← All case studies
EdTech · SaaS · Built & OperatedLive Product

Most platforms teach code. This one runs it.

Progsity is a complete coding-education platform — structured courses, a 10-language cloud IDE, an online judge and integrity-controlled exams — engineered, shipped and operated end-to-end by BWJ Tech.

submission.cpp · Progsity Judge
// graded against hidden tests, compile-once
bool isPrime(long long n) {
    if (n < 2) return false;
    for (long long i = 2; i * i <= n; i++)
        if (n % i == 0) return false;
    return true;
}
AcceptedRuntime 42 msMemory 8.1 MBScore 100 / 100
Project Facts
ClientProgsity (in-house product)
IndustryEducation Technology
RegionGlobal — built and operated from Bangladesh
TimelineIterative — live and growing
Year2025 — present
~301K
lines of TypeScript across 4 repos
10
languages in the cloud IDE, verified live
41
backend modules · 73 data models
28/28
adversarial sandbox checks passed
EN + BN
English & Bangla, transcreated
$0
recurring platform fees, forever
01The Challenge

Renting a platform puts a ceiling on ambition.

Progsity started life on a third-party course marketplace at $499 every month — and every serious product idea ended the same way: the platform can’t do that.

It couldn’t execute a student’s code. It couldn’t run a supervised exam. It couldn’t grade fifty lab submissions at once, speak natural Bangla, or take bKash the way Bangladesh actually pays. The roadmap belonged to someone else — and so did the ceiling.

So we made the founder’s call: stop renting. Build the whole thing, own every line, and operate it in production ourselves.

Run & grade student coderented: no
Secure, invigilated examsrented: no
Online judge & contestsrented: no
Bangla-first experiencerented: no
bKash · Nagad · SSLCommerzrented: no
Own the roadmap & the datarented: no
Progsity, custom-builtall of it — $0/mo
02The Idea

One account. Five products. Each one feeds the next.

We didn't build five apps. We built one ecosystem where a single sign-up reaches everything — and every product is a doorway into the others.

A visitor runs code in the free IDE — zero sign-up required. They save a snippet, so they create an account. The account shows them courses. The course drops them into exercises on the judge. Their teacher discovers the quiz platform, and the institution asks about proctored lab exams. The unified account is the moat — and it’s why the IDE deliberately has no standalone paid SKU: Pro features unlock only by joining the ecosystem.

03What We Built

A full campus, in software.

Six core products on one Fastify backend — 41 modules, 73 data models, one API contract.

Learn

Courses & LMS

A full learning system, not a video playlist.

  • Six lesson types — video, text, resource, quiz, assignment, and live classes with countdown → live → recording states
  • Phased curricula with sequential unlock, drip schedules and auto-resume progress
  • Verifiable certificates — auto-issued PDFs with QR public verification
  • DRM-backed video via Bunny Stream, entitlement-checked on every play
  • Bundles, multi-plan pricing, cohort seats & sprint countdowns
Practice

Progsity IDE

A cloud coding playground anyone can use — no account, no setup.

  • 10 languages — C, C++, Python, Java, JavaScript, TypeScript, Go, Rust, PHP, Ruby — all 32 toolchains verified live
  • Zero-auth execution; login unlocks saving, sharing & public profiles
  • Monaco editor, stdin, exec time & memory readouts, share links & embeds
  • Sandboxed: no network, strict CPU/memory/output ceilings, rate limits
  • AI “Explain my code,” metered by an atomic credit system
Compete

Online Judge

A competitive-programming judge engine built for real grading.

  • Bilingual problems with samples, editorials, tags & difficulty
  • 9 verdicts, 3 scoring modes — binary, per-test, subtask
  • 4 checker types including sandboxed custom checkers
  • Hidden test data lives in a private bucket — never client-visible
  • Contest mode designed in from day one: ratings, freezes, clarifications
Examine

Lab Exams & Coding Tests

Solves the problem no one else in the market touches: one instructor, fifty students, real code, real marks.

  • Integrity Kernel — fullscreen & focus monitoring, paste metering, tamper-evident telemetry with hash-chained events
  • Per-student problem variants so adjacent seats get different problems
  • Live invigilation console: risk-ranked roster, code playback, verdicts
  • Similarity analysis with winnowing + MinHash fingerprints
  • Join by roster code — students never create accounts mid-exam
Assess

Quiz & Exams Platform

A standalone assessment SaaS with its own subscription tiers — Free to Enterprise.

  • 8 question types shipped, from fuzzy-matched fill-in-the-blank to AI-assisted essays — auto-graded code answers on the roadmap
  • Tracked & Strict secure modes with teacher-controlled thresholds
  • Copy-on-publish immutability — a running exam can never silently change
  • Google Forms import as a one-click migration funnel
  • Embeds, templates, leaderboards, org cohorts & analytics
Submit

Assignments

Coursework that goes deeper than Google Classroom.

  • Rubric-first grading with audit trails on every mark change
  • Inline annotation on text, code & files; milestones with checkpoints
  • Code mode with server-only hidden tests
  • AI feedback drafts — teacher-reviewed, never auto-published to students
  • Due-date notifications with quiet hours, in English and Bangla
bKash · Nagad · SSLCommerz paymentsCoupons & payment linksCampus ambassador programXP, streaks & 16 badgesRevenue-sharing ledger40-section admin panelRBAC · 5 roles · 35 permissionsLifecycle email automationMarketplace & digital productsEN/BN transcreated copy
04The Engineering

The parts you can't buy off a shelf.

Four decisions that show how we work — with the numbers that forced them.

We did the arithmetic — then built our own judge engine.

