E-commerce · Full-Stack
QuickComm Store
Voice AI Hardware Storefront & CRM
My roleI built the store, the payment flow and the admin portal with its CRM.
The situation
A buyer in Dubai and a buyer in Lahore open the same product page for the same device. One expects AED and VAT, the other PKR, and both expect to pay by card without wondering where their card number goes.
Behind the page, every order then needs a home: payment status, shipping, returns, disputes, and the sales team's deals and leads.
- Guest checkout: no customer accounts, so nothing in the browser should ever be able to read another customer's order.
- Card details must never reach our servers.
- An order is paid when money has moved, not when a browser says so.
- Fast and readable for search engines and AI search, with no heavyweight e-commerce platform.
Architecture decisions I made
- D1Lock the orders table, then go through the serverThe orders table has row-level security with no permissive policy at all. Every read and write goes through server functions. If the public key ever leaks, customer names and addresses are still unreachable.Trade-off It looks like a missing policy to the next developer, so the handover says in plain words: do not "fix" this by adding one.
- D2Only the signed webhook marks an order paidThe server reprices the cart from the catalogue and reserves stock. The card is entered in the payment provider's own form, so card data never touches our servers. The browser reports a short code, which is stored but proves nothing. The order turns paid only when the provider's signed webhook arrives.
- D3A lost email must never lose an orderConfirmation and admin emails are sent best-effort after the order is recorded. A mail outage is logged, and the order stands.
- D4It runs before anything is configuredWith no database, the store still works end to end in demo mode and says so in a banner at checkout. Each service, from the database to email and cards, switches on by itself when its settings are added.
In practice
One card payment
- CheckoutThe buyer submits checkout. The server reprices the cart from the catalogue, creates the order as awaiting payment and reserves stock.
- PayThe buyer enters the card in the payment provider's form. Our servers never see it.
- ReportThe browser reports the provider's short code. It is stored on the order, which stays unpaid.
- ConfirmThe provider's signed webhook arrives. The order is marked paid, the fee and net are recorded, and the emails go out.
- Or notIf the webhook never comes, the order stays awaiting payment and visible in the admin, which is the honest failure.
What I took away
- A browser saying "it worked" is not evidence that money moved.
- Write the security model into the handover. A deliberate missing policy looks exactly like a mistake.
Questions about this project
What problem did QuickComm Store solve?
QuickComm needed to sell hardware in two currencies and two markets, take card payments safely, and run orders and sales from one place, without a heavyweight e-commerce platform.
Who built QuickComm Store, and how does it work?
I did (Qalab Hassnain Agha). I built the store, the payment flow and the admin portal with its CRM. How it works: A server-rendered TanStack Start store on Supabase. The orders table has row-level security with no permissive policy, so a leaked public key cannot read customer data. An order is only marked paid by the payment provider's signed webhook, and card data never touches our servers. The admin adds order management and a CRM, and the site ships with strict security headers, schema markup and llms.txt for AI search. Stack: TanStack Start (React 19), Tailwind CSS v4, Supabase, Hosted card payments, Resend, Vercel.
What results did QuickComm Store achieve?
Live at quickcomm.ae. All 18 routes server-rendered. Card data never touches our servers. Zero elements below WCAG AA contrast.
Can I hire Qalab to build something similar to QuickComm Store?
Yes. Contracts from $25 an hour, full-time remote from $3,000 a month, fixed-price prototypes from $600 and builds from $2,000, and fractional CTO retainers from $800 a month. Book a free 30-minute call and I will tell you honestly whether and how I would build it.
Gallery
