Voleur
voleur.co
Skip to content
Kavcar
Every leaked copy says who it belongs to.
Course platform with hardened content protection: signed video, single-viewer lock, identity watermarks. Next.js 16, Drizzle, Bunny Stream.
What we did
Two layers on payment, 246 tests.
Shopier sends no paid notification. Access therefore opens from two places: a signature-verified webhook and a reconciliation job that runs every five minutes.
If the webhook is missed, the second layer catches it. A student who paid does not wait. The code is held by 246 Vitest tests.
An engineering educator with his own catalogue.
He teaches electrical and electronic engineering. While the courses sold on off-the-shelf platforms, he held neither the content controls nor the customer data.
The platform was built from scratch. Catalogue, payment and student data now sit with him.
The work went where it was most expensive.
Most of the effort went into content protection. Video embeds are signed. A Redis lock keeps one viewer per account.
A moving identity watermark sits on the video. Every PDF is stamped with the student's identity.
Courses, packages, cart, coupons.
Courses, modules and lessons are ordered by drag-and-drop curriculum. Tiered packages, a cart and a coupon engine all run.
The 1-on-1 side has an availability calendar, bookings, lesson credits and a Zoom link.
Admin and personal data stay apart.
The panel covers roles, an audit log, refunds and versioned email templates.
The KVKK data-request flow is included. Not even an administrator can open a student's personal data package.
The stack runs on its own server.
Next.js 16, PostgreSQL with Drizzle, Bunny Stream, BullMQ, TOTP two-factor auth.
It runs on a VPS via Coolify. Encrypted restic backups go to Cloudflare R2.
Screens
Let's talk about what you want built.
Tell us what you want to build and we will work the scope out together.
Ask an AI about Lumiasoft
The question is ready. Let the tool read the site and answer for itself.
