Aviation
Preparation Academy

A student pilot can have all the material and still not know what actually matters, why a correct answer is correct, or how they will hold up under exam timing.

And behind them, someone has to actually run the business: examinations, products, orders, coupons, guarantee claims, refunds, student access. If that needs a developer every time, it isn't a platform — it's a website with a bill attached.

A public marketing site, a student learning platform and an admin CMS in one Next.js application. Prospective students get pricing transparency and a free ten-question mock exam before they commit to anything.

Active learners get syllabus-indexed study material across PPL, CPL and IR — fifteen theory subjects plus flight-test groundwork — chapter-based practice, timed mock exams at real exam pace, automated Knowledge Deficiency Reports delivered as PDFs by email, and progress tracked per student.

Everything that decides money or access — prices, discounts, entitlements, payment verification, guarantee eligibility — is computed server-side. None of it is taken on the client's word.

That is not a posture statement; it is tested. A dedicated suite runs thirty checks across access control, IDOR, authentication integrity, payment tampering and XSS. The last audit recorded zero vulnerabilities.

• Server-side money and access — prices, discounts, entitlements and guarantee eligibility are all computed on the server. A price that can be edited in a devtools panel is not a price.
• Verified payments, not reported ones — Razorpay callbacks are checked by server-side signature verification before anything is granted — the client saying a payment succeeded is not evidence that it did.
• Signed sessions — JWT sessions signed with jose, passwords hashed with bcryptjs. Input validated with zod at the boundary rather than trusted inward.
• Reports as artefacts — Knowledge Deficiency Reports are generated server-side as PDFs with pdfkit and delivered by email through Resend — something a student keeps, not a page they have to be logged in to re-read.
• A content pipeline, not hand-keying — dedicated tooling extracts, imports, maps, audits and changelogs PPL, CPL and IR syllabus content, with coverage and visibility reports — so fifteen subjects stay in sync with their source syllabi instead of drifting.
• Own design system — a custom CSS design system carrying light and dark themes, rather than a UI framework — the interface is the product's, not a library's defaults.