Work → BASF / Nunhems Mexico

Next.js 16Supabasenext-intlSecurity Audit

Nunhems Quiniela

A World Cup prediction platform for 800+ agricultural distributors across Latin America.

2025·BASF / Nunhems Mexico

Nunhems Quiniela

800+

Active distributors

72

Matches tracked

0

Post-launch incidents

9 weeks

Brief to production

01THE PROBLEM

What needed solving.

BASF Nunhems needed a branded World Cup prediction game for 800+ distributors across Latin America — in Spanish, with real-time scoring, secure authentication, and zero tolerance for downtime during live matches. No off-the-shelf product existed. Timeline: 9 weeks from brief to production.

02THE APPROACH

How we built it.

01

Built on Next.js 16 App Router with Supabase as the database. Spanish-first with next-intl v4 for all 72 match fixtures.

02

Designed a custom scoring engine with PostgreSQL triggers. A column-name bug in the trigger caused a 48-hour debugging session — the fix taught us to always alias ambiguous column references in Supabase trigger functions.

03

Six-pass security audit before launch: RLS policy verification, rate limiting via check_rate_limit() function, service role auth for admin routes, timezone conversion edge cases in the admin form, and a critical self-promotion vulnerability in the prediction flow that would have allowed users to boost their own scores.

04

Deployed on Vercel with ISR for the leaderboard. Branded to BASF March 2025 guidelines — primary orange #F39500, anthracite #333333, Helvetica Neue.

03THE OUTCOME

What shipped.

Deployed 4 days before the tournament kickoff. Zero incidents across the full group stage. 800+ active distributors. The security audit findings were documented and handed to the BASF internal security team.

04TECH STACK

Built with.

Next.js 16Supabasenext-intl v4VercelPostgreSQLRLSTypeScript

Project Details

Client

BASF / Nunhems Mexico

Year

2025

Services

Next.js 16 · Supabase

Status

Live in production

Key Numbers

800+

Active distributors

72

Matches tracked

0

Post-launch incidents

9 weeks

Brief to production

← All work

Minhaz built our World Cup platform from brief to production in nine weeks. The security audit caught things our internal team missed. Delivered on time, zero incidents after launch.

Alejandro Ascencio

Alejandro Ascencio

Marketing Lead, BASF / Nunhems Mexico

Next project →

Larry's Lunch
Larry's Lunch