Loading challenges
Catalog
Each project is a working codebase with a backlog of real tickets. Pick a system you'd like to work in, then pick a ticket inside it.
A production-shaped Flask CRUD API for contacts and groups, built on the application-factory + Blueprints pattern -- where a marshmallow validation contract, a SQLAlchemy relationship loading strategy, and CSV bulk-import idempotency are the real engineering surface, not the CRUD itself.
Nobody has started this yet — be first.
A compact Django + DRF book-tracking API where the same handful of business rules -- a rating is 1-5, a read book needs a finish date -- are deliberately enforced at three independent layers (model validators, serializer validation, a database CheckConstraint), and the interesting bugs live in the gaps between them.
Nobody has started this yet — be first.
A Flask "mini Google Forms" API whose real subject is everywhere dynamic, per-form data collides with a service that still has to validate, notify, export, and store files safely -- JSON(B)-backed dynamic schemas, fail-closed table-driven validation, Celery-backed async email, and a file-upload path that has to stay correct across a database rollback.
Nobody has started this yet — be first.
A small, real bookmark-saving API whose entire reason for existing is teaching the habit of building tag/search SQL filters with parameterized queries -- clause list and argument slice built in lockstep -- instead of string-concatenated SQL, even in an app "nobody" is attacking.
Nobody has started this yet — be first.
A small but real Express/Prisma/PostgreSQL recipe API built around one deliberate modeling decision -- ingredients and steps get their own indexed tables with a foreign key back to the recipe instead of a JSON blob -- with ratio math, query composition, and transaction-boundary correctness as the actual engineering problems under test.
Nobody has started this yet — be first.
A JWT-authenticated FastAPI habit tracker where the real engineering test is timezone-correct streak math, per-user ownership isolation, and idempotent concurrent writes -- not the CRUD scaffolding wrapped around them.
Nobody has started this yet — be first.
A Go weather-dashboard API demonstrated by fanning out live weather fetches for a user's saved cities in parallel -- bounded retry-with-backoff against a genuinely flaky upstream, a TTL cache with stale-data fallback, and safe, mutex-free concurrent writes are the central engineering problems, not an afterthought.
Nobody has started this yet — be first.
A deliberately small Flask + SQLAlchemy watchlist API where the domain is trivial on purpose -- the real engineering problem is getting authentication, per-user ownership scoping, and JWT lifecycle correct under boundary, normalization, and concurrent-request conditions, not building a movie database.
Nobody has started this yet — be first.
A FastAPI file-upload and thumbnail-processing API where the central engineering problem is not the upload itself but everything that has to happen correctly once the HTTP response has already been sent -- background image processing, a three-state lifecycle, and the precise status codes a polling client depends on.
Nobody has started this yet — be first.
A Django + DRF poll/voting API demonstrating that "one vote per user per poll" only actually holds under concurrency when it is enforced by a database constraint, not an application-level check -- with a curated set of bugs and gaps layered on top of a real, tested authorization and results-aggregation surface.
Nobody has started this yet — be first.
A production-quality Express/Prisma/Redis URL shortener whose central engineering problem is keeping the redirect path fast while still counting every click correctly -- async, fire-and-forget click logging that never adds latency, backed by a single atomic SQL increment instead of a read-then-write.
Nobody has started this yet — be first.
A production-style multi-user expense tracker in Go where the authorization boundary between one user's financial data and everyone else's is a literal SQL `WHERE id = $1 AND user_id = $2` clause -- not an application-layer check -- so a single flipped operator or dropped predicate is a real, silent cross-account data breach, not a cosmetic bug.
Nobody has started this yet — be first.
A Django REST Framework API for tracking job applications through their full status lifecycle, where a custom user model with token authentication, strict per-user data isolation, and an auditable status-history trail are the central engineering problems, not an afterthought.
Nobody has started this yet — be first.
A production-quality Node/Express/Prisma Blog API whose central engineering lesson is that authentication and authorization are two separate, sequentially-enforced checks -- a valid JWT proves who you are, a server-side ownership re-check proves what you're allowed to do to this specific resource.
Nobody has started this yet — be first.
A small, fully-typed FastAPI notes service backed by a real SQLAlchemy/SQLite database, used as the substrate for tickets centered on search-query correctness, SQL LIKE-wildcard escaping, PATCH semantics, and a race-safe uniqueness check under real concurrency.
Nobody has started this yet — be first.
Oversell-proof stock reservations under extreme concurrent contention: 100 units, 50,000 simultaneous "Buy Now" clicks, and exactly 100 must succeed.
Nobody has started this yet — be first.
A production-grade declarative state-machine engine, demonstrated by a realistic payment lifecycle -- durable per-state timeouts and crash-recovery via a transactional outbox are the central engineering problems, not an afterthought.
Nobody has started this yet — be first.
Idempotency, retry-with-jitter, and a dead-letter queue, as three standalone Go libraries plus a runnable HTTP demo -- fifteen ways the payments-style plumbing most real systems get subtly wrong quietly breaks.
Nobody has started this yet — be first.
A "cron-as-a-service" job scheduler backed entirely by Postgres -- SKIP LOCKED leasing and advisory-lock leader election, no etcd/ZooKeeper/Consul -- twenty ways the coordination quietly breaks.
Nobody has started this yet — be first.
Three interchangeable rate-limiting algorithms -- token bucket, sliding window, and leaky bucket -- each with an in-memory and a Redis-backed implementation behind one Go interface, plus a runnable HTTP service -- fifteen ways the concurrency, correctness, and operability details of a production rate limiter quietly go wrong.
Nobody has started this yet — be first.
A FastAPI reverse proxy that streams every request and response without ever buffering a body in full, with hot-reloadable routing, per-route auth, Redis token-bucket rate limiting, and a per-upstream circuit breaker.
Nobody has started this yet — be first.
A backpressure-safe FastAPI ingestion API built to swallow ~50,000 events/sec without ever doing one INSERT per event or growing an unbounded buffer.
Nobody has started this yet — be first.
An async job API whose GET endpoint long-polls for a real status change instead of dumb fixed-interval polling -- measured at 15-30x fewer requests, not the "100x" round number a proxy-safe wait cap can't actually deliver.
Nobody has started this yet — be first.
A per-user Server-Sent-Events notification stream with proxy-safe heartbeats, Last-Event-ID reconnection replay, and multi-instance Redis fan-out.
Nobody has started this yet — be first.
A production-shaped Flask URL shortener: app-factory pattern, Blueprints, Flask-SQLAlchemy, and a real Redis cache-aside layer in front of Postgres, with per-link click analytics.
Nobody has started this yet — be first.
A from-scratch Flask authentication service: JWT access + refresh tokens with rotation and reuse detection, real session/device revocation, password reset, email verification, and TOTP 2FA with backup codes.
Nobody has started this yet — be first.
A Flask multi-tenant SaaS reference app where Postgres Row-Level Security -- not an app-level `WHERE tenant_id = ...` -- is the actual isolation boundary, plus subdomain tenant resolution, per-tenant RBAC, an append-only audit trail, and idempotent Stripe subscription billing.
Nobody has started this yet — be first.