Off-the-shelf judges compile every submission from scratch, per test case. For a 50-student, 2-hour lab exam, the math simply doesn’t close: 9,600 CPU-seconds of work against 7,200 available. No amount of tuning fixes arithmetic.

So we built progsity-runner: a first-party sandbox on isolate — the same isolation layer used by international olympiads — that compiles once and runs the artifact against every test. Measured on production hardware: 11× faster compilation throughput. The exam that was physically impossible became routine.

50 students × 2h lab examthe workload
CPU-seconds needed (compile per test)9,600
CPU-seconds available7,200
Needed with compile-once-run-many~2,000
Compile throughput, measured live11× faster

We attacked our own sandbox before any student could.

Before the runner was allowed near a real exam, it had to survive a scripted adversarial gate on the live production host — every attack run twice, once as a student submission and once as a malicious instructor-supplied checker, and every check required to prove it actually provoked the condition it claims.

28 of 28 checks passed. And because the gate ran on real hardware, it caught two defects no offline test would ever find.

verify:hardening · live judge host28 / 28
Fork bomb — 15 forks, then deniedtimed_out
Memory bomb — stopped at the exact ceilingmemory_exceeded
Output flood — cut at 1,048,576 bytescrashed
Filesystem escape — /etc, siblings, ../ traversalall denied
Steal the runner's own credentialsdenied
Network egress — TCP, UDP, DNSunreachable
Every attack costs one submission — never the cohort behind it. The gate is re-runnable on demand, and a check that cannot run counts as a failure, not a skip.

We refused to sell “cheat-proof” — and built something better.

Every proctoring vendor promises what a browser cannot deliver. We wrote the opposite into the spec: an honest capability matrix that is the single source of truth for every integrity claim — in product, marketing and support. Words like “cheat-proof” are contractually forbidden in our own copy.

Telemetry is hash-chained and sequence-numbered, so suppressing it is itself evidence. Risk scores triage — they never auto-penalize. Every integrity outcome is a human decision, recorded with evidence, and appealable. Institutions trust it precisely because it never overclaims.

The client is a sensor. The server is the authority.

Integrity Kernel — design principle

We operate it like owners, because we are.

BWJ Tech doesn’t hand off and walk away. Progsity runs on infrastructure we manage daily — DigitalOcean Singapore, MongoDB Atlas, Cloudflare R2, Vercel — behind a CI/CD pipeline where the production server never contacts GitHub, pulls before it swaps, health-gates on real readiness, and can roll back to the previous image digest automatically.

Every incident becomes a written post-mortem, and every post-mortem becomes a pipeline rule. Uploads pass through ClamAV malware scanning. Exam data lives in a bucket that is never presigned and has no public path. Uptime is watched around the clock.

RegionSingapore (SGP1) + global edge
DeploysGitHub Actions → GHCR → health-gated
Rollbackprevious image digest, automatic
Course page p95≤ 300 ms (was 1–3 s)
Admin analytics p95≤ 500 ms (was ~9.8 s)
Uptime checksevery 5 minutes, 24/7
05The Architecture

Boring where it should be. Sharp where it counts.

Next.js on the edge, a clean-architecture Fastify monolith at the core, and untrusted code quarantined on its own hardware inside a private network.

Student web app
Next.js 15 · React 19 · Vercel edge · EN/BN
Admin panel
Next.js 16 · 40 route groups · Vercel
Public IDE & embeds
Monaco · zero-auth · SEO landing pages
▼   one API contract · JWT + httpOnly refresh · Redis-cached reads   ▼
Progsity API — Fastify 5 modular monolith
41 modules · 73 Mongoose models · clean architecture (routes → controllers → services → repositories) · Nginx + Docker · DigitalOcean SGP1
▼   private VPC — judge traffic never touches the public internet   ▼
progsity-runner
first-party graded sandbox · isolate · compile-once · VPC-only bind
Judge0 CE
playground execution · firewalled to the API host only
MongoDB Atlas · Redis
primary data · cache, queues, rate limits
R2 · Bunny · Cloudflare
object storage ×2 buckets · video DRM · images, DNS, WAF

Two storage buckets with separate credentials, so the browser-reachable document path can never reach exam answer keys. The runner binds only its private VPC address — a firewall mistake alone cannot expose it. Defence in depth, at zero extra cost.

06Product Ethics, In Code

Values that compile.

These aren't slogans from a deck. Each one is enforced by the codebase.

A student's submission is always accepted — even when the teacher's plan is over quota.

Billing problems belong to adults, never to a student's coursework. Creator uploads block; student submissions never do.

AI drafts feedback. It never speaks to a student directly.

Every AI-generated comment is a private draft the teacher must accept, edit or discard — with an audit row either way.

A risk score triages. It never punishes.

Every integrity outcome is a human decision, recorded with evidence, and appealable. Unreliable detection was left unbuilt on purpose.

Bangla is transcreated, never machine-translated.

The copy says “অফার লেটার” because that's the phrase Bangladeshi students actually use. Language switching is geo-aware down to the field level.

07The Results

Shipped, live, and earning.

$499 → $0
monthly platform rent eliminated — the roadmap and the data now belong to the business
5+
products live behind one account: LMS, IDE, judge engine, quiz platform, assignments
65+ hrs
of course video live in the flagship Competitive Programming program
32/32
IDE toolchains verified against the deployed API — not a staging box
100/100
first real graded submission through the new judge engine — limits, checkers & leak-tests proven in the same run
261
automated checks passed before the judge's first graded run — sandbox attacks, acceptance suites, live toolchain and storage-security verification
Tech Stack
Next.jsReact 19FastifyNode.jsTypeScriptMongoDBRedisDockerCloudflare R2Bunny StreamDigitalOceanVercel
Next case study
Madrasa Education Board System

A board-level education platform, wireframe to production in five weeks