DEV Community: Mir Mursalin Ankur

Claude Code Configuration Blueprint: The Complete Guide for Production Teams

Mir Mursalin Ankur — Sun, 15 Mar 2026 05:01:20 +0000

Configure Claude Code once — get security, reusable workflows, specialized agents,
and cross-session intelligence across every project.

Who This Is For

You've used Claude Code on a project or two. You know the basics. Now you want to:

Stop Claude from touching secrets, credentials, or system files
Share team standards via git without leaking personal preferences
Create reusable workflows (spec, plan, implement, review, ship)
Make Claude remember lessons across sessions

This guide gives you copy-paste configs and explains the why behind each decision.

The Configuration Layers

Claude Code loads configuration from multiple layers, each with a specific scope:

Personal (not in any repo):
  ~/.claude/settings.json        → Security (deny list for all projects)
  ~/.claude/CLAUDE.md            → Personal workflow preferences
  ~/.claude/skills/*/SKILL.md    → Reusable workflows
  ~/.claude/commands/*/SKILL.md  → Convenience shortcuts
  ~/.claude/rules/*.md           → File-specific patterns (glob matching)
  ~/.claude/agents/*.md          → Domain specialists

Team-shared (committed to git):
  .claude/settings.json          → Project permissions
  CLAUDE.md                      → Coding standards, architecture
  .claude/rules/*.md             → Team-specific patterns

Personal overrides (gitignored):
  .claude/settings.local.json    → Your project overrides
  CLAUDE.local.md                → Your project preferences

Key rule: Your project CLAUDE.md must be self-contained. Teammates don't have your global skills, agents, or personal CLAUDE.md — global files are your personal toolkit, project files are the team playbook.

Part 1: Security — The Permission System

Permissions follow a strict hierarchy: Deny (always blocks) → Ask (prompts you) → Allow (auto-approved). Deny always wins — this is what makes the system trustworthy.

Pattern Syntax

Bash(exact command)       → matches only that exact command
Bash(command *)           → matches command with any arguments (space before *)
Read(path/to/file)        → matches exact file
Read(path/**/*.json)      → matches glob pattern
Read(~/.ssh/**)           → ~ expands to home directory on any OS

Space matters: Bash(ls *) matches ls -la but NOT lsof. Bash(ls*) matches both.

Global Settings (`~/.claude/settings.json`)

{
  "permissions": {
    "allow": ["Read", "Edit", "Write", "Glob", "Grep", "Bash(git status:*)", "Bash(git diff:*)", "Bash(nvm use:*)", "Bash(node:*)", "Bash(ls:*)"],
    "ask": ["Bash(git push:*)", "Bash(git commit:*)", "Bash(pnpm install:*)", "Bash(docker:*)", "Bash(curl:*)"],
    "deny": ["Bash(rm -rf:*)", "Bash(sudo:*)", "Bash(git push --force:*)", "Read(.env)", "Read(.env.*)", "Read(~/.ssh/**)", "Read(~/.aws/**)", "Read(~/Library/Keychains/**)"]
  }
}

Cross-OS coverage: The deny list covers macOS (~/Library/Keychains), Linux (~/.local/share/keyrings), and Windows WSL (/mnt/c/Users/*/AppData). One global config works on any machine.

Project Settings (`.claude/settings.example.json`)

{
  "permissions": {
    "allow": ["Read", "Edit", "Write", "Glob", "Grep", "Bash(pnpm build:*)", "Bash(pnpm test:*)"],
    "deny": ["Read(.env)", "Read(.env.*)", "Read(node_modules/**)", "Read(dist/**)"]
  }
}

Add to .gitignore: .claude/* and !.claude/*.example*

Part 2: CLAUDE.md — Teaching Claude Your Codebase

A well-written CLAUDE.md turns Claude from a generic assistant into a team member who knows your conventions, pain points, and architecture.

The Instruction Budget Problem

Frontier LLMs reliably follow roughly 150–200 instructions total. Claude Code's system prompt consumes ~50 slots before your CLAUDE.md loads. Instruction degradation is uniform — every low-value rule you add actively makes your high-value rules less likely to be followed.

Brevity isn't nice — it directly affects instruction compliance.

The Template

Write it for Claude, not humans. Don't duplicate your README.

# CLAUDE.md

## Commands
- `pnpm dev` — Start development server
- `pnpm build` — Production build
- `pnpm lint-fix` — Lint and fix all packages

## Architecture
- `packages/client` — Vue 3 frontend
- `packages/server` — Express API
- `packages/shared` — Types, DTOs, utilities

## Coding Standards
- TypeScript strict mode, no `any` types
- Absolute imports only (no `../../`)
- API payloads: declare as typed constants

## PR Review Rules
1. **Type Safety** — Never use `any`. Typed constants for API payloads
2. **Dead Code** — Remove unused imports, variables, i18n keys
3. **Error Handling** — Wrap all API calls in try/catch

## Critical Gotchas
- Always use projection in DB queries — never fetch entire documents
- Server error messages MUST come from constant files

Progressive Disclosure

For larger projects, use a progressive disclosure pattern — put detailed docs in a separate directory:

## Detailed Documentation
When working on specific areas, read the relevant doc first:
- `docs/Agent/database_schema.md` — Data model and relationships
- `docs/Agent/payment_flow.md` — Payment gateway integration

What Works vs. What Doesn't

Do	Don't
Include commands Claude needs	Include formatting rules (use linter + hooks)
Document non-obvious patterns	Document obvious language features
List real PR review pain points	Duplicate your README
Keep it under 200 lines	Include aspirational rules nobody follows

Part 3: Rules — Enforcing Patterns with Globs

For patterns that must apply across specific file types, use rules with glob matching. Place them in ~/.claude/rules/:

---
description: Common coding mistakes — enforced across all projects
globs: "*.ts,*.tsx,*.vue,*.js,*.jsx"
---

# Coding Gotchas
- Never use relative imports (`../../`) — always absolute paths
- Never introduce `any` types — find or create the proper type

When Claude edits files matching the glob, these rules apply automatically.

	CLAUDE.md	Rules (`~/.claude/rules/`)
Scope	Per-project	Global (all projects)
Content	Architecture, commands, standards	File-specific patterns
Trigger	Loads when working in directory	Loads when file matches glob
Best for	Teaching your codebase	Enforcing patterns across projects

For teams: commit project-specific rules to .claude/rules/ in your repo.

Part 4: Plugins & Agents — Instant Capabilities

Plugins

Plugins are pre-built packages from the community. One install command gives you agents, MCP servers, and skills:

claude plugins:install context7 superpowers code-review feature-dev

Recommended stack:

Plugin	Purpose
`context7`	Live, version-specific documentation lookup
`feature-dev`	Codebase exploration + architecture design agents
`superpowers`	TDD, debugging, brainstorming, parallel agents
`code-review`	Multi-agent PR review with confidence scoring
`playwright`	Browser automation and E2E testing
`commit-commands`	Streamlined git commit, push, and PR creation

MCP Servers — Many plugins include MCP (Model Context Protocol) servers that bridge Claude Code with external systems (databases, APIs, task trackers). No additional configuration needed.

Custom Marketplaces — Add team-specific or community plugins:

{
  "extraKnownMarketplaces": {
    "my-team": { "source": { "source": "github", "repo": "my-team/claude-plugins" } }
  }
}

Agents

Agents are pre-configured specialists you can call for specific tasks. Unlike plugins (which add tools), agents add expertise.

Category	Example Agents	When to Use
Engineering	`backend-architect`, `frontend-developer`, `ai-engineer`	Domain-specific architecture
Testing	`test-writer-fixer`, code-review agents	Test strategy, bug fixing
Operations	`analytics-reporter`, `finance-tracker`	Data analysis, reporting
Development	`code-explorer`, `code-architect`, `rapid-prototyper`	Codebase understanding, MVPs

Example: Instead of explaining React Server Components patterns, say "Use the frontend-developer agent to build this with Server Components." The agent already knows the patterns, has React-specific tools, and follows frontend best practices automatically.

	Plugins	Agents
What they add	Tools, MCP servers, skills	Domain expertise and focus
Best for	Adding capabilities	Complex tasks requiring depth

Part 5: Skills & Commands — Building Workflows

Skills vs. Commands

	Commands (`~/.claude/commands/`)	Skills (`~/.claude/skills/`)
Purpose	Convenience shortcuts	Workflow orchestration
Examples	`/commit`, `/loop`, `/rewind`	`/spec`, `/implement`, `/grill`
Scope	Single operations	Multi-step processes
Use Case	Quick actions	Structured workflows

Use a command for quick shortcuts. Use a skill for multi-step workflows with decision points.

The Spec-to-Ship Workflow

The real power of skills comes from chaining them into a complete development workflow:

/scope (optional) → /spec → /grill (auto) → /plan-work → /grill (auto) → /implement → /verify → /ship

The ceremony scales with the risk:

Task Type	Workflow
New product	`/scope` → full chain
Feature	Full chain
Minor enhancement	Light spec → plan → implement → verify → ship
Bug fix	Bug spec or skip → plan → implement → verify → ship
Hotfix	Inline plan → implement → verify → ship

Key Skills

Skill	Purpose
`/scope`	Rapid product scoping — forces "ONE thing" question, maps user journey, identifies cost drivers
`/spec`	Clarified technical spec with Change Log for tracking mid-implementation updates
`/grill`	Hard-critic review through 7 lenses (security, architecture, testing, etc.) with severity levels
`/plan-work`	Phase-by-phase implementation plan traced to spec requirements
`/implement`	Executes plans with mid-implementation discovery handling (minor/moderate/significant tiers)
`/verify` → `/pre-review` → `/ship`	Type check → spec requirement walkthrough → branch management + PR creation

Ticket Directory Structure

ai/TICKET-146/
├── requirements/
│   ├── original-requirement.md    # Raw requirement (verbatim)
│   ├── spec.md                    # Clarified technical spec
│   └── grill-log.md              # Review findings
├── plans/
│   ├── overview.md               # High-level plan
│   ├── phase-1-data-model.md     # Detailed phase plan
│   └── grill-log.md              # Plan review findings
└── tests/
    └── manual-test-cases.csv

This structure makes work resumable across sessions — future sessions read spec/plan files to pick up where you left off.

Building Your Own Skills

---
name: my-skill
description: Use when the user says "plan this" or presents a multi-file task
---

# Skill Title
## When to Use
- [Trigger conditions]

## Process
### Step 1: [Name]
[Instructions Claude follows]

## Rules
- [Hard constraints]

Three tips:

Write instructions TO Claude, not documentation ABOUT a process
Include trigger phrases in the description
Keep each skill focused — one workflow, one skill

Part 6: Advanced Patterns — Hooks, Subagents, Worktrees

Hooks — Automated Quality Gates

Hooks run automatically at lifecycle events. Two types:

prompt — Claude evaluates a condition and acts (block, remind, warn)
command — Runs a shell command directly (always executes)

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{
        "type": "prompt",
        "prompt": "If this is a git commit, verify lint and type-check have been run. If not, block with: 'Run lint and type-check before committing.'"
      }]
    }],
    "PostToolUse": [{
      "matcher": "Write|Edit",
      "hooks": [{
        "type": "prompt",
        "prompt": "If the file is TypeScript and more than 3 TS files have been edited since the last type-check, remind: 'Consider running type-check before continuing.'"
      }]
    }],
    "Notification": [{
      "matcher": "",
      "hooks": [{ "type": "command", "command": "notify-send 'Claude Code' 'Awaiting your input'" }]
    }]
  }
}

Use hooks instead of CLAUDE.md for linting rules — LLMs are expensive compared to linters. Hooks free up instruction budget for things only CLAUDE.md can teach.

Subagents — Keeping Context Clean

For complex tasks, spawn subagents to handle research, exploration, or parallel work. Subagents run in separate contexts and return distilled findings — keeping your main conversation focused on implementation.

Scenario	Example
Research	Investigating a library before using it
Exploration	Understanding a large codebase section
Parallel work	Running independent analyses
Heavy debugging	Deep investigation
Code review	Multiple reviewers checking different aspects

Many skills use subagents automatically. /grill spawns review agents for different aspects. /implement may spawn research agents for unfamiliar libraries.

Worktrees — Isolated Development

For feature work that needs isolation, use git worktrees. Claude can create and manage worktrees, giving you a clean environment for each branch.

Scenario	Benefit
Multiple features	Work on several branches simultaneously
Parallel testing	Test approaches in isolated environments
Code review	Review PR branches while keeping main stable
Hotfixes	Fix production without interrupting feature work

Part 7: Automation — Auto-Invocation & Memory

Auto-Invocation — Skills That Trigger Themselves

Both plugins and skills support auto-invocation — Claude reads the skill's description and triggers it automatically when your request matches. You don't need to remember slash commands.

To make auto-invocation reliable:

Be specific with trigger phrases — vague descriptions lead to false activations
Include negative triggers — "Do NOT use for TDD projects — use /plan-tdd instead"
Test with natural language — try different phrasings

Example: With /grill configured to trigger on "grill this", "poke holes", or "stress test this", simply saying "poke holes in this spec" auto-triggers the workflow.

Auto Memory — Cross-Session Intelligence

Claude Code maintains a persistent memory directory per project at ~/.claude/projects/<project-path>/memory/. The MEMORY.md file (first 200 lines) loads into every conversation automatically — no manual setup needed.

