LetsCML
Backend services for a platform with 300,000+ registered users, supporting content, events, and customer engagement.
2024 — present · Principal backend engineer on the service — client work through NXS Indonesia. I've written the large majority of it and have maintained it since launch.
The problem
LetsCML needed backend services for content publishing, event launches, and direct-to-customer activities. A key challenge was handling high customer traffic while field promotion staff (SPG) used the DTC system, all on a modest database instance.
What it does
I own the service that runs it: content APIs and CMS, event registration, check-in and event management, direct-to-customer surveys, loyalty points, and WhatsApp AI integration for customer registration and redemption. The public website shows the content platform; the internal customer operations systems are described here at a high level.
Engineering decisions
Removed indexes instead of adding them
An earlier revision added five indexes to speed up the heaviest reports. They duplicated indexes the CMS already creates, so they were removed. A duplicate index costs write throughput and storage and buys no reads, and on a two-core instance that trade is never worth it. The sequential scans we were chasing turned out to be the query planner declining to use indexes that already existed — not their absence.
Refused to cap unbounded queries with a LIMIT
Some reports pull very large result sets and occasionally strain memory. The obvious fix is a LIMIT, but a LIMIT doesn't bound the problem, it corrupts the answer: a total that silently stops counting still looks like a total. Instead a guard logs when a result crosses fifty thousand rows and leaves it whole. A wrong number that looks right is worse than a slow query.
Kept the signing secret on the server
Internal endpoints are protected by HMAC request signing with timestamp freshness checks. That makes the interactive API docs awkward, since signing in the browser means shipping the shared secret to the browser. The docs page signs through a small server-side proxy instead — the team gets a working try-it button, and the secret never leaves the server.
Where it landed
- Backend for a platform with 300,000+ registered users
- Content APIs and CMS, event registration, check-in, and event management
- Internal DTC surveys and WhatsApp AI integration for customer registration and redemption
- Sustained 50+ submissions/second during SPG-led activities
- Maintained continuously since 2024 for a long-term NXS Indonesia client