A full production marketing site and internal ops platform for a real staffing agency — built to replace a folder of hand-copied static HTML with a proper data-driven app.
I'm CTO / Head of Technology at ClearPath Staffing, where I own the stack end to end — marketing site, internal ops tooling, and everything in between.
The old site was a folder of hand-copied static HTML — three separate files with the same form and card CSS, slowly drifting out of sync with each other. The rebuild's whole premise: one data source, one design system, nothing hardcoded in the views.
Bun + Express + express-handlebars for the app, bun:sqlite for the database, pdf-lib for invoice generation, multer for uploads with real content-sniffing instead of trusting file extensions. No ORM, no auth framework, no message queue, no CSS build step — because the actual scale (one small agency, a handful of admin users) doesn't need any of it.
Knowing when Bun + SQLite + Handlebars is the right call — versus reaching for Next.js/Postgres/Prisma by default — is itself the point, not a compromise.
Content lives in a single data/ directory — nothing is hardcoded in a view. A list of FAQs feeds the page render and the FAQPage JSON-LD schema simultaneously, so they can never say different things. Blog posts work the same way: one array feeds the blog index, the homepage preview, related-post cross-linking, and Article schema, all from a single generic template. Adding a post is just adding an object.
English (default, unprefixed), Spanish, Traditional Mandarin, and Vietnamese — via URL subdirectory prefixing (/es/apply). Middleware strips the locale prefix before routing, so no route is ever mounted twice, and machine-translated content merges over an English base at render time with automatic per-field fallback. Full hreflang alternates and og:locale generate automatically.
Deliberately scoped out: internal admin tools and the safety-critical emergency-report flow stay English-only. A translation error there is an operational risk, not a UX gap.
noindex pre-launch, flipped on at launchsitemap.xml, robots.txt, and — the AI-GEO angle — llms.txt and agents.md: machine-readable site summaries aimed at LLM crawlers and agents, not just search enginesBusiness, job-seeker, quote, and emergency-report forms are all server-validated — not just client-side required attributes — with a honeypot field for scraper bait. Job-seeker resume uploads get file-signature verification instead of trusted MIME types, plus PDF sanitization on the way in.
The part I'm proudest of: sensitive fields like SSNs are encrypted entirely client-side before the form ever submits. The server only ever stores ciphertext — decryption happens offline, locally, never on the server. Admin auth is hand-rolled session cookies with real password hashing, gated on every route, with an emergency after-hours reporting system that pushes alerts to on-call staff.
A unified contacts inbox across every submission type, shift and job-board CRUD, a client roster with billing profiles, and a full invoicing system — PDF generation, drafts, duplication for repeat weekly billing, and percent-markup bill-rate calculation. A read-only integration API lets the owner's external CRM pull submissions programmatically, so nothing has to be re-typed twice.