Claude updates this file as it learns your project: architectural patterns, common mistakes, file paths that matter. The /ship skill captures learnings at the end of each ticket automatically, so memory grows organically across sessions.

Part 8: Putting It All Together

New Project Setup (5 Minutes)

Create CLAUDE.md — commands, architecture, coding standards, PR review rules, critical gotchas
Create .claude/settings.example.json — project-specific deny list
Optionally create .claude/rules/*.md — project-specific patterns with glob matching
Add to .gitignore: .claude/* and !.claude/*.example*
Ensure ~/.claude/settings.json has the global security deny list
Install plugins: claude plugins:install context7 superpowers code-review feature-dev

How the Layers Work in Practice

"Read .env.local"             → Project deny  → BLOCKED
"pnpm add lodash"             → Ask rule      → Prompts you
"git push --force"            → Global deny   → BLOCKED (even with --dangerously-skip-permissions)
"Read src/components/App.vue" → Allow         → AUTO-APPROVED
"This test is failing"        → Auto-invoke   → debugging skill triggers

Quick Reference

File	Shared?	Purpose
`~/.claude/settings.json`	No	Global security (deny list)
`~/.claude/CLAUDE.md`	No	Personal workflow preferences
`~/.claude/skills/*/SKILL.md`	No	Custom workflows
`~/.claude/commands/*/SKILL.md`	No	Convenience shortcuts
`~/.claude/rules/*.md`	No	File-specific patterns (glob)
`~/.claude/agents/*.md`	No	Domain specialists
Plugins	No	Pre-built agents + MCP + skills
`.claude/settings.json`	Yes	Team project permissions
`.claude/rules/*.md`	Yes	Team-specific patterns
`CLAUDE.md`	Yes	Team coding standards
`~/.claude/projects/*/memory/`	No	Cross-session memory

The Takeaway

Layer your configuration by scope and shareability:

Global settings protect your system — secrets, credentials, destructive commands
Project settings protect project resources — config files, build artifacts
CLAUDE.md encodes team standards (keep it under 200 lines — every low-value instruction degrades high-value ones)
Rules enforce file-specific patterns with glob matching — language conventions, gotchas
Agents provide domain expertise — backend, frontend, AI, testing, operations
Plugins add instant capabilities — code review, testing, documentation, MCP servers
Skills encode workflows (multi-step) — Commands handle shortcuts (single actions)
Hooks automate quality gates — free up CLAUDE.md instruction slots
Subagents keep context clean — offload research, exploration, parallel analysis
Worktrees enable isolated development — multiple branches without switching
Memory captures lessons learned — no reteaching the same thing twice
Auto-invocation makes skills trigger themselves — no slash commands needed

The spec-to-ship workflow isn't bureaucracy. It's front-loading the thinking so implementation is mechanical. A grilled spec catches the bug that would have taken a day to debug. A phased plan prevents the "I changed 47 files and nothing type-checks" disaster.

Configure once. Benefit on every session, every project, every team member.

References

Official:

Claude Code Documentation — Permissions, hooks, settings, skills
Plugins README — Plugin marketplace

Community:

Writing a Good CLAUDE.md — HumanLayer — Instruction budgets research
Claude Code Hooks: Complete Guide — aiorg.dev — 20+ hook examples
Claude Code Permissions Guide — eesel.ai — Security setup

Let's Connect

I'm always excited to hear about what you're building! If you found this guide helpful, have questions, or just want to share your Claude Code journey:

Website: encryptioner.github.io
LinkedIn: Mir Mursalin Ankur
GitHub: @Encryptioner
X (Twitter): @AnkurMursalin
Technical Writing: Nerddevs

Navigating Bangladesh's Software Industry: A Practical Guide for Developers in 2026

Mir Mursalin Ankur — Tue, 20 Jan 2026 15:39:57 +0000

Bangladesh's software industry has grown rapidly over the past decade. From $1.3 billion in exports to 2,650+ ICT companies employing hundreds of thousands of developers, the sector has transformed from a niche outsourcing destination into a serious global technology hub. The country now boasts over 1 million active freelancers (2026), making it a global freelancing powerhouse.

But the landscape has changed dramatically. The entry-level market is saturated. Senior talent is scarce. And the post-2024 reality—marked by internet shutdowns, tax policy uncertainty, and global competition—means the easy growth is over.

This guide is about action—not analysis.

The Brutal Truth: Too Many Developers, Not Enough Jobs

Let's start with what's actually happening in Bangladesh.

We have a massive oversupply problem. Every year, hundreds of universities and colleges pump out thousands of computer science graduates. Add to that the hundreds of online training institutes, bootcamps, and YouTube tutorials creating "developers" in 3-6 months.

The result? A glut of low-skill junior developers fighting for the same entry-level positions.

Experience Level	Jobs Available	Candidates	Competition
Entry-level	~12,000	30,000+	2.5x oversubscribed
Mid-level	~8,000	20,000	2.5x oversubscribed
Senior	~3,000	5,000	1.7x oversubscribed
Specialized	~1,000	500	0.5x (talent shortage)

The lesson: If you're doing what everyone else is doing (basic web development, tutorial-heavy learning, no specialization), you're competing with 2-3 other people for every job.

Why This Is Happening: The Training Glut

The University Problem

Bangladesh has 150+ universities offering computer science and engineering programs. Many of these programs are outdated, teaching curriculums from 5-10 years ago. Students graduate knowing theory but unable to build real applications.

Common issues:

Professors who haven't worked in the industry in decades
Outdated technologies (teaching Java applets in 2026)
Zero emphasis on practical projects
No industry exposure or internships

The Online Course Explosion

YouTube, Udemy, Coursera, and local platforms have made programming education accessible to everyone. But this has created a new problem: tutorial developers.

Thousands of graduates complete 20+ tutorials but can't:

Build an original project without following instructions
Debug their own code
Write clean, maintainable code
Explain technical decisions
Work in a team environment

The Bootcamp Industry

Dozens of "become a full-stack developer in 3 months" bootcamps promise quick careers. They teach students to copy-paste code, pass interviews, and get jobs. But these developers struggle when faced with real-world complexity.

The result: Companies are flooded with resumes from graduates who look good on paper but can't deliver. They've stopped trusting fresh graduates and now require 2-3 years of experience—even for "entry-level" positions.

The New Reality: Global Competition + AI

Just when Bangladesh's oversupply problem was peaking, two global shifts made things harder:

1. Remote Work Saturation

During COVID, remote work exploded. Bangladeshi developers could finally access international jobs. But this also meant they were now competing directly with developers from India, Pakistan, Eastern Europe, and the Philippines—all of whom offer similar rates.

2. AI Coding Tools

AI tools like ChatGPT, GitHub Copilot, and Claude have changed the entry-level equation globally. A Stanford study found that employment for software developers aged 22-25 dropped nearly 20% between 2022-2025.

Why this hits Bangladesh hard:

Entry-level tech hiring globally decreased 25% in 2024
70% of hiring managers believe AI can do the work of interns
Companies asking: "Why hire a junior for $90K when GitHub Copilot costs $10?"

The tasks that junior developers used to do—writing boilerplate code, fixing bugs, writing test scripts—are now what AI tools handle well.

Three Career Paths That Actually Work

Despite the challenges, there are still paths to a successful career. You just need to be strategic.

Path 1: Specialization Premium

Pick a high-value niche (embedded systems, AI/ML, security, DevOps)
Become exceptional in it
Charge 2-3x what generalist developers charge
Competition: Low
Why it works: Specialized work is harder to automate and outsources can't easily replicate

Path 2: International Remote

Build skills for global market
Work directly for US/European companies
Earn in USD (3-5x local rates)
Competition: Medium (requires English and self-marketing)
Why it works: Local market is saturated; global market has talent shortages

Path 3: Local Premium

Join top outsourcing companies (Cefalo, Enosis, Optimizely, Cheq)
Work your way up through established career ladders
Earn local premium rates
Competition: High (everyone wants these jobs)
Why it works: These companies have established client relationships and can pay more

The AI Reality: Don't Ignore It, Don't Overrate It

85% of developers globally use AI tools, but here's what most don't realize:

The challenges:

46% distrust AI accuracy (only 3% "highly trust" it)
66% are frustrated by "AI solutions that are almost right, but not quite"
45% say debugging AI-generated code takes longer
67% spend more time debugging AI code
68% spend more time fixing security issues in AI code

The reality: AI makes you faster at routine tasks but can slow you down overall when you account for verification and debugging.

What this means for you:

Learn AI tools – GitHub Copilot, Cursor, ChatGPT, Claude, Gemini are industry standards
But don't depend on them – Understand what the code is actually doing
Focus on what AI can't do – Architecture, security, business logic, client communication

Developers resist using AI for high-responsibility tasks:

Deployment and monitoring: 76% don't use AI
Project planning: 69% don't use AI

That's where your value lives.

Action Plan: Your First 5 Years

Year 1: Foundations + Specialization Choice

Months 1-6: Pick your lane (don't try to do everything)
- Web/Mobile? Generalist path, more competition
- Embedded Systems? Fewer competitors, higher pay
- AI/ML? Growing field, severe talent shortage
- DevOps/Cloud? Critical infrastructure, hard to find
- Security/Biometrics? Trust-sensitive, premium pay
Months 7-12: Build portfolio while learning
- 3-5 substantial projects (not tutorials)
- Learn AI tools—but don't depend on them
- Start freelancing on Upwork for real experience

Year 2-3: First Job + Skill Deepening

Target companies based on your chosen path
Build real-world experience
Start specializing deeper
Salary target: 30,000-50,000 taka/month

Year 3-5: Seniority or Pivot

Option A: Grow in current company toward senior roles
Option B: Jump to higher-paying company
Option C: Go full remote international
Salary target: 80,000-150,000+ taka/month

Specialization Deep Dives

Embedded Systems & IoT

Why pays premium: Specialized knowledge, fewer engineers, global talent shortage
Market demand: ~2,921 embedded systems job openings on major job portals
Key employers: Samsung R&D Institute Bangladesh, Teton Electronics, BJIT Embedded, SIMEC, Subra Systems, Ninos IT Solution
Skills needed: C/C++, firmware development, microcontrollers, RTOS, hardware-software integration
Salary range: 60,000-180,000+ taka/month
Time to expertise: 12-18 months

AI/ML & Data Science

Why pays premium: Global talent shortage, high value work
Skills needed: Python, TensorFlow/PyTorch, SQL, statistics, MLOps
Salary range: 100,000-200,000+ taka/month
Time to expertise: 18-24 months

DevOps & Cloud

Why pays premium: Critical infrastructure, hard to find qualified people
Skills needed: Linux, AWS/Azure/GCP, Docker, Kubernetes, CI/CD, scripting
Salary range: 120,000-250,000+ taka/month
Time to expertise: 12-18 months

Security & Biometrics

Why pays premium: Trust-sensitive roles, regulatory requirements
Key employers: Tiger IT, security roles at banks/telecom
Skills needed: Cryptography, network security, ethical hacking, compliance
Salary range: 90,000-150,000+ taka/month
Time to expertise: 12-18 months

Targeting the Right Companies

Tier 1: International Outsourcing (Premium Pay)

Cefalo: Norwegian market, 65,000-220,000 taka/month
Enosis: US/Europe clients, 50,000-220,000 taka/month
Optimizely BD: US company, 70,000-300,000 taka/month
Cheq BD: US cybersecurity, 70,000-300,000 taka/month
Tero Labs: 120,000-150,000 taka/month

Tier 2: Top Local Companies

Brain Station 23: 60,000-220,000 taka/month (800+ employees)
BJIT: Japanese market, 30,000-220,000 taka/month (80% work from Japan)
Selise: Swiss-Bangladeshi operations (~$37.9M revenue)

Tier 3: High-Growth Startups

Pathao: 65,000-180,000 taka/month + equity
Chaldal: 70,000-180,000 taka/month
ShopUp, Shikho, Arogga: Competitive packages + equity upside

Salary Breakdown: The Real Numbers (2024-2025)

Level	Salary Range (BDT/month)	Salary Range (USD/month)
Trainee/Intern	0-15,000	$0-135
Junior Developer (0-2 years)	20,000-45,000	$180-405
Software Engineer (2-5 years)	50,000-80,000	$450-720
Senior Engineer (5+ years)	100,000-220,000	$900-1,980
Tech Lead/Principal	165,000-300,000	$1,485-2,700

The Remote Work Premium: Engineers working remotely for international companies earn substantially more (~345,000 taka/month average)—2-4x higher than local salaries.

Training: What Actually Works in 2026

For Foundations:

BITM (BASIS): Industry-aligned, most credible for placement
University CS programs: Top-tier only (BUET, DU, KUET, RUET, NSU, BRAC, AIUB)
Poridhi.io: Bangla-language, AI/ML tracks, 250+ hands-on labs

For Practical Skills:

Build real projects, not tutorials – This is the #1 differentiator
GitHub portfolio – Quality over quantity
Freelancing on Upwork – Real client experience
Open source contributions – Demonstrates collaboration skills

AI Tools (Learn, Don't Depend):

GitHub Copilot, Claude, Gemini, or Cursor – Industry standard tools
Practice validation – Review AI code for security and correctness
Understand first, then automate – Strong fundamentals matter more than AI skills

Red Flags:

Courses that only teach syntax without projects
"Become a full-stack developer in 3 months" claims
No portfolio/real-world application
Instructors who haven't worked in the industry
"AI will replace developers" – No, it won't. But developers who use AI will replace those who don't.

