01Case study · Public sector

Our own project: software we built and operate ourselves.

CivicFlow

A resident reports a problem through a simple form with category and priority, and staff see the whole queue in one panel. No report gets lost in an inbox. The portal blocks forged submissions, and the database needs no server of its own.

Open the live demoGet my free audit
CivicFlow admin dashboard: a queue of resident reports with category, priority, and statusLive demo
02Challenge

Resident reports get lost in inboxes and phone calls

A fault reaches the local office by email or phone. No one sees right away what is urgent, what is already being handled, or how many similar reports came in. So we built a simple portal: the resident picks a category and priority, and staff see the whole queue and change status without digging through email.

03Who it's for

One reporting system, from municipality to local wardens

CivicFlow fits anywhere a resident's report needs to reach the right department with a priority attached, not a shared inbox. A gmina, Poland's smallest municipal unit, tracks road and lighting faults in it. A city routes reports across departments. Municipal wardens run a separate queue: illegal parking, noise, public order. Categories and permissions adapt to your organization's structure, not the other way round.

04How it works

From a resident's form to a staff dashboard

Submission

A form validated on the client and with a Zod schema on the server: name, email, one of 6 categories, priority, message. A CSRF token in a double-submit-cookie pattern blocks cross-site attacks before the request is even sent.

Verification and save

The server first checks the CSRF token against the secret in an httpOnly cookie, checks the rate limit, validates the content with a Zod schema, and only then writes the report to Postgres through Prisma.

Admin dashboard

Staff see every report in one place: filter by category and priority, sort by date, change status Pending → In Progress → Resolved (or Rejected) in a single click.

Security headers

HSTS, X-Content-Type-Options, and Referrer-Policy set at the response level. The database is a private Postgres instance on Neon, with no server of its own to maintain.

05Numbers

Structure, not marketing numbers

6

report categories: each lands with the right department and a priority, not in a shared inbox.

4

report statuses, changed with a single click: the whole team sees at once what is waiting, in progress, and closed.

0

forged reports in the database: every one must come through the real form, so the queue never fills with junk.

Check these numbers yourself in the live demo
06Stack

Every choice has a reason

Frontend
Next.js 16 (React 19)
App Router, server components for the dashboard
Database
PostgreSQL (Neon)
Serverless Postgres via the Vercel Marketplace, zero infrastructure to manage
ORM
Prisma 7
Typed database access and schema sync
Validation
Zod
One schema validates the form on both the client and the server
Security
CSRF (double-submit cookie)
An httpOnly token plus a request header protect the POST /api/report endpoint
Styling
Tailwind CSS 4
Utility-first, dark mode built in from the start
07Contact

Got a nagging problem? Describe it, I'll code the rest.

One sentence is enough to start. Tell me what's bothering you. Within 48 hours I come back with a clear answer: can it be done, and at what fixed price.

No obligation: describing your problem costs nothing
Free intro audit: you keep the report either way
Fixed price agreed upfront or we don't start: no surprises on the invoice
A limited number of projects at a time, each with full attention: reach out early if the deadline matters
We reply within 48 hours