slow, manual, expensive to run, or nobody wants to touch it any more. That is the kind of problem I like.

    Send the context and I will tell you what I would do, whether or not you hire me. Based in Lahore, UTC+5, working comfortably with US and EU hours.