Common Mistakes to Avoid

Mistake 1: Tutorial addiction

Problem: You've completed 20 tutorials but can't build anything original
Solution: After learning basics, stop tutorials and build original projects

Mistake 2: Jack of all trades

Problem: You know a little of everything, expert in nothing
Solution: Pick one stack and go deep

Mistake 3: Ignoring the market reality

Problem: "If I learn MERN stack, I'll get a job"
Solution: Look at what companies actually need. 30,000+ people know MERN. Fewer know embedded systems or DevOps.

Mistake 4: Relying on AI too much

Problem: Copy-pasting AI code without understanding it
Solution: Always validate. Security vulnerabilities in AI code are common.

Mistake 5: Waiting for the "perfect job"

Problem: 6 months unemployed, waiting for top company
Solution: Take the good-enough job, build skills, move up later

Mistake 6: No specialization

Problem: Doing what everyone else is doing
Solution: Pick a niche. Embedded systems, security, DevOps, AI/ML—anything but generic web development.

Where the Industry Is Headed

Short-term (2026-2027):

Post-2024 stabilization (after internet shutdown, white paper, tax changes)
Entry-level jobs remain tough; senior/specialized roles in high demand
AI adoption accelerates—teams that use AI effectively will win

Medium-term (2027-2029):

Developer role transforms from "coder" to "problem solver"
Companies that don't hire juniors will eventually have no seniors
New career pathways emerge for AI-augmented developers

Long-term (2029-2031):

Either: Software becomes a top export category ($5B+)
Or: Stagnation at current levels ($1-2B)
Difference depends on: Investment + Education quality + Policy stability

Final Thoughts

Bangladesh's software industry is at an inflection point. The easy growth is over. The market is saturated with junior developers. AI has disrupted entry-level jobs globally. But this isn't the end—it's a transformation.

The developers who thrive in 2026 and beyond will be the ones who:

Specialize in areas where there's actual demand
Build genuine skills—not tutorial certificates
Use AI tools without depending on them
Think architecturally, not just syntactically
Communicate effectively (English + technical explanation)

The free ride ended in 2024. What comes next depends on the choices you make.

For those who build genuine skills and create real value: The opportunity is substantial.

For those who want shortcuts: The door is closing.

Choose wisely.

Resources

Learning Platforms:

Poridhi.io - Bangla Software Engineering Courses
BITM - BASIS Institute of Technology & Management - Industry-aligned training
Coursera - University-level courses
edX - MIT, Harvard courses

AI Coding Tools (Learn, Don't Depend):

GitHub Copilot - Industry standard
Cursor - AI-native IDE
ChatGPT - Code review and explanation
Claude - Advanced coding assistant with long context
Gemini - Google's AI assistant

Job Platforms:

Upwork - Freelance work
Toptal - Elite freelance network
Turing - Remote US jobs
CSE Job Bangladesh Facebook Group - Local jobs

Career Development:

LinkedIn - Build your professional profile
GitHub - Showcase your code
Stack Overflow - Learn and help others

Bangladesh Industry Data (2026):

Vivasoft: Top 20 Best Software Companies in Bangladesh 2026 (January 6, 2026)
Ontik Technology: Top 25 Software Companies in Bangladesh 2026 (January 7, 2026)
Nextzen: Top 10 Best Software Companies in Bangladesh 2026 (January 10, 2026)
Kaz Software: Top AI Developers in Bangladesh 2026
Vocal Media: The Rise of Freelancing in Bangladesh 2026 - Over 1 million active freelancers

AI Impact & Job Market Data:

Stanford Digital Economy Study: Canaries in the Coal Mine (2025) - 20% decline for devs aged 22-25
CIO: Demand for Junior Developers Softens as AI Takes Over - Entry-level hiring down 25% YoY
Stack Overflow Developer Survey 2025 - AI Section - 84% adoption, sentiment data
World Economic Forum: Software Developers and AI Work (January 2026) - Learning priorities and trends
DevOps.com: AI Coding Tools Survey (January 2026) - Daily usage statistics

Salary & Company Data:

This guide is based on publicly available information and industry analysis as of January 2026. Specific situations vary by individual skills, location, and market conditions.

End

That's all!

I hope you've found the article useful. I'll write more about the software engineering, career opportunities and overall ecosystem. Feel free to share your thoughts.

Check more on

Inside Bangladesh's Software Industry: Companies, Models, and Opportunities

Mir Mursalin Ankur — Thu, 15 Jan 2026 19:19:47 +0000

When you think about software outsourcing destinations, Bangladesh probably isn't the first name that comes to mind. But it should be.

Beside the Bay of Bengal, this country of 170 million people has built a diverse software ecosystem with companies doing remarkable work—from government systems that serve millions to products used by British Council and ACCA for global examinations.

Let me walk you through the companies, what they actually do, and the business models that work.

The Industry at a Glance

Current State (2024-2025):

$1.3 billion+ in annual ICT exports
$840 million in official software export revenue (FY 2023-24)
4,500+ registered IT/software companies
400,000+ professionals employed
Exports to 80+ countries worldwide

Growth:

From $26 million in 2008 to over $1 billion today—a 40x increase in 16 years

Why Bangladesh's Software Industry Exists

Bangladesh has pulled off something remarkable over the past fifteen years. The government made a deliberate bet on IT services as an export industry, offering tax breaks, building infrastructure, and pushing digitization across public services. The result? An industry that went from essentially nothing to generating over a billion dollars annually.

Here's what makes the model work: Bangladesh offers highly skilled English-speaking developers at competitive rates that deliver exceptional value. A senior software engineer in Dhaka might earn 100,000+ taka monthly (roughly $900+)—professional compensation that enables access to world-class engineering talent at reasonable investment levels.

For American or European companies, the value proposition is compelling. You're not "saving money"—you're accessing talented engineers who bring strong technical skills, problem-solving abilities, and dedication to building quality products. The time zone works perfectly too—Bangladesh is well-positioned for both European and US clients, enabling real-time collaboration when needed.

This created multiple distinct types of software businesses beyond just traditional outsourcing. Let's break them down.

The Complete Business Model Breakdown

Looking across Bangladesh's software landscape, you can categorize companies into seven main business models—not just the two or three most people talk about:

Business Model	% of Industry	Description	Top Companies
Pure Outsourcing	40%	Provide developers/teams to international clients on time-and-materials or fixed-price projects	Brain Station 23, BJIT, Cefalo, Enosis, Vivasoft
Government Contracts	15%	Specialize in public sector projects, national infrastructure, digitization initiatives	Datasoft, Tiger IT, OrangeBD, Tappware, SoftBD
Product Companies	12%	Build and sell own software (SaaS, licenses, marketplace products)	BDTask, Ollyo, REVE Systems, NerdDevs
Hybrid Models	8%	Combine client work with own products for diversification	Brain Station 23, NerdDevs, Kaz Software
Tech Startups	10%	VC-backed growth companies building consumer/enterprise platforms	bKash, Pathao, ShopUp, Chaldal, Shikho
Embedded Systems	5%	Firmware, IoT, hardware-software integration for electronics/devices	Samsung R&D, BJIT Embedded, Teton Electronics
Freelance-to-Company	6%	Companies that started as freelancers on Upwork/Fiverr and grew into agencies	Hundreds of small agencies across Dhaka/Chittagong
Digital Services	4%	Software + SEO, content marketing, social media management	Bizcope, Red Sparrow Digital, HYPE DHAKA

Let's dive into each category with the major players you need to know.

The Government Contract Giants

Datasoft Systems Bangladesh Limited

Website: https://datasoftbd.com
Founded: 1998
Employees: 300+
Certification: CMMI Level 5 (first in Bangladesh)

Datasoft was the first mover in Bangladesh's software industry, and they focused on something many others avoided—government contracts. That turned out to be prescient.

Walk into any government office in Bangladesh and there's a decent chance you'll encounter Datasoft's work. They built the national ID system, the e-passport system, biometric registration systems for multiple agencies, voter registration platforms, and border control infrastructure. These aren't small projects—they're nation-building scale, often worth tens or hundreds of millions of taka.

Their flagship commercial product, Microfin 360 (launched 2008), targets microfinance institutions and NGOs. Given Bangladesh's massive microfinance sector (pioneered by Grameen Bank), this was smart positioning. The product has since expanded across the region to Nepal, Bhutan, Canada, and India.

What Datasoft understood early was that government contracts, while bureaucratic and sometimes slow-paying, provide stable long-term revenue. Once you're embedded in a ministry's infrastructure, replacement becomes politically and technically difficult. That stickiness matters.

Salary Range: 30,000-180,000 taka/month+ for software engineers

Tiger IT Bangladesh Limited

Website: https://www.tigerit.com
Founded: 2006
Employees: 100+
Specialization: Biometric and identity management

If Datasoft is the generalist in government contracts, Tiger IT is the specialist. They focus almost exclusively on security, identity management, and biometric systems—the stuff that requires security clearances and deep technical expertise.

This is the company government agencies call when they need fingerprint identification systems, automated fingerprint identification systems (AFIS), facial recognition, or secure document management. Their client list includes defense and security agencies, which means many of their projects aren't publicly discussed.

Tiger IT has carved out a defensible niche. Biometric systems aren't something you can easily commodity outsource—they require specialized knowledge, security protocols, and trust.

Salary Range: 90,000-180,000 taka/month+ for software engineers

The Government Contract Controversy

No discussion of Bangladesh's software industry is complete without addressing the elephant in the room: government procurement controversies.

Between 2019 and 2024, the a2i (Aspire to Innovate) project—a major government digitalization initiative supported by UNDP—procured software through 46 separate contracts. An investigation found that just four companies received 23 of those 46 contracts (50%).

The companies were:

Tappware Solutions: 6 contracts
SoftBD: 6 contracts
Business Automation Limited: 6 contracts
OrangeBD (Orange IT): 5 contracts

Allegations emerged of a "syndicate" where procurement conditions were allegedly tailor-made to benefit specific companies. This isn't unique to Bangladesh—government tech procurement is notoriously prone to corruption globally. But it illustrates why some companies focus intensely on government contracts while others avoid them entirely.

The International Outsourcing Leaders

Brain Station 23

Website: https://brainstation-23.com
Founded: 2006
Employees: 800+ (700+ software engineers)
Certifications: CMMI Level 3, ISO 9001, ISO 27001 Projects Completed: 2,000+

If you had to pick one company that represents Bangladesh's software ambitions, it's probably Brain Station 23. They're the largest by headcount, the most diverse in services, and have the strongest international presence with offices in the USA, UK, Australia, Nigeria, and across Europe and the Middle East.

Brain Station 23 does everything. Banking and fintech (they built CityTouch for City Bank, which processes over $3 billion in transactions), e-commerce platforms (the Shwapno supermarket system), ERP implementations (official Odoo partner), learning management systems (Moodle partner with their own Proctoring Pro product), AI and machine learning solutions, AR/VR, mobile apps—the list goes on.

Their client roster reads like a who's who: PayPal, Nissan, British Telecom, Unilever, City Bank, AB Bank, HSBC Bangladesh, MetLife, Grameenphone, Robi, BAT Bangladesh, and multiple pharmaceutical companies.

What makes Brain Station 23 interesting is their hybrid model:

~50% international outsourcing
~30% own product development (like Intellifriend, their AI time-tracking app)
~20% local enterprise solutions

Salary Range: 60,000-220,000 taka/month+ for software engineers

BJIT Group

Website: https://bjitgroup.com
Founded: 2007
Employees: 800+
Specialization: Japanese market

BJIT took a different approach—instead of trying to serve everyone, they became the go-to partner for Japanese companies. About 80% of their work comes from Japan, with the rest split between Singapore and other markets.

This specialization makes sense. The Japanese market is huge, culturally specific, and historically underserved by South Asian outsourcing. Companies like BJIT that invest in understanding Japanese business culture, communication styles, and quality expectations can command premium rates.

Salary Range: 30,000-220,000 taka/month+ for software engineers

Cefalo Bangladesh Ltd.

Website: https://www.cefalo.com
Specialization: Norwegian market

Like BJIT with Japan, Cefalo focused almost exclusively on Norway. They provide full-time capable developers to Norwegian businesses and have built a reputation as one of the best workplaces in Bangladesh.

The salaries reflect Norwegian client budgets:

Salary Range: 65,000-220,000 taka/month+ (senior engineers can earn 185,000-220,000 taka)

That senior engineer salary is exceptional for Bangladesh—roughly $1,700-$2,000/month. Competitive value for Norwegian clients while representing top-tier local compensation.

Enosis Solutions

Website: https://enosisbd.com
Founded: 2010
Employees: 200+
Focus: US and European markets

Enosis went the American and European route, focusing on web and mobile application development, cloud solutions, and IT consulting using agile methodologies. About 70% of revenue comes from US clients, 20% from Europe, 10% elsewhere.

