Startup — From idea to 500 users in 6 weeks

Challenge

Bangladesh's online skincare market is flooded with counterfeit and expired products — an estimated 30-40% of products sold online in South Asia are fake. Existing marketplaces treat skincare like any other product with no invoice verification, no batch tracking, and no expiry monitoring. Consumers face decision paralysis without professional guidance, and cash-on-delivery orders are plagued by velocity abuse, fake names, and rapid-fire ordering that create significant operational losses. The challenge: build a skincare marketplace where every product is verified authentic, every recommendation is personalized, and every transaction is protected against fraud — while keeping the experience seamless for buyers, sellers, admins, and warehouse operators.

Solution

We built TheSkinProof as a verification-first marketplace with four distinct portals. The core Product Verification Pipeline requires every listing to pass invoice checks, Certificate of Analysis (COA) validation, batch tracking, and expiry monitoring before going live. An AI-powered 8-question Skin Quiz generates personalized product recommendations with match-score explanations (90% test coverage on the scoring engine). Multi-signal fraud detection handles velocity abuse, name mismatches, rapid-fire orders, and high-value guest COD with a 0-100 risk scoring system. The platform features granular RBAC with 15+ permission modules and 50+ discrete actions, a complete warehouse management system with FIFO batch allocation, and Bangladesh-specific localization including bKash/Nagad/SSLCommerz payments and Pathao courier integration.

Result

Technical Architecture

Verification-first product pipeline with admin review queue and approve/reject workflow. AI skin quiz with 5-stage scoring: tag weight computation, skin type determination, concern prioritization, exclusion generation, and product matching. Multi-signal fraud detection with COD eligibility engine (blocks COD above risk score 75). HMAC-SHA256 session auth with nonces (no JWT). Redis sliding-window rate limiting with 8 presets (strict to relaxed). Zustand 5 for persistent client state (6 stores: cart, wishlist, auth, chat, notifications, UI). 26-table PostgreSQL schema with UUID primary keys, separate sellers table, product_drafts staging table, and 20 incremental migrations.