A task manager, booking app or job board where users sign up and manage their own data.
The project for module 5, Backend and databases. It proves: apis, database design, authentication, security and testing.
Choose one theme, or your own idea. Same skills, but your portfolio won't look like everyone else's.
Task manager with projects and due dates
Booking app for a barber or tutor with time slots
Job board where companies post and people save jobs
Two short builds that practise the skills this project needs. About 3.5 hours in total.
Create, read, update and delete notes through API routes, tested with curl or Postman.
Done when: Every route returns the right status code for both good and bad requests.
Design and create the tables for a booking app: users, services and bookings.
Done when: Trying to book a taken slot fails with a database error you handle.
7 steps in order. Each one ends with a clear check, so you always know when to move on.
Draw your tables and how they relate, for example users, projects and tasks.
Done when: Every table has a primary key, and every item that belongs to a user has a user_id column.
Draw it on paper first. Changing a drawing is free, changing a live database isn't.
Create a free Neon database, write your schema with Drizzle or Prisma, and run the first migration.
Done when: The tables exist and you can insert a row from a script.
Keep DATABASE_URL in .env.local and add .env*.local to .gitignore before your first commit.
Add Auth.js with GitHub sign-in and protect your app pages.
Done when: Signed-out visitors are sent to the sign-in page.
Check the session on the server in every protected page and action, not only in the UI.
Build a form that creates an item with a Server Action, and a page that lists the user's items.
Done when: New items appear for the user who made them and nobody else.
Validate input with Zod on the server. Never trust what the browser sends.
Add edit and delete, checking ownership on every request.
Done when: Changing an id in the request can't touch someone else's item. Try it.
Put the owner check in the database query itself: WHERE id = ? AND user_id = ?.
Write at least 10 tests for validation and ownership, and run them on every push with GitHub Actions.
Done when: A green check shows next to your commits on GitHub.
Test the rules, not the UI: wrong owner, empty title, too-long text.
Deploy on Vercel with your environment variables and write a README with setup steps.
Done when: A friend can sign up on the live site and use it.
Add a 'Security' section to the README listing how you protect user data. Clients love that.
Tick each one when it's done. Saved to your account.
Optional. One of these makes your project stand out from the tutorial version.
Free APIs, tools and docs for this project.