Salary Range: 50,000-220,000 taka/month+ (well-structured career ladder with clear levels)

Vivasoft Limited

Website: https://vivasoftltd.com
Founded: 2010
Employees: 300+ (180+ dedicated engineers)
Focus: Team augmentation and offshore office setup

Vivasoft positioned themselves uniquely—instead of just doing custom development, they focus on team augmentation (providing dedicated developers to extend existing teams) and helping companies set up full offshore offices in Bangladesh.

Salary Range: 25,000-220,000 taka/month+ for software engineers

Selise Digital Platforms

Website: https://selisegroup.com
Revenue: ~$37.9 million
Headquarters: Zürich, Switzerland (with Bangladesh operations)
Ranking: #2 Top Software Company in Bangladesh 2025

Selise is a global IT delivery organization with significant Bangladesh operations. They specialize in advanced computing, AI, data science, and digital platform creation. As a "Swiss tech partner for digital transformation," they bring European quality standards to Bangladeshi talent.

The Product Companies

NerdDevs

Website: https://nerddevs.com
Product Website: https://biddaan.com
Founded: 2015
Employees: 20+ (small but impactful)
Specialization: EdTech and messaging solutions

NerdDevs represents a different model—staying small, focusing intensely on specific problems, and building both client work and own products simultaneously.

Their flagship partnership achievement is TestReach, an online assessment platform that ACCA (Association of Chartered Certified Accountants), British Council, CIPS, and iSQI use for global examinations. If you've taken a professional certification exam in the UK, there's a decent chance NerdDevs wrote part of the software.

They also built Genius and other messaging apps, which are mostly used in the US market that handles 4-5 million messages monthly—managing that volume reliably requires serious engineering.

For the Bangladesh market, their major products include:

Biddaan (https://biddaan.com) - Their flagship Learning Management System specifically designed for Bangladeshi & International educational institutions. It handles student tracking, progress notes, institution management, and the full administrative stack educational organizations need. The interface is multilingual, which matters—most LMS solutions are English-only, creating barriers for local schools.

Salary Range: 30,000-220,000 taka/month+ for software engineers

BDTask Limited

Website: https://www.bdtask.com
Focus: Ready-made software products

While most Bangladeshi companies do client work, BDTask went the opposite direction—they build ready-made software and sell it globally through marketplaces like Envato.

Their product catalog includes accounting software, inventory management, POS systems, school management, hospital management, hotel management, restaurant management, HR and payroll systems—basically every business management need you can think of.

This is a different business model entirely. Instead of getting paid for hours worked or projects completed, they sell licenses—think $50-$500 per copy, with customers in Europe, North America, and Southeast Asia buying directly.

Ollyo (MuktoSoft)

Website: https://ollyo.com
Founded: 2010
Focus: WordPress and Joomla ecosystem

Ollyo took a similar product approach but focused narrowly on WordPress plugins, themes, Joomla extensions, and open-source tools. They're an Envato partner, meaning their products sell through Envato's massive marketplace.

Products include WordPress plugins, Joomla templates, no-code website builders, e-learning platforms, e-commerce solutions, and a free open-source icon library. Some of their work is used by thousands of websites globally.

REVE Systems Ltd.

Website: https://www.revechat.com
Focus: VoIP and communications platform software

REVE Systems built telecommunications software—VoIP platforms, communication tools, and enterprise communications solutions used globally. This is highly specialized work requiring understanding of telecommunications protocols, real-time communication, and handling large-scale voice/video traffic.

Salary Range: 50,000-150,000 taka/month+ for software engineers

The Embedded Systems & IoT Specialists

This is a specialized but critical segment of Bangladesh's software industry—companies working on firmware, embedded systems, IoT solutions, and hardware-software integration. These engineers bridge the gap between software code and physical devices.

Samsung R&D Institute Bangladesh (SRBD)

Website: https://research.samsung.com/srbd
Founded: February 2011
Focus: Embedded systems, IoT, cellular modem technology

Samsung chose Bangladesh for its first-ever R&D hub in the country—a strong endorsement of the local engineering talent. SRBD works on cutting-edge embedded systems including cellular modem systems, IoT hardware, and intelligent embedded devices.

What they work on:

Embedded software and systems engineering
Cellular modem systems development
IoT hardware and connectivity systems
Firmware for Samsung's global product line

Why it matters: When Samsung—one of the world's largest electronics companies—sets up an R&D center in your country, it's a validation of your engineering talent. SRBD employs some of Bangladesh's most skilled embedded systems engineers working on products used globally.

Teton Electronics / Teton Private Ltd.

Website: https://tetonelectronics.com
Focus: Firmware development and embedded systems services

Teton Electronics provides comprehensive firmware development services, including:

Programming and updating embedded firmware
Integration for different types of microcontrollers and processors
Hardware-software integration solutions
Custom embedded systems design

They work across various industries requiring specialized firmware solutions—from consumer electronics to industrial applications.

BJIT Embedded Systems Division

Website: https://www.bjit.co.jp
Focus: IoT & Embedded Engineering

BJIT, known for its Japanese market specialization, has a dedicated embedded systems division offering:

IoT & Embedded Engineering
Embedded Application Development
Mechanical Design
Hardware-software integration

Their Japanese clients demand precision and reliability—qualities that have driven BJIT to develop strong embedded systems capabilities.

Subra Systems Limited

Specialization: Embedded systems and industrial automation

Subra Systems focuses on embedded solutions for industrial applications, where reliability and real-time performance are critical. They work on automation systems, control systems, and industrial IoT solutions.

SIMEC System Ltd.

Specialization: Embedded systems and firmware development

SIMEC provides embedded systems services across various sectors, working on firmware design, implementation, and optimization for different hardware platforms.

Ninos IT Solution

Website: https://www.ninositsolution.com
Specialization: Cutting-edge embedded systems design

Ninos IT Solution specializes in designing and developing embedded systems with seamless integration capabilities. They work on projects requiring deep hardware and software knowledge.

The Embedded Systems Job Market:
The demand for embedded systems engineers in Bangladesh is substantial, with approximately 2,921 embedded systems job openings listed on major job portals. Skills in high demand include:

Embedded software engineering
IoT development
LoRaWAN device development
Firmware design and implementation
Hardware-software integration
Robotics and automation

Salary Ranges: 60,000-180,000 taka/month+ for embedded systems engineers (higher due to specialized skills)

Why Embedded Systems Matter:
As the world becomes more connected with smart devices, IoT sensors, and intelligent electronics, embedded systems expertise becomes increasingly valuable. Bangladeshi companies are positioning themselves to serve this growing global market with skilled engineers who understand both hardware and software.

The Tech Startup Scene (The Real Growth Engine)

bKash

Industry: Mobile Financial Services
Ranking: #3 Top Startup in Bangladesh

bKash isn't just a startup—it's practically a utility. As Bangladesh's leading mobile financial services provider, bKash has transformed how millions of Bangladeshis send, receive, and store money. With international investment and attention, bKash has attracted significant funding and become one of Bangladesh's most successful tech exports.

Pathao

Founded: 2015
Founders: Hussain Elius, Shifat Adnan, Fahad
Ranking: #6 Top Startup in Bangladesh

Pathao is Bangladesh's "super-app" offering:

Ride-sharing services (bikes, cars, cycles)
Food delivery
Logistics and parcel delivery
Created over 300,000 jobs in eight years
Serving 60,000 small businesses
Over 8 million users

Salary Range: 65,000-180,000 taka/month+ for software engineers

ShopUp

Ranking: #1 Startup in Bangladesh

ShopUp focuses on B2B commerce platform, helping small retailers and businesses source inventory. As Bangladesh's top-ranked startup, ShopUp has attracted significant investor attention and represents the maturation of Bangladesh's startup ecosystem.

Chaldal

Industry: E-commerce grocery

Chaldal has revolutionized grocery shopping in Bangladesh's major cities with its online grocery platform. They've built sophisticated logistics technology and inventory management systems that compete with international players.

Salary Range: 70,000-180,000 taka/month+ for software engineers

Other Notable Startups:

Shikho - EdTech platform
Arogga - Healthcare/medicine delivery
PriyoShop Retail - B2B retail platform
Shohoz - Transportation and logistics

Startup Ecosystem Growth:

Bangladesh's startup investment grew 1,116% year-over-year to $119.9 million in H1 2025
698+ top startups currently operating
Middle class growing at 10% per annum to reach 34 million by 2025

2024 Startup Investments That Matter:

Sombhab (tech startup): $1 million investment from Singapore's Cocoon Capital
Blue-Tech: $100,000+ foreign investment
Bangladesh Startup Summit 2024: July 27-28 at Bangladesh Computer Council, theme "Smart Bangladesh, Limitless Possibilities"
AdTech Recognition: 7 Bangladeshi EdTech startups ranked in South Asia's top 100

The Freelance-to-Company Model (Hidden Giants)

This is the category nobody talks about but it's MASSIVE. Hundreds of software companies in Bangladesh started as individual freelancers on Upwork, Fiverr, Freelancer.com, and oDesk (now Upwork).

Here's how it works:

Developer starts freelancing on Upwork/Fiverr while in university or early career
Builds reputation, gets 5-star reviews, starts earning $2,000-$5,000/month
Gets more work than they can handle alone
Hires friends/junior developers
Registers a company
Continues taking contracts through platforms + direct clients

Characteristics of these companies:

5-50 employees typically
Heavy focus on web development (WordPress, Laravel, React, Node.js)
Strong presence on Upwork, Fiverr, Freelancer.com
Often specialize in specific niches (e-commerce sites, real estate portals, booking systems)
Salaries: 20,000-150,000 taka/month+ typically
Revenue: $50,000-$500,000 annually for established agencies

Why this model works:

Low barrier to entry (no sales team needed—platforms bring clients)
International clients from day one
Payment security through platforms
Can build reputation faster than cold outreach

Notable platforms used:

Upwork (most popular for software development)
Fiverr (quick projects, WordPress fixes, small websites)
Freelancer.com (competitive bidding model)
PeoplePerHour, Guru (alternative platforms)

Digital Marketing + Software Companies

A growing category of companies combines software development with digital marketing services. These companies often build websites, then handle SEO, content creation, social media marketing, and paid advertising for clients.

Leading Digital Marketing Agencies:

Bizcope (https://www.bizcope.com/)

Global SEO and digital marketing agency
Services: SEO, web development, content production, 360-degree digital marketing

Red Sparrow Digital (https://www.redsparrowdigital.com/)

Full-stack digital marketing agency
Web design & development, SEO, comprehensive marketing solutions

HYPE DHAKA

Communications agency
Services: SEO, email marketing, social media marketing, website development
100% positive client reviews according to Clutch.co

Marketorr

One of the fastest-growing digital marketing agencies
Deep SEO expertise and full-funnel marketing strategies

Implevista (https://digital.implevista.com/)

Expert SEO, PPC, and social media marketing (SMM) solutions

Why this model matters:
Many Bangladeshi businesses don't just need software—they need the complete digital package. These companies provide that integrated solution, often at competitive rates compared to Western agencies.

Salary Comparison: The Real Numbers

Let me give you the unvarnished truth about salaries in Bangladesh's software industry. These are ranges based on current market data (2024-2025):

By Experience Level:

Level	Salary Range (BDT/month)	Salary Range (USD/month)
Trainee/Intern	0-15,000	$0-135
Junior Developer (0-2 years)	20,000-45,000	$180-405
Software Engineer (2-5 years)	50,000-80,000	$450-720
Senior Engineer (5+ years)	100,000-220,000	$900-1,980
Tech Lead/Principal	165,000-300,000	$1,485-2,700

By Company Type:

Company Type	Junior	Mid-Level	Senior
Local Outsourcing	25,000-35,000	50,000-70,000	100,000-150,000
Western Outsourcing (Cefalo, Enosis)	50,000-80,000	70,000-130,000	185,000-220,000
International Companies (Optimizely, Cheq)	70,000+	120,000+	250,000-300,000
Tech Startups (Pathao, Chaldal)	65,000+	70,000-100,000	155,000-220,000
Product Companies	30,000-50,000	60,000-90,000	100,000-220,000

Key Observations:

1. The Entry-Level Reality:
Many companies pay trainee and intern positions 0-10,000 taka monthly (effectively free or near-free labor). It's controversial but common—companies view it as paid training rather than productive work.

2. The International Company Premium:
Companies with international headquarters pay significantly more:

Optimizely: Senior Software Engineer at 250,000-300,000 taka/month+
Cheq Inc.: Senior QA Automation Engineer at 180,000-300,000 taka/month+
Tero Labs: Engineer at 120,000-150,000 taka/month+

3. The Startup Competitiveness:
Local tech companies (Pathao, Chaldal) pay competitively because they compete directly with international employers for talent.

