Shivam Kumar

Category · Education

Examm.in

A GATE exam-preparation platform for timed mock tests, focused practice, progress tracking, and community chat.

Live product · GitHub repository

React · TypeScript · Vite · Express · Socket.IO · Turso · Cloudflare R2 · Nginx · AWS EC2 · Sentry · GitHub Actions

Status: The live product is available at examm.in. No separate API documentation, video, or interactive sandbox is published.

System architecture

flowchart LR
    U[Web browser] --> N[Nginx on EC2]
    N --> F[React app and static blog]
    N --> A[Express API]
    N --> W[Socket.IO chat]
    A --> T[(Turso database)]
    W --> T
    A --> R[Cloudflare R2 images]
    A --> X[Turnstile, Resend, Cashfree]
    F --> O[Sentry and PostHog]
    G[GitHub Actions] --> N

Request and data flow

  • Nginx serves the website and sends API and chat traffic to the Node.js backend.
  • Express validates requests, applies rate limits, and reads questions from Turso.
  • Question images are streamed from Cloudflare R2 and cached by the browser.
  • After a test, the client calculates the score and saves results for dashboards, streaks, and leaderboards.

Engineering highlights

  • Complete test engine: Supports mock tests, past papers, multiple answer types, negative marking, review states, and saved results.
  • Search-friendly content: A build script turns more than 3,000 Markdown articles into static pages with LaTeX and sitemap support.
  • Faster repeat reads: Database indexes and short-lived caches reduce repeated work.
  • Automated deployment: GitHub Actions deploys the app to EC2, while Socket.IO powers live chat.

Trade-off: Static article generation improves search visibility but makes builds heavier. In-memory caching is simple and cheap, but cache entries are not shared between multiple backend processes.

Testing, observability, and security

  • Testing: No automated test suite or coverage report is included. Deployment checks that the project builds successfully.
  • Observability: Sentry records frontend/backend errors, while PostHog tracks product usage and feature flags.
  • Security: The backend uses Helmet, CORS rules, rate limits, bcrypt passwords, JWT authentication, Turnstile, webhook verification, and HTTPS. The initial admin credential and browser token storage should be hardened before wider production use.