The marketplace for production-ready software.
Don't just buy code. Know what you are buying.
DevXchange is a developer-first marketplace for source code, SaaS projects, web and mobile applications, websites, AI projects, APIs, templates and scripts. The product is designed around five practical promises: trust, verified code, fair seller economics, transparent licensing and real versioning.
- Frontend: Next.js static export, TypeScript and Tailwind CSS, deployed to GitHub Pages through GitHub Actions.
- Base path:
/DevXchangefor this repository deployment. Public URLs are generated with the repository base path. - Backend: Supabase Postgres, Auth, Storage, Row Level Security and Edge Functions.
- Privileged logic: Edge Functions only. GitHub Pages cannot run a server.
- Payments: a provider interface with Stripe and Razorpay adapters behind Edge Functions. An order is never marked paid without a verified provider webhook.
- Catalog: real Supabase data only. If credentials or catalog data are unavailable, the public build shows an honest empty state.
- Secrets: only the Supabase publishable/anon key may reach the browser. The service-role key is restricted to server-side catalog/build tasks and is checked against build output.
- Install Node.js 20.20.2 and npm 10.8.2 or a compatible Node 20 release.
- Clone this repository.
- Copy
.env.exampleto.env.local. - Set
NEXT_PUBLIC_SUPABASE_URLandNEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY. - Run
npm ci. - Run
npm run dev. - Open the local URL printed by Next.js.
The public application works with an empty catalog. It does not ship invented listings, reviews, sales or user counts.
Apply the SQL migrations in supabase/migrations/ in filename order. Configure the Auth redirect URLs for the GitHub Pages base path, create the documented Storage buckets, and deploy the Edge Functions under supabase/functions/.
Required production configuration is documented in docs/setup.md and docs/security.md.
The production workflow is .github/workflows/deploy.yml and uses actions/configure-pages, actions/upload-pages-artifact and actions/deploy-pages. The workflow publishes apps/web/out and does not use a branch-based Pages build.
In Repository → Settings → Pages → Build and deployment → Source, select GitHub Actions. Do this once if the repository is still configured for a branch/folder source.
No CNAME file is committed until a custom domain is actually configured.
Verification levels are evidence levels, not marketing grades:
- Unverified
- Listing Verified
- Build Verified
- Deployment Verified
- Security Reviewed
- DevXchange Certified
Recorded checks include archive integrity, file hash fingerprint, secret-pattern scan, README presence, dependency manifest and declared license. A check that has not run is Not yet checked. A badge cannot be purchased.
v1 covers public discovery, categories, technology landing pages, product pages, seller onboarding and submission, versioning, admin review, structured reviews, buyer dashboards, favorites, support tickets, standard licensing, infringement reports, order creation and signed-expiring download authorization.
DevXchange was founded by Syed Ali Hasan Moosavi, Founder and Managing Director of SAYANJALI NEXUS PRIVATE LIMITED, Hyderabad, India. His work spans AI products, blockchain infrastructure, enterprise SaaS, cybersecurity/OSINT, automation and open-source tooling.
GitHub: https://github.com/SHalimoosavi
Today almost every builder ships websites, apps and software with AI help, and has tools to check them for vulnerabilities. But when it comes to selling, there is no simple trusted place to do it. DevXchange exists so builders can list finished software and new members can buy and start with zero code, knowing what they get.
The CI workflow runs npm ci, typecheck, lint, unit tests, static build, privileged-secret output checks and Playwright smoke tests. Pages deployment is separate and publishes the same static export through the official Pages deployment actions. The deployment workflow also runs Lighthouse against the live Pages URL and uploads the JSON report.
The final verified run passed typecheck, lint, unit tests, build, secret-output checks and Playwright smoke tests. Lighthouse on the deployed site reported Performance 98, Accessibility 98, Best Practices 96, SEO 100.
- Dependency audit: the current npm install reports 10 vulnerabilities (2 moderate, 6 high, 2 critical). These are not ignored or presented as clean; the dependency tree needs a separate remediation pass before calling the dependency audit clean.
- External service configuration: Supabase SMTP, Auth redirect configuration, payment credentials/webhooks and real buyer/seller accounts are external configuration and are not fabricated by this repository.
- Marketplace inventory: the production catalog is intentionally empty until real sellers and approved listings exist.
- Payment E2E: the public smoke suite verifies the static order/download surfaces and protected routes; real successful payment/webhook/download authorization requires configured Stripe/Razorpay credentials and webhooks.
- Reference image binaries: the repository contains hand-authored SVG versions of the supplied visual concepts and the generated OG image. The original conversation-uploaded PNG binaries are not substituted with fake stock images; replace the SVGs with the final PNG/SVG design assets if you want the exact source files preserved byte-for-byte.
docs/architecture.md— system boundaries and data flowdocs/setup.md— platform-neutral setup and Supabase configurationdocs/security.md— RLS, storage, downloads and secret handlingdocs/seo.md— sitemap, robots, JSON-LD, AEO/GEO and webmaster verificationdocs/licensing.md— Personal, Commercial, Extended and Enterprise termsdocs/api-contract.md— public/client-to-Edge Function contractdocs/market-research.md— marketplace pain points and product decisions
See LICENSE.