4. Remote Work Premium:
Engineers working remotely for international companies earn substantially more:

~$41,465 (average for remote software developers in Bangladesh)
~$46,135 (median annual salary for remote software engineers)
That's 2-4x higher than local salaries

The Complete Company Directory

Government & Enterprise Solutions

Datasoft Systems Bangladesh: https://datasoftbd.com - CMMI Level 5, government contracts specialist
Tiger IT Bangladesh: https://www.tigerit.com - Biometric and security systems
Southtech Limited: https://www.southtech.com.bd - Banking and ERP solutions
LeadSoft Bangladesh: Financial and insurance platforms

International Outsourcing Leaders

Brain Station 23: https://brainstation-23.com - Largest diversified player, 800+ employees
Selise Digital Platforms: https://selisegroup.com - #2 ranked, Swiss-Bangladeshi operations, $37.9M revenue
BJIT Group: https://bjitgroup.com - Japan market specialist
Cefalo Bangladesh: https://www.cefalo.com - Norway market specialist
Enosis Solutions: https://enosisbd.com - US/Europe agile development
Vivasoft Limited: https://vivasoftltd.com - Team augmentation and offshore setup

Product Companies

NerdDevs: https://nerddevs.com - EdTech and messaging solutions
- Biddaan LMS: https://biddaan.com - Learning management system for Bangladesh
BDTask Limited: https://www.bdtask.com - Ready-made software products
Ollyo (MuktoSoft): https://ollyo.com - WordPress/Joomla ecosystem
REVE Systems: https://www.revechat.com - VoIP and communications platforms

Embedded Systems & IoT Companies

Samsung R&D Institute Bangladesh: https://research.samsung.com/srbd - Embedded systems, IoT, cellular modem (founded 2011)
Teton Electronics: https://tetonelectronics.com - Firmware development and embedded systems services
BJIT Embedded Systems: https://www.bjit.co.jp - IoT & Embedded Engineering
Subra Systems Limited: Embedded systems and industrial automation
SIMEC System Ltd.: Embedded systems and firmware development
Ninos IT Solution: https://www.ninositsolution.com - Cutting-edge embedded systems design

Tech Startups (Growth Stage)

bKash: https://www.bkash.com - Mobile financial services (#3 startup)
Pathao: https://pathao.com - Super-app: ride-sharing, food delivery, logistics (#6 startup)
ShopUp: #1 ranked startup - B2B commerce platform
Chaldal: https://chaldal.com - E-commerce grocery
Shikho: EdTech platform
Arogga: Healthcare/medicine delivery
PriyoShop Retail: B2B retail platform
Shohoz: Transportation and logistics

Digital Marketing + Software Agencies

Bizcope: https://www.bizcope.com - SEO, web development, content production
Red Sparrow Digital: https://www.redsparrowdigital.com - Full-stack digital marketing
HYPE DHAKA: SEO, email marketing, social media marketing
Marketorr: Fastest-growing digital marketing agency
Implevista: https://digital.implevista.com - SEO, PPC, SMM solutions

Smaller Specialists

Kaz Software: https://www.kaz.com.bd - Enterprise custom development
Nascenia Limited: https://www.nascenia.com - SaaS product engineering
Dynamic Solution Innovators: https://www.dsibd.com - E-commerce and ERP
Dream71 Bangladesh: Mobile games and creative apps
PipilikaSoft: Education management systems
Dcastalia Limited: Top 10 ranked software company

Government Contractors (Under Investigation)

OrangeBD (Orange IT): Infrastructure and cybersecurity
Tappware Solutions: Software development and maintenance
SoftBD: Software development services
Business Automation Limited: Process automation solutions

International Companies with Bangladesh Operations

Optimizely Bangladesh: Global optimization platform office
Samsung R&D Bangladesh: Samsung research and development
Cheq Inc.: Cybersecurity platform

IT Training Institutes

BASIS Institute of Technology & Management (BITM): bitm.org.bd
Creative IT Institute: Web development, MERN stack, digital marketing
Dewan ICT Institute: #1 ranked IT training institute
European IT Institute: Professional IT training, Dhanmondi
Softopark IT Institute: Career-boosting IT programs

Resources

BASIS (Bangladesh Association of Software & Information Services): https://basis.org.bd - Industry association
DoICT (Directorate of ICT): https://doict.gov.bd - Government ICT initiatives
Salary Data: https://tahanima.github.io/salary-ranges-offered-by-bangladeshi-software-companies-for-different-positions/

What This All Means

Bangladesh's software industry has reached an interesting inflection point. The early stage of just doing outsourcing for international clients is maturing into something more sophisticated.

Companies like Brain Station 23, NerdDevs, and Selise show it's possible to move up the value chain—not just writing code someone else specifies, but building products, solving complex problems, and working with prestigious international clients. TestReach (NerdDevs' platform) being used by British Council and ACCA isn't just outsourcing—it's being the technical partner for critical global infrastructure.

The government digitalization push, despite procurement controversies, created a domestic market for software. Companies like Datasoft and Tiger IT built genuinely hard technology (national ID systems, biometric platforms) that required serious engineering.

The product companies (BDTask, Ollyo, Biddaan) demonstrate that Bangladeshi developers can compete globally in marketplaces and create solutions used by thousands of businesses and schools.

The startup ecosystem (bKash, Pathao, ShopUp, Chaldal) shows that world-class consumer platforms can be built from Bangladesh for Bangladesh—and eventually for emerging markets globally.

But challenges remain real. Salaries lag far behind international standards. A "senior" engineer in Bangladesh earning $2,000/month would be entry-level pay in the US or Europe. This creates brain drain—talented developers leave for opportunities abroad. Companies struggle to retain their best engineers once they get two-three years experience and realize their market value elsewhere.

Infrastructure issues persist. Power grid losses, internet reliability in secondary cities, and reliance on Dhaka for most operations limit growth. The skills gap in advanced technologies (AI, machine learning, blockchain) means many companies can't compete for cutting-edge work.

The procurement corruption allegations around government contracts raise questions about whether that sector is sustainable long-term without serious reform.

Still, the trajectory is impressive. From essentially nothing twenty years ago to a billion-dollar industry employing hundreds of thousands, with serious companies working on real problems for real international clients—that's meaningful progress.

The Future: Where Bangladesh's Software Industry Is Headed

The software industry Bangladesh built over fifteen years is real, substantial, and growing. It's not Silicon Valley, and it's not trying to be. It's something different—a developing country using its advantages (cost, talent, English proficiency) to build an export industry while simultaneously digitizing its own economy.

What to watch in 2026-2030:

AI and ML Adoption: As global demand for AI talent explodes, Bangladesh's value proposition could drive growth—if the skills gap can be addressed
Startup Exits: Bangladesh has yet to see a major IPO or acquisition. When bKash, Pathao, or ShopUp exit, it will unlock capital and validate the ecosystem
Government Reform: If procurement becomes transparent and merit-based, government contracts could drive sustainable growth rather than creating dependencies
Regional Expansion: Bangladeshi companies are well-positioned to serve other emerging markets in South Asia, Southeast Asia, and Africa
Remote Work: As remote work becomes normalized, Bangladeshi developers can work directly for international companies at international rates—reducing brain drain
Product Success: BDTask, Ollyo, and NerdDevs are showing that products can scale. More success stories here could shift the industry from services to products
Freelance Professionalization: The freelance-to-company pipeline will likely formalize, creating more sustainable agencies rather than individual freelancer outfits

The story of Bangladesh's software industry isn't just about affordable services. It's about a country leveraging its human capital to participate in the global digital economy. It's about companies like Datasoft building national infrastructure, NerdDevs powering global examinations, and Pathao transforming transportation.

It's about 400,000 professionals building their futures one line of code at a time.

That's a story worth paying attention to.

References

Industry Statistics & Market Data

Salary & Compensation Data

Company Rankings & Lists

Startup Ecosystem

Digital Marketing Agencies

Outsourcing Comparisons

Freelance & Marketplace Resources

Embedded Systems & IoT

Government & Policy

Company Reviews & Salary Data (Bangla Sources)

Academic & Research

This blog is based on publicly available information as of January 2026. Company details, salaries, and situations may change. All salary figures are approximate based on employee reports and job postings.

End

That's all!

I hope you've found the article useful. I'll write more about the software engineering and it's business ecosystem. Feel free to share your thoughts.

Check more on

The Complete Guide to Software Business Models: How Tech Companies Actually Make Money

Mir Mursalin Ankur — Sat, 10 Jan 2026 15:03:06 +0000

If you've ever wondered how your favorite apps stay free, why some software charges monthly while others are one-time purchases, or how tech giants like Google and Apple structure their businesses, you're in the right place.

The software industry has evolved far beyond simple "buy once, use forever" models. Today's tech landscape features dozens of sophisticated business models, each designed to solve specific problems and create value in unique ways. Understanding these models isn't just for entrepreneurs—it helps you make smarter decisions as a consumer, investor, or anyone navigating the digital economy.

Let's break down the most important business models shaping the software world today.

The Foundation: Core Business Model Families

Think of these as the main categories that most tech businesses fall into. While companies often mix and match elements, understanding these fundamentals helps you see the bigger picture.

Subscription: The Predictable Revenue Machine

Remember when you bought Microsoft Office once and used it for years? Those days are largely gone. The subscription model has become the dominant force in software, and for good reason—it works incredibly well for both companies and customers.

Here's how it works: instead of paying a large upfront fee, you pay a smaller amount regularly—usually monthly or annually. Netflix pioneered this for entertainment, but it's everywhere now. Adobe Creative Cloud, Spotify, Microsoft 365, and thousands of business software tools all use subscriptions.

Why did this model take over? For companies, it creates predictable, recurring revenue. Instead of hunting for new customers every month, they can focus on keeping existing ones happy. A company with 10,000 subscribers paying $10 monthly knows it has roughly $100,000 coming in next month, making planning and investment much easier.

For customers, the benefits are real too. Lower upfront costs mean less risk when trying new software. You're not committing $500 upfront—maybe just $10 for the first month. Plus, subscriptions typically include automatic updates, cloud storage, and customer support. The software company stays invested in keeping you happy because if you cancel, their revenue drops.

The numbers tell the story. A well-run subscription business might see 90-95% of customers renew each year. That compounds powerfully over time. After three years, a company might still have 75% of its original customers, all while adding new ones. This creates what investors call an "annuity stream"—revenue that keeps flowing with less effort over time.

Freemium: The Generous Hook

Freemium is everywhere, even if you don't realize it. The name combines "free" and "premium"—give away the basic product for free, then charge for advanced features.

Think about Spotify, Canva, or Slack. All offer genuinely useful free tiers that millions of people use daily without ever paying. But eventually, enough users hit limitations that matter to them—whether it's offline listening, premium templates, or message history—and convert to paid plans.

The economics seem counterintuitive at first. How can you make money giving away your product? The key is that digital products have near-zero marginal cost. Serving one more free user costs almost nothing—no manufacturing, shipping, or materials. So if you can convert even 2-5% of free users to paying customers, the math works beautifully.

Dropbox famously grew this way. They gave everyone 2GB of free storage—enough to be useful, but eventually, most people needed more. Some users upgraded immediately, others took years, but the free tier kept them engaged the whole time. Today, Dropbox has millions of paying customers who started with that free 2GB.

The challenge is finding the right balance. Make the free tier too generous, and no one upgrades. Make it too restrictive, and people never experience the value. The best freemium products hook users with the free tier, then create natural "aha moments" that drive upgrades.

Transaction and Commission: Taking a Cut

Some of the world's largest tech companies don't sell software at all—they connect buyers and sellers and take a percentage of each transaction.

Airbnb doesn't own hotels. Uber doesn't own cars. Etsy doesn't make crafts. But they've built billion-dollar businesses by creating marketplaces where transactions happen, then taking a slice of each one.

The magic of this model is that it scales with customer success. When an Airbnb host makes more money, Airbnb makes more money. When Stripe processes more payments for businesses, Stripe earns more. The incentives align perfectly.

Transaction rates vary widely. Stripe and PayPal charge around 2.9% plus 30 cents per transaction. Airbnb takes about 3% from hosts and 14% from guests. The App Store and Google Play take 15-30% of app sales. These percentages might seem small, but when you're processing billions in transactions, they add up fast.

The tricky part is reaching critical mass. A marketplace with few buyers won't attract sellers, and vice versa. This "chicken and egg problem" means transaction-based businesses often operate at a loss initially, subsidizing one or both sides to build momentum. Once they reach critical mass, though, network effects create powerful moats—the more users join, the more valuable the platform becomes, attracting even more users.

Advertising: Free for Users, Paid by Brands

If you're not paying for the product, you are the product. This saying captures the advertising model perfectly.

Google Search, Facebook, Instagram, YouTube, and most of the internet you use daily are free because advertisers pay for your attention. These companies have gotten incredibly sophisticated at targeting ads based on your behavior, demographics, and interests, making those ads more valuable to advertisers.

The numbers are staggering. Google made over $200 billion from ads in 2023. Meta (Facebook/Instagram) made another $130 billion. These aren't small businesses with ads on the side—advertising IS their business.

For this model to work, you need massive scale. A blog with 1,000 readers might make a few dollars from ads. A platform with 100 million users makes millions. That's why ad-supported businesses focus obsessively on growth and engagement—more eyeballs and more time spent equals more ad revenue.

The model has its critics. Privacy concerns have grown as tracking becomes more sophisticated. Regulations like GDPR in Europe are forcing changes. And users increasingly turn to ad blockers or paid ad-free alternatives. Still, for many services—particularly social media—advertising remains the dominant model because users won't pay directly.

Pay-As-You-Go: Usage-Based Pricing

Some software charges based on exactly what you use, like your electricity bill. This usage-based model has exploded with cloud computing.

Amazon Web Services (AWS), the backbone of much of the internet, bills by the computing power, storage, and bandwidth you consume. Use more, pay more. Use less, pay less. The same applies to Twilio (charged per text message or phone call), Stripe (per transaction), and many developer tools.

