Marketplace · 2026
XploreCars
A Nigerian vehicle marketplace built solo, from verification and billing to ranked search and chat.
- Role
- Solo, end to end
- Timeline
- 2026
- Stack
- NestJS, Next.js, Drizzle, PostgreSQL, Paystack
- Links
- Private · 2 min read
The problem
Buying a car in Nigeria online usually means a classifieds page, an unverified seller and a phone number. XploreCars set out to be a marketplace you can trust: sellers are verified, listings are ranked by quality rather than by who posted last, and buyers can talk to sellers without leaving the platform.
What I built
The whole platform, solo and end to end: seller onboarding and verification, subscription billing, ranked search, in-app chat and fraud protection.
- NestJS endpoints
- 51
- domains
- 17
- tables
- 29
One schema, one source of truth
A NestJS API and a Next.js storefront share a single Drizzle schema of 29 tables. The schema is where the types come from, for the API and the frontend alike, so a column change shows up as a type error in both places at once instead of a runtime surprise in one.
The API is split into 17 domains — auth, listings, billing, verification, chat, fraud and the rest — so each can change without reaching into the others.
Ranking that knows about the business
Discovery is the product. Every listing is scored at write time on recency, completeness, seller tier and trust. Search sorts on a precomputed number instead of doing the maths per query, and because seller tier is an input, the ranking supports the subscription model rather than working against it.
The hard part: a privilege-escalation hole
During review I found that a client could promote itself to the top verification tier, which also unlocked paid plans.
The cause was subtle. The request bodies were typed with TypeScript interfaces, which are erased at runtime, so nothing actually stopped an extra field like the verification tier from reaching the update. The types said it was safe; the running code did not agree.
I replaced the interfaces with allowlisted DTOs that strip unknown fields, added role gates on every route that touches tier or billing, and then checked each attack path by hand until all of them failed.
Payments
Subscriptions run on Paystack, the payment rail most Nigerian buyers and sellers already trust.