Sign Up
Log In
Home

Inspiration

Every social network is built for heroes: clean profiles, motivational posts, and "open to work" banners. But what about the people who work in the shadows? Supervillains have the same problems as everyone else. They need henchmen who show up, buyers for stolen goods, and partners for the next doomsday device. We took the familiar mix of a professional network, a neighborhood alert board and a group chat, and gave it an evil twist. The result is DoomStack, the network where villains get things done together.

What it does

DoomStack is a full social platform for supervillains:

Evil Feed: post your latest schemes, use #hashtags and @mentions, and give other villains an "Evil Nod."
Villain profiles: pick a villain class, add a catchphrase, a nemesis and an Evil CV, and collect endorsements for skills like Mind Control, Hacking and Explosives.
Secure Comms: real-time direct messages with typing indicators, read receipts, reactions, replies, pinning, image sharing, and self-destructing messages.
Bounty Board: post contracts for sabotage, theft or recon, with Doom Coin rewards held in escrow until the job is marked complete.
Global Threat Feed: report hero sightings with a danger level, and let other villains confirm or call them false alarms. Level 5 threats set off a siren.
Secret Societies: private invite-code groups with their own chat.
Rank and economy: earn notoriety to climb from Lackey to Overlord, and compete on the Richest Villains leaderboard.
Villain Lab: a daily scheme generator, an alias generator, and a "Which villain are you?" quiz.
Moderation tools: admins can ban or mute users.

How we built it

Backend: TypeScript with Express and Socket.IO for real-time messaging and live alerts.
Database: PostgreSQL with Prisma. The schema includes users, posts, messages, bounties, sightings, societies, follows, endorsements and notifications.
Security: passwords hashed with bcrypt, JWT login tokens, input validation with Zod, Helmet headers, and rate limiting on both the API and the sockets.
Frontend: a single-page app in plain JavaScript with Tailwind CSS, hosted on GitHub Pages.
Deployment: the API runs in a Docker container on Render, with a managed Postgres database.

Challenges we ran into

Money and race conditions. Escrowed Doom Coins meant two requests arriving at once. A user could double-pay a bounty or refund one that had just been claimed. We solved it with database transactions and atomic status updates.
Trusting the client. Early on, a user could claim to be someone else just by changing the IDs in a request. We rewrote the server to take identity only from the verified login token.
Real-time loops. Our read receipts once made two open chats trigger each other endlessly until we made them fire only when something actually changed.
Deployment gotchas. CORS rejected our site until the allowed origin matched exactly, free-tier servers fall asleep and make the first request slow, and one malformed environment variable took the whole service down.
Moderation. As soon as other people could post, we learned we needed ban and mute tools and a way to reset the database.

Accomplishments that we're proud of

A complete social platform, with real-time chat, an economy, groups and moderation, that runs live on the internet.
A backend that stays safe when users send it malformed or malicious requests.
A consistent villain theme in everything from the copy to the rank names, down to the "Evil Nod."

What we learned

How to design a relational schema with Prisma and keep money-like data consistent using transactions.
How WebSockets and REST work together, and how to avoid the loops and duplicates that real-time features create.
How to secure an app: token auth, validation, rate limiting and safe handling of user content.
How to deploy with Docker, Render and GitHub Pages, and how to debug a deployment from its logs.
That letting real users loose on your app teaches you more than testing alone.