This model aligns costs with value better than almost anything else. A startup spending $100 monthly on AWS can scale to $100,000 when they grow, without renegotiating contracts or switching providers. The pricing grows naturally with their business.

For customers, it removes the fear of overpaying. You're never paying for capacity you don't need. For companies, it means revenue automatically scales with customer success—a win-win.

The downside is unpredictability. Companies can't forecast usage-based revenue as easily as subscriptions. A customer might spend $1,000 one month and $5,000 the next. This variability makes planning harder. Many companies now combine fixed subscriptions with usage-based pricing to balance predictability and flexibility.

Marketplaces: Connecting Supply and Demand

Marketplaces are fascinating because they create value without creating products. eBay doesn't manufacture goods. Upwork doesn't do the freelance work. Airbnb doesn't provide the accommodations.

Instead, they build platforms that reduce friction between buyers and sellers. They handle payments, build trust through reviews, provide insurance, and create discovery mechanisms. This infrastructure is valuable enough that both sides willingly pay fees.

The best marketplaces solve real pain points. Before Airbnb, renting your apartment to strangers was risky and complicated. Before Uber, hailing a cab in many cities was frustrating. The marketplace didn't just connect supply and demand—it made transactions trustworthy and convenient.

Two-sided marketplaces face unique challenges. You need enough supply to attract demand and enough demand to attract supply. Successful marketplaces often subsidize one side initially. Uber spent billions on driver incentives to ensure riders could always find a car. Once established, network effects made the platform nearly impossible to displace.

Open Source and Open Core: The Generosity Paradox

Some of the most valuable software companies give away their core product for free—completely free, not freemium. How does that work?

The open-core model releases the basic software as open source (anyone can use, modify, and see the code for free) but charges for enterprise features, support, or managed services.

GitLab is a perfect example. Their core product is free and open source. Millions of developers use it daily without paying a cent. But large companies pay substantial fees for advanced features like enterprise security, compliance tools, and dedicated support.

This model builds massive adoption and community goodwill while still generating revenue from those who need enterprise capabilities. It's particularly effective for developer tools because developers love open source and will advocate for tools they already use when their companies need to make purchasing decisions.

Red Hat pioneered this model with Linux, eventually selling to IBM for $34 billion. MongoDB, Elastic, and many others have followed similar paths. The key is offering enough value in the free version to drive adoption while reserving genuinely valuable enterprise features for paying customers.

Quick Reference: Business Model Comparison

Here's a comprehensive comparison of the major software business models to help you quickly understand their key differences:

Model	Revenue Structure	Best For	Pros	Cons	Examples	Key Metrics
Subscription	Recurring monthly/annual fees	Products with ongoing value, sticky workflows	Predictable revenue, customer retention, compounding growth	Churn management, subscription fatigue	Netflix, Spotify, Adobe CC, Microsoft 365	MRR, ARR, Churn, LTV, NRR
Freemium	Free tier + paid upgrades	Products that scale with usage/team size	Low friction acquisition, viral growth, large user base	Low conversion (2-5%), high support costs for free users	Spotify, Canva, Slack, Dropbox	Free-to-paid conversion, activation rate, time to convert
Transaction/Commission	% of each transaction	Marketplaces, payment processing, two-sided platforms	Scales with customer success, aligned incentives	Chicken-egg problem, needs critical mass	Uber, Airbnb, Stripe, Etsy, App Store	GMV, take rate, liquidity, active buyers/sellers
Advertising	CPM/CPC from brands	Mass-market consumer products	Free for users drives scale, massive revenue potential	Privacy concerns, ad blockers, regulatory risk	Google, Facebook, YouTube, Instagram	DAU/MAU, engagement time, CPC/CPM, revenue per user
Usage-Based	Pay per unit consumed	Cloud infrastructure, APIs, developer tools	Fair pricing, scales with customer growth	Unpredictable revenue, harder forecasting	AWS, Twilio, Zapier, Stripe	Usage volume, consumption trends, expansion revenue
Marketplace	Fees from buyers/sellers or both	Supply-demand matching, peer-to-peer transactions	Network effects, strong moat at scale	Critical mass challenge, complex trust-building	eBay, Upwork, Airbnb, Uber, Etsy	GMV, take rate, buyer/seller ratio, transaction frequency
Open Core	Free OSS + paid enterprise features	Developer tools, infrastructure software	Community trust, rapid adoption, developer advocacy	Converting OSS users to paid is challenging	GitLab, MongoDB, Red Hat, Elastic	Enterprise conversion rate, community growth, support revenue
API-First	Per-call or % of transaction value	Technical infrastructure, developer platforms	Deep integration, switching costs, usage scales automatically	Technical audience, requires developer trust	Stripe, Twilio, Plaid, SendGrid	API calls, transaction volume, developer adoption
Platform Ecosystem	Multiple revenue streams (hardware + services + subscriptions)	Companies with product breadth	Lock-in, multiple monetization touchpoints, high LTV	Requires huge capital, slow to build, complex coordination	Apple, Google, Microsoft, Amazon	Cross-product adoption, ecosystem retention, ARPU
Creator Economy	% of creator earnings or subscription	Content creator monetization platforms	Aligns with creator success, viral growth	Content moderation, payment processing complexity	Patreon, Substack, YouTube, OnlyFans	Active creators, creator earnings, fan spend per creator
White-Label	Wholesale licensing fees	B2B infrastructure, platform tech	Rapid scaling through partners, reduced CAC	Lower margins, less customer control, brand dilution	WordPress, white-label SaaS	Partner count, reseller revenue, partner retention
Data as Service	Subscription for data access	Companies with unique, valuable data	High margins, recurring revenue, defensible	Privacy/ethics concerns, data quality maintenance	Bloomberg, weather services, analytics platforms	Data accuracy, subscriber count, data refresh rate

Choosing Based on Your Situation

Your Situation	Recommended Model(s)	Why
Consumer app, viral potential	Freemium + Ads	Low barrier, mass scale required
B2B software, clear ROI	Subscription (tiered)	Predictable revenue, willingness to pay
Marketplace idea	Transaction/Commission	Scales with transaction volume
Developer tool	Open Core + API/Usage	Developers prefer OSS, enterprises pay for support
Infrastructure/technical	Usage-based/API	Fair pricing, scales naturally
Content/media	Ads + Creator Economy split	Users won't pay directly, creators need monetization
Enterprise focus	Subscription + White-label	High contract values, predictable revenue
Platform vision	Ecosystem approach	Maximize LTV through multiple touchpoints

Revenue Predictability Comparison

High Predictability:  Subscription │────────────────────────────────│ 95%+
                        SaaS Tiered │─────────────────────────│ 90%+

Medium Predictability: Freemium→Sub │──────────────│ 70-80%
                        Usage-Based (large customers) │────────│ 60-70%

Low Predictability:   Usage-Based (small customers) │────│ 50-60%
                        Transaction/Commission │──│ 40-50%
                        Advertising │─│ 30-40%

Customer Acquisition Cost (CAC) Recovery Time

Model	Typical CAC Recovery	Why
Freemium	12-24+ months	Most users never pay, long conversion cycles
Advertising	Immediate (but per-user value is low)	Revenue starts immediately but margins thin
Subscription	6-18 months	Predictable monthly payments accelerate recovery
Usage-Based	3-12 months	Depends on customer adoption speed
Transaction	Varies wildly	Scales with customer transaction volume
Enterprise Subscription	12-36 months	High CAC but large contracts justify it

Specialized Software Business Models

Beyond the main categories, several specialized models have emerged for specific contexts.

Software as a Service (SaaS) Variations

SaaS deserves its own deep dive because it's become the default for business software. But not all SaaS is created equal. Let's look at the main pricing variations.

Flat-rate SaaS charges everyone the same amount—simple but limiting. Basecamp famously charges $99 monthly regardless of team size. This simplicity is refreshing in a world of complex pricing tiers, though it means large companies and small teams pay the same.

Tiered pricing offers multiple plans at different prices. Think Slack's Free, Pro, Business, and Enterprise tiers. This captures more value from customers with different needs and budgets. A startup might pay $8 per user monthly while an enterprise pays $15+.

Per-user pricing scales costs with team size. Most SaaS tools use this—Zoom, Microsoft 365, and thousands of others charge per user per month. It's straightforward and aligns costs with value, though teams sometimes share accounts to save money.

Usage-based SaaS charges for consumption, not seats. Zapier charges based on tasks automated. AWS charges for computing resources used. This works beautifully when value correlates directly with usage.

Many modern SaaS companies use hybrid models, combining elements. You might have a base platform fee, per-user charges, and usage fees for certain features. Complexity increases but so does revenue optimization.

API-First Business Models

APIs (Application Programming Interfaces) have become products themselves. Companies like Stripe, Twilio, and Plaid built billion-dollar businesses by offering APIs that developers integrate into their applications.

Stripe's API makes it incredibly easy to accept payments. Instead of building payment infrastructure from scratch—dealing with banks, fraud prevention, and compliance—developers add a few lines of code and start processing payments immediately. Stripe handles the complexity and charges per transaction.

This model works because it solves hard technical problems and packages them as simple APIs. Developers pay for convenience, reliability, and not having to become experts in payments, communications, or banking infrastructure.

The economics are compelling. Once you build the API infrastructure, serving additional customers costs very little. A company processing $1 million in payments pays the same percentage as one processing $100 million, but Stripe's costs don't increase proportionally. At scale, margins are excellent.

Data as a Service

Some companies have realized their data itself is valuable. Bloomberg built an empire selling financial data. Weather companies sell forecasts to businesses. Analytics platforms sell aggregated insights.

This model requires unique data that others don't have and customers who will pay for it. Bloomberg can charge thousands monthly because traders need real-time market data to make billion-dollar decisions. The value is clear.

The challenge is often privacy and ethics. Companies must aggregate and anonymize data carefully. Selling individual user data creates backlash, but selling anonymized trends and insights can be legitimate and valuable.

White-Label and Licensing

Some software companies don't sell to end users at all—they license their technology to other companies who rebrand and resell it.

WordPress powers 40%+ of the internet, but most users don't know or care. Web hosting companies like Bluehost and GoDaddy offer "WordPress hosting," adding their branding and support. WordPress benefits through ecosystem growth.

White-label SaaS lets companies offer software products without building them. A marketing agency might white-label email marketing software, offering it to clients under their own brand. The underlying software company charges a wholesale rate, and the agency marks it up.

This model scales quickly because each licensing partner becomes a sales channel. The tradeoff is lower margins and less direct customer relationships.

Emerging and Creative Models

Innovation in business models continues. Here are some newer patterns worth understanding.

Platform Ecosystems: Building Worlds, Not Products

The most valuable tech companies don't sell products—they create ecosystems that lock users in through interconnectivity and network effects.

Apple's ecosystem is the classic example. An iPhone works beautifully alone, but add an iPad, MacBook, Apple Watch, and AirPods, and you're deeply embedded. Messages sync across devices. AirPods switch seamlessly between them. Files move effortlessly through AirDrop. Leaving means losing all that integration.

Apple doesn't just sell hardware—they sell the App Store (30% commission), Apple Music (subscription), iCloud storage (subscription), Apple TV+ (subscription), and more. Each product makes the others more valuable. This is ecosystem thinking at its finest.

Google does the same with Android, Chrome, Search, Gmail, Drive, and YouTube. Once you're using several Google services, switching becomes increasingly difficult. Your data, preferences, and workflows are all integrated.

Building ecosystems requires patience and capital. You need multiple products that genuinely work better together. But once established, ecosystems create powerful moats. Customers stay not because they can't leave but because leaving would mean losing substantial value.

Platform Cooperatives: The Democratic Alternative

While most platforms are owned by shareholders seeking maximum profit, a small but growing movement advocates for platform cooperatives—platforms owned by users or workers.

Imagine if Uber were owned by drivers. Or if a social network were owned by its users. Instead of optimizing for investor returns, these platforms could optimize for user welfare.

Examples are emerging. Stocksy (stock photography) is owned by contributing artists. Resonate (music streaming) is owned by musicians and listeners. These cooperatives still need to generate revenue and cover costs, but profits are distributed among stakeholders rather than external shareholders.

The model addresses concerns about platform power and wealth concentration. Whether it can scale to compete with venture-backed giants remains uncertain, but it represents an interesting alternative approach to platform building.

Creator Economy Models

The rise of creators—YouTubers, podcasters, newsletter writers, course creators—has spawned new business models.

Platforms like Patreon let creators charge fans directly for access to exclusive content. Substack enables writers to run paid newsletters, keeping 90% of revenue. YouTube shares ad revenue with creators. OnlyFans takes a percentage of creator earnings.

These platforms succeeded by recognizing that creators needed infrastructure for payments, hosting, and fan management. By providing these tools, they could capture a percentage of the growing creator economy without creating content themselves.

The model works because it aligns incentives. When creators succeed, the platform succeeds. Unlike traditional media where companies employed creators, these platforms enable independent creators while taking a cut.

Bundling and Cross-Selling

Some companies win not through individual products but through packaging multiple offerings together.

Microsoft 365 bundles Word, Excel, PowerPoint, Teams, OneDrive, and more for one price. Individually, these might cost $15-30 monthly each. Bundled, they're $12.50 per user. Customers get better value, Microsoft gets stickier relationships and higher total revenue per customer.

