Next.js + Clerk + Convex
Next.js and TypeScript power the interface. Clerk handles identity; Convex stores tools, loans and members and enforces permissions on each operation. The client does not decide ownership or administrator status.
LendLoop / Full-stack
A platform for
sharing tools.
I developed a platform to list tools, request date-based loans and manage returns. I used it as an exercise in connecting a product experience with backend permissions, reliable automations and secure file handling.
- My work
- Full-stack · UX · Security
- Stack
- Next.js · Clerk · Convex · n8n
- Status
- Working prototype
01 / Product
From catalog to loan.
The public catalog exposes tool names and categories only. After signing in, a member can create listings, check availability and request dates. The owner approves or declines, and participants record returns. Administrators can moderate listings and mark trusted lenders.
I chose a catalog interface with search, categories and visible availability. Separate listings, outgoing requests and incoming requests give each action a clear place.
02 / Architecture
Separate responsibilities.
n8n + Docker
Loan changes generate events in a transactional outbox. n8n processes mock notifications and daily overdue reminders. Retries, visible errors and idempotency handle failures without duplicate records.
03 / Cybersecurity
Verify before trusting.
Permissions and integrations
- Authorization and ownership enforced in Convex; availability rechecked on approval.
- HMAC-signed webhooks with separate keys for each direction.
- Events carry opaque identifiers, without email addresses or session tokens.
- Private environment files excluded from the repository; configuration templates contain no keys.
Images and storage
The server validates and decodes static JPEG, PNG or WebP images, then produces optimized WebP. It bounds size and resolution and strips metadata. Convex stores only the processed output; reads require authentication and replacement requires ownership.
Uploads use single-use tickets, quotas and a processor signature. The backend rechecks authorization before attaching a file to a listing.
The data layer uses structured Convex queries and validates arguments and identifiers before performing operations. User content is rendered as text rather than executed as HTML.
04 / Verification
Visible tests and limitations.
63automated tests8Chromium demo checks
I also verified authenticated JPEG upload, WebP retrieval, rejection of a disguised non-image, anonymous access denial and deletion. The Convex–n8n round trip delivered three signed notifications and prevented duplicates on replay. Loan integration checks used synthetic development identities.
05 / Scope
A working exercise, not a commercial service.
LendLoop is an experimental development built as a take-home exercise. It has no real users or adoption metrics. Notifications are mock records, not outgoing emails. The in-memory demo is separate from the authenticated, persistent application.
The manual walkthrough with two real Clerk accounts remains pending. Before production, I would add stable hosting, observability, global quotas, pagination, retention policies and orphan-file reconciliation. These limitations are documented alongside the security decisions.