Adobe Creative Cloud similarly bundles Photoshop, Illustrator, Premiere Pro, and 20+ other tools. Professional designers might use several daily. Buying individually would cost hundreds monthly; bundled, it's $55.

Bundling increases switching costs. A customer might consider alternatives to Photoshop, but finding replacements for their entire Adobe workflow is much harder.

The risk is that customers only value one or two bundle components. If they're paying for 10 tools but only using 2, competitors offering just those 2 tools for less might win.

How to Choose the Right Model

With so many options, how should a company choose? Several factors matter.

Audience and market: Consumer apps rarely work with direct payments—users expect free or very cheap. Business software can command higher prices because the ROI is clear.

Product nature: Some products fit certain models naturally. Developer tools work well with usage-based pricing. Creative tools suit subscriptions. Marketplaces obviously need transaction models.

Competition: In crowded markets, freemium helps acquire users despite competition. In blue ocean markets, you might charge from day one.

Growth goals: Venture-backed startups often prioritize growth over revenue, making freemium attractive. Bootstrapped companies need revenue sooner, favoring paid models.

Margins and economics: High-margin products (pure software) support freemium better than low-margin ones (with human services or heavy infrastructure costs).

Customer acquisition costs: If it costs $1,000 to acquire a customer, you need a business model that generates substantially more than $1,000 per customer over time. Subscriptions work well here; one-time purchases might not.

Most successful companies eventually use hybrid models. Slack is freemium with tiered subscriptions. AWS has subscriptions for some services, usage-based pricing for others. Apple combines hardware sales, commissions, subscriptions, and ecosystem lock-in.

The key is starting simple, learning from customers, and evolving thoughtfully rather than adopting every trendy model.

Strategic Considerations

Beyond choosing a model, several strategic factors determine success.

Understanding Your Key Players

Every market has dominant players whose strategies shape the landscape. In cloud computing, AWS, Google Cloud, and Microsoft Azure set pricing and features. In social media, Meta and Google define the advertising model.

Understanding these players helps you identify opportunities. Are they ignoring a segment? Is there a feature gap? Could you serve customers they're overpricing?

Sometimes the best strategy is being acquired by a major player. Instagram and WhatsApp became worth billions because Facebook (now Meta) needed to acquire their users and eliminate competition.

Opportunities in the Current Market

Several trends create opportunities for new entrants:

Remote work has exploded demand for collaboration software, virtual events, and distributed team management. Companies that solve remote work pain points well have grown dramatically.

AI and automation are transforming every industry. Tools that help businesses implement AI without deep expertise are proliferating. The companies building the best AI wrappers and integrations will capture substantial value.

Privacy and data ownership concerns are creating demand for alternatives to ad-supported services. Paid search engines, encrypted messaging, and privacy-focused analytics are emerging.

Vertical SaaS targets specific industries with tailored solutions rather than horizontal tools for everyone. Software for restaurants, medical practices, or law firms can command premium prices by solving industry-specific problems.

No-code and low-code platforms democratize software creation. As these mature, new types of businesses become possible.

Weaknesses and Risks to Navigate

No business model is perfect. Understanding weaknesses helps you mitigate them.

Subscription fatigue is real. Consumers and businesses are pushback against dozens of monthly charges. Some users are choosing one-time purchases or reducing subscriptions.

Platform dependence means your business can change overnight if Apple, Google, or Amazon changes policies. Many businesses have seen revenue disappear when App Store rules changed or Amazon adjusted search algorithms.

Competition and commoditization affect every model. As markets mature, differentiation becomes harder and prices compress. What once commanded premium prices becomes a race to the bottom.

Retention challenges plague subscription businesses. Losing 5% of customers monthly compounds into losing more than half your base in a year. Customer success and continuous value delivery are critical.

Threats on the Horizon

Several external factors could disrupt current models:

Regulation is increasing globally. Europe's Digital Markets Act forces changes to App Store fees and default browser settings. Privacy regulations restrict advertising practices. Future regulations could reshape entire business models.

Economic downturns hit different models differently. Subscription businesses often see churn spikes in recessions. Ad-supported businesses see revenue drop as marketing budgets shrink. Transaction-based businesses decline with overall economic activity.

Technology shifts can make entire categories obsolete. Mobile apps disrupted desktop software. Cloud computing disrupted on-premise software. AI might disrupt both. Companies must continuously evolve.

Security and privacy breaches destroy trust and can kill companies. As data becomes more central to business models, protecting it becomes existential.

Tax and Legal Considerations

Business models have different tax and legal implications that matter enormously.

Digital services taxation varies globally. Selling software to customers in Europe requires understanding VAT (typically 17-27%). Some US states tax SaaS, others don't. Compliance complexity grows with geographic expansion.

Revenue recognition rules differ by model. Subscriptions recognize revenue over time as services are delivered. One-time sales recognize revenue immediately. Marketplaces have specific rules for gross versus net revenue recognition. Getting this wrong can have serious accounting and legal consequences.

Data privacy compliance affects advertising and data businesses particularly. GDPR in Europe, CCPA in California, and similar laws globally create compliance obligations. Violations bring substantial fines.

Contractor versus employee classification matters for platform businesses. Uber, Lyft, and others face ongoing legal battles about whether drivers are contractors or employees. The distinction affects costs massively and has business model implications.

Metrics That Matter

Different business models require tracking different metrics.

For subscription businesses, the critical metrics are:

Monthly Recurring Revenue (MRR) and Annual Recurring Revenue (ARR)
Customer Acquisition Cost (CAC)
Lifetime Value (LTV)
Churn rate (monthly percentage of customers lost)
Net Revenue Retention (revenue from existing customers including expansions minus churn)

For marketplace businesses, track:

Gross Merchandise Value (GMV) - total transaction volume
Take rate (percentage you keep)
Active buyers and sellers
Liquidity (how quickly supply meets demand)

For advertising businesses, watch:

Daily/Monthly Active Users (DAU/MAU)
Engagement metrics (time spent, actions taken)
Cost Per Click (CPC) or Cost Per Thousand Impressions (CPM)
Revenue per user

For freemium businesses, monitor:

Free to paid conversion rate
Activation rate (percentage of signups who experience core value)
Time to conversion
Feature adoption by tier

Understanding which metrics matter for your model helps you optimize the right things.

Real-World Examples and Lessons

Theory is important, but let's look at how this plays out in practice.

Zoom started as a better video conferencing tool in a crowded market. They offered generous free tiers (40-minute meetings for up to 100 participants) while charging businesses for unlimited meeting length, more participants, and features like recording.

The freemium model drove explosive growth. Millions tried Zoom for free during the pandemic. Many upgraded when remote work became permanent. By 2023, Zoom had over 467,000 customers with more than 10 employees, most paying substantial subscriptions.

Stripe could have sold their payment processing API as a monthly subscription. Instead, they chose transaction-based pricing—2.9% plus 30 cents per charge. This aligned perfectly with customer success. Startups pay almost nothing initially, but as they grow, Stripe grows with them. Some of Stripe's largest customers process billions in payments annually, generating millions in fees.

Notion brilliantly combined freemium, subscription tiers, and viral growth. The product is genuinely useful for free, encouraging personal adoption. As teams form and need collaboration features, they upgrade. Users love Notion enough to tell others, driving organic growth. The result: a $10 billion valuation built largely through product-led growth.

Epic Games challenged the App Store model directly. They bypassed Apple's 30% commission by offering direct payment options in Fortnite. Apple banned Fortnite, leading to lawsuits and regulatory scrutiny. While Epic hasn't fully won, they've sparked global debate about fair platform fees and helped drive regulatory changes.

These examples show that business models aren't just theoretical—they're strategic decisions with massive implications.

The Future of Software Business Models

Where is this all heading? Several trends seem clear.

AI integration will become table stakes. Every software category will incorporate AI capabilities. The question becomes: do you charge extra for AI features, include them in existing tiers, or use AI as a moat? Different companies will choose different approaches.

Unbundling and rebundling will continue. Markets oscillate between integrated suites and best-of-breed point solutions. Currently, we're seeing both: some companies bundle more features (Notion adding docs, wikis, databases), while others unbundle (focused tools that do one thing excellently).

Privacy-first models may gain traction as users tire of ad-supported services that monetize attention. Paid alternatives to free, ad-supported tools are emerging. Whether consumers actually pay remains to be seen, but the shift is beginning.

Consumption-based pricing will likely expand beyond cloud infrastructure. As companies seek to align costs with value more precisely, usage-based pricing makes sense for more categories.

Platform regulation will reshape marketplace and ecosystem models. Regulators globally are scrutinizing platform power, app store fees, and default settings. Changes seem inevitable, though specifics remain uncertain.

Web3 and blockchain introduce new possibilities. Decentralized platforms owned by token holders rather than shareholders, creator tokens that let fans invest in creators directly, and NFTs that enable new digital ownership models are all experiments in progress. Most will fail, but some innovations may stick.

Conclusion: It's About Value Creation, Not Just Revenue

After exploring dozens of business models, one truth becomes clear: the best model is the one that creates and captures value most effectively for your specific situation.

Subscription models succeed when they continuously deliver value, keeping customers engaged month after month. Freemium works when the free tier genuinely helps users while premium features solve real pain points. Marketplaces thrive when they reduce friction and enable transactions that wouldn't happen otherwise.

The companies that win long-term don't just choose a model—they obsess over delivering value, then find business models that capture some portion of that value sustainably.

Understanding these models helps you make better decisions whether you're building software, investing in tech companies, or simply using digital products. You'll recognize when you're in a freemium acquisition funnel, understand why that SaaS company is pushing annual plans so hard, and see the strategic logic behind platform ecosystem moves.

The software industry continues evolving rapidly. New models emerge, existing ones adapt, and what works today might not work tomorrow. But the fundamental principle remains: create real value for real people, then build a business model that captures enough value to sustain and grow while keeping customers happy.

That's the real art of software business models—finding that sustainable balance where everyone wins.

End

That's all!

I hope you've found the article useful. I'll write more about the software business & related organizations & ecosystem soon. Feel free to share your thoughts.

Check more on

Publishing Your First NPM Package: A Real-World Guide That Actually Helps

Mir Mursalin Ankur — Sat, 22 Nov 2025 02:54:55 +0000

You know that moment when you’ve written the same utility function for the third time across different projects and suddenly think: “Wait… why am I doing this again?”
Yeah — that’s exactly how NPM packages quietly sneak into your life.

I recently went through the process of turning a simple HTML-to-PDF generator into a proper NPM package. What started as a quick utility became a small adventure — a mix of excitement, challenges, and learning-by-doing. A little confusing at times, but absolutely worth it.

And here’s the twist: NPM has updated quite a few things lately — deprecated classic tokens, changed their UI, and even updated how org-scoped packages behave. So if you’ve followed older tutorials, you’ve probably felt that “why isn’t this working?” frustration.

This guide is different.
It’s based on real steps, real mistakes, and the little details nobody tells you about until you’re already stuck.

Why Even Bother Publishing a Package?

Publishing a package does three magical things:

Reusability: Stop copy-pasting code between projects
Helping others: Someone out there is fighting the same problem right now
Learning: You'll dive into open-source workflow, versioning, CI/CD, and documentation

Plus, there's something genuinely satisfying about typing npm install your-package-name and seeing your own work install. It's a tiny piece of software craftsmanship that feels really good.

Understanding Scopes and Naming (Before You Start)

NPM packages can be:

Unscoped: your-package-name
Scoped: @yourname/your-package-name

Here's what matters: if your *NPM username *is cooldev, then @cooldev/anything is automatically your namespace. You don't need to create an organization unless your scope differs from your username.

Check if a name is available:

npm view @yourname/your-package-name
# 404 means it's free to use

Step 1: Set Up the Project Structure

Start fresh. Create a clean directory and initialize it:

mkdir your-package-name
cd your-package-name
git init
npm init -y

Keep things organized with a src/ folder for your code.

Step 2: Bring in Your Source Files

Copy your working code into the new package structure:

mkdir -p src
cp -r /path/to/your-project/src/lib/your-library/* src/

This isolation keeps your package clean and focused.

Step 3: Configure Your package.json

This is the heart of your package. Update these critical fields:

{
  "name": "@yourname/your-package-name",
  "version": "1.0.0",
  "main": "dist/index.js",
  "types": "dist/index.d.ts",
  "repository": {
    "type": "git",
    "url": "https://github.com/yourname/your-package-name.git"
  },
  "bugs": {
    "url": "https://github.com/yourname/your-package-name/issues"
  },
  "homepage": "https://github.com/yourname/your-package-name#readme"
}

Make sure:

name is unique (check NPM first)
repository.url points to your GitHub repo
bugs.url gives people a place to report issues
homepage links to documentation

Step 4: Connect to GitHub

Get your code into version control:

git add .
git commit -m "Initial commit: My Library to NPM Package"
git branch -M master
git remote add origin https://github.com/yourname/your-package-name.git
git push -u origin master

Step 5: Test Your Build Locally

Before publishing anything, make sure it actually works:

npm run build

Here's the secret weapon most beginners don't know about — test your package locally:

npm pack

This creates a .tgz file — the exact same file that would go to NPM.

Now test it in another project:

npm install /path/to/your-package-1.0.0.tgz

This catches so many issues. Seriously, multiple problems only showed up after testing in a fresh environment.

Step 6: Login to NPM Account

You can login to npm from any browser by going to npmjs.com. Login is also straightforward by command line:

npm login

You'll be prompted for:

Username
Password
Email
One-time password (if you have 2FA enabled)

Step 7: Choose Your Publishing Strategy

You have two ways to publish your package:

Manual Publishing - Quick start, publish from command line
Automated CI/CD - Professional, publish on git tag (recommended)

Let's start with manual to get you published quickly, then set up automation.

Manual Publishing (Quick Start)

npm login
npm publish --access public

The --access public flag is required for scoped packages (like @yourname/package-name).

That's it. Your package is live on NPM!

But here's the thing: manual publishing is error-prone. You might forget to build, or push the wrong version, or skip tests. Let's set up automation.

Step 8: Set Up Automated Publishing (Recommended)

Here's where it gets interesting. Classic NPM tokens are deprecated — many old tutorials still reference them, which is confusing. You need to create a Granular Access Token instead. Then use github CI/CD workflow to publish the changes to npm

Creating a Granular Access Token

This token lets GitHub Actions publish your package automatically. Here's how:

1. Go to npmjs.com and login

Navigate to your profile → Access Tokens → Generate New Token → Select Granular Access Token

2. Configure the token:

Token Name: GitHub Actions CI/CD
Expiration: 90 days (or your preference)

3. Set permissions:

Under "Packages and scopes":

Select Read and write
Choose either:
- "All packages" (easier), OR
- Select your specific package @yourname/your-package-name

4. Copy the token immediately

You won't be able to see it again! It starts with npm_...

5. Add to GitHub Secrets:

Go to your GitHub repository:

Settings → Secrets and variables → Actions
Click "New repository secret"
Name: NPM_TOKEN
Value: Paste your token
Click "Add secret"

Now GitHub Actions can publish on your behalf.

Step 9: Understanding Semantic Versioning

Before we automate, let's talk about versioning. It's not just numbers — it's a promise to your users:

Command	Example	When to Use
`npm version patch`	1.0.0 → 1.0.1	Bug fixes
`npm version minor`	1.0.0 → 1.1.0	New features
`npm version major`	1.0.0 → 2.0.0	Breaking changes

Here's the magic: each npm version command does three things:

Updates version in package.json
Creates a git commit
Creates a git tag (like v1.0.1)

That git tag is what triggers automated publishing.

Step 10: Create the GitHub Actions Workflow

Now let's set up the automation. This workflow:

Triggers when you push a version tag (like v1.2.3)
Runs your tests and builds
Verifies the version matches
Publishes to NPM with provenance (security feature)
Creates a GitHub release

Create .github/workflows/publish.yml:

name: Publish to NPM

on:
  push:
    tags:
      - 'v*'

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@v4
        with:
          version: 9.0.0

      - uses: actions/setup-node@v4
        with:
          node-version: '18.20.0'
          registry-url: 'https://registry.npmjs.org'
          cache: pnpm

      - run: pnpm install --frozen-lockfile
      - run: pnpm run typecheck
      - run: pnpm run build

      - name: Verify version matches tag
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          VERSION="${TAG#v}"
          FILE_VERSION=$(node -p "require('./package.json').version")
          if [ "$VERSION" != "$FILE_VERSION" ]; then
            echo "Version mismatch: tag=$VERSION, package.json=$FILE_VERSION"
            exit 1
          fi

      - name: Publish to NPM
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: pnpm publish --access public --provenance

Important notes about this workflow:

permissions: id-token: write enables NPM provenance (proves your package came from your GitHub repo)
The version verification step prevents accidental publishes with mismatched versions
--frozen-lockfile ensures consistent installs
Adjust pnpm to npm if you're not using pnpm

Step 11: Publishing with the Automated Workflow

Now that automation is set up, here's your new publishing workflow:

1. Make sure all changes are committed:

git status
git add .
git commit -m "feat: add new feature"
git push origin master

2. Create and push a version tag:

# For a patch release (bug fixes)
npm version patch
git push origin master --tags

# For a minor release (new features)
npm version minor
git push origin master --tags

# For a major release (breaking changes)
npm version major
git push origin master --tags

3. Watch it happen:

Go to your GitHub repository → "Actions" tab
You'll see the workflow running
Within a few minutes, your package is published!
GitHub automatically creates a release too

Pro tip: The moment you push the tag, GitHub Actions takes over. No manual npm publish needed.

Step 12: Control What Gets Published

Want to see exactly what goes into your package?

npm pack --dry-run

Typically you want:

dist/ (your compiled code)
README.md
LICENSE
package.json

Use .npmignore to exclude:

Source files (src/)
Tests
Config files
.github/
Development dependencies

Step 13: Write Documentation That Actually Helps

Your README is the first thing people see. Make it count:

Must-haves:

Quick installation command
Basic usage example (copy-paste ready)
API reference
Common problems and solutions

Nice-to-haves:

Advanced examples
Browser vs Node.js differences
Performance tips
Contribution guidelines

Good documentation increases adoption way more than perfect code does.

Step 14: Licensing and Collaboration

Choose a license: MIT is the most permissive and common for open-source libraries.

Enable collaboration:

Add CONTRIBUTING.md with guidelines
Use GitHub Issues for bug reports
Consider GitHub Discussions for questions
Tag releases properly

Note on releases:
With GitHub Actions set up, you don't need to manually create releases. The workflow automatically creates a GitHub release when you push a version tag. But you can still edit the release notes afterward to add detailed changelogs.

If it is important to create Releases manually, follow this:

Go to your repo's "Releases" tab
Click "Create new release"
Tag it as v1.x.x
Add a changelog describing what changed
Publish

Once the tag is pushed, GitHub Actions takes over and handles publishing.

Step 15: When Things Go Wrong

Yes, mistakes happen. Accidentally published version 1.1.0 instead of 1.0.3? Been there.

Within 24 hours:

npm unpublish @scope/package@version

After 24 hours:
NPM won't let you unpublish for safety reasons. Instead:

npm deprecate @scope/package@version "Broken release, use 1.0.4 instead"

Then publish the correct version and update your changelog.

Wait a minute or two after unpublishing — NPM's cache takes time to update.

Lesson learned: always double-check before tagging and pushing.

Bonus: One-Command Publishing Scripts

Want to make publishing even easier? Create these helper scripts that combine versioning and pushing in one command:

publish-patch.sh:

#!/bin/bash
npm version patch
git push origin master --tags

publish-minor.sh:

#!/bin/bash
npm version minor
git push origin master --tags

publish-major.sh:

#!/bin/bash
npm version major
git push origin master --tags

Make them executable:

chmod +x publish-*.sh

Now publishing is as simple as:

./publish-patch.sh

The script bumps the version, creates the tag, and pushes it. GitHub Actions sees the tag and handles the rest — testing, building, and publishing to NPM automatically.

Best Practices Checklist

Before Publishing:

✅ Test with npm pack and install locally
✅ Run all tests and type checks
✅ Update README with latest features
✅ Add or update CHANGELOG

Package Quality:

✅ Include TypeScript types (if applicable)
✅ Add a LICENSE file
✅ Set up CI/CD for automated testing
✅ Use .npmignore to keep package lean
✅ Include usage examples in README

Maintenance:

✅ Respond to issues promptly
✅ Tag releases with semantic versions
✅ Keep dependencies updated
✅ Document breaking changes clearly

Real-World Example: From Hobby Project to Published Package

This guide is based on a real-world transformation: turning an HTML-to-PDF generator from a single-application solution into a framework-agnostic package that any developer can use.

The package: @encryptioner/html-to-pdf-generator

What it does: Modern multi-page PDF generator from HTML content with smart pagination and styling support.

The transformation journey:

Started as tightly coupled code in a single project
Extracted the core logic into a standalone library
Made it framework-agnostic (works with React, Vue, vanilla JS, Node.js)
Added proper TypeScript types
Set up automated publishing with GitHub Actions
Documented everything in a useful README

The outcome:
A package that solves a real problem for developers who need to generate clean, multi-page PDFs from HTML without fighting with browser print dialogs or complex PDF libraries.

Installation:

npm install @encryptioner/html-to-pdf-generator

This transition from "code that works for one project" to "code that works for everyone" demonstrates what successful package publishing looks like. The technical steps matter, but the mindset shift matters more — thinking about edge cases, documentation, and user experience.

Final Thoughts

Publishing your first NPM package is a rite of passage. It's messy, confusing, and occasionally frustrating — but incredibly rewarding.

The moment you see someone install your package, report a bug, or (even better) contribute a feature — it all clicks. You're not just writing code anymore. You're building something that helps others build things.

Don't wait for the perfect moment or the perfect code. Start with something useful, document it well, and iterate. The tools are better than ever, and the community is welcoming.

And when something breaks at 2 AM (it will), don't panic. Unpublish within 24 hours, fix it, document what happened, and keep going.

The open-source world needs more builders. So go ahead — publish that package you've been thinking about.

Happy publishing! 🚀

Let's Connect

I'm always excited to hear about what you're building! If you found this guide helpful, have questions, or just want to share your NPM publishing journey:

Website: encryptioner.github.io
LinkedIn: Mir Mursalin Ankur
GitHub: @Encryptioner
X (Twitter): @AnkurMursalin
Technical Writing: Nerddevs

Drop a message if you publish your first package using this guide — I'd love to check it out!

I Built My Own Shell for Fun. You Can Too

Mir Mursalin Ankur — Fri, 01 Aug 2025 14:07:27 +0000

Ever wondered what happens when you type ls and hit Enter? I did too. So I built my own shell to find out.

The "Why" Behind the Madness

As a lead software engineer, I've spent years working with shells—Bash, Zsh—but I never really understood what was happening under the hood. Sure, I knew about processes, file descriptors, and system calls, but the actual mechanics of how a shell works? That was a black box.

Then I stumbled upon codingchallenges.fyi and their shell challenge. It gave motivation to uncover the invisible scene of most common functionalities. It was my chance to peel back the layers and understand the fundamentals that power every terminal session.

What is a Shell, Really?

When you type ls -la, here's what happens:

Read: The shell reads your input from stdin
Parse: It breaks your command into tokens (ls, -la)
Execute: It finds the ls program and runs it with -la as arguments
Wait: It waits for the program to finish
Repeat: It shows a new prompt, ready for your next command

Simple, right? But the devil is in the details.

The Journey Begins: ccsh

I decided to build ccsh (Compact C Shell)—a minimal but functional Unix-like shell. Here's what I learned along the way:

Why C?

C is the lingua franca of Unix systems. Every Linux distribution, macOS, and BSD variant comes with a C compiler. This means my shell can run anywhere without dependencies.

But more importantly, C gives me direct access to the system calls that power everything:

fork() and exec() for process creation
pipe() for inter-process communication
dup2() for file descriptor manipulation
waitpid() for process synchronization
signal() for handling interrupts

These are the same system calls that Bash, Zsh, and every other shell use under the hood.

AI as My Learning Partner

Here's the honest truth: AI generated most of my code, but I understood every line.

How AI Helped Me:

Generated boilerplate code structure - I didn't start from scratch
Explained complex system calls - When I was stuck on fork() vs exec()
Debugged memory management issues - C's manual memory management is tricky
Suggested best practices - Error handling, code organization, security considerations

The Key Insight:

AI is a tool, not a replacement. Understanding the fundamentals is crucial. Here's what I learned:

80% understanding is enough - If this isn't your core job, you don't need to memorize every system call
AI accelerates learning - When you know the basics, AI can help you build faster
Fundamentals matter - You still need to understand what fork() does, even if AI wrote the code

My Approach:

Start with understanding - Learn what each system call does conceptually
Use AI for implementation - Let AI handle the boilerplate and edge cases
Review and modify - Understand AI generated lines. If necessary, get clarification from alternate source
Test and debug - Break things to understand them better

"AI generated the code, but I understood most of the lines. That's the sweet spot."

Building the Shell

I chose to implement everything in a single main.c file for simplicity. Here's how to build it:

What is a Makefile?

A Makefile is a configuration file that tells the make utility how to build your project. It's like a recipe that automates the compilation process. Instead of typing long gcc commands, you just run make.

Simple Build

gcc -Wall -Wextra -std=c99 -g main.c -o ccsh -lreadline

What each flag does:

-Wall -Wextra: Enable all warning messages
-std=c99: Use C99 standard
-g: Include debug symbols
-lreadline: Link against the readline library (for command history)

With Makefile

# Compiler and flags
CC = gcc
CFLAGS = -Wall -Wextra -std=c99 -g
LDFLAGS = -lreadline

# Build target: ccsh depends on main.c
ccsh: main.c
    $(CC) $(CFLAGS) -o ccsh main.c $(LDFLAGS)

# Clean up build artifacts
clean:
    rm -f ccsh

# Install to system (optional)
install: ccsh
    cp ccsh ~/.local/bin/

How it works:

CC = gcc: Define the compiler
CFLAGS: Compiler flags for warnings and standards
LDFLAGS: Linker flags for external libraries
ccsh: main.c: Target ccsh depends on main.c
clean: Remove built files

Building and Running

# Build the shell
make

# Run the shell
./ccsh

# Clean up
make clean

The Cool Features I Added

1. Built-in Commands

cd /path/to/directory    # Change directory
pwd                      # Print working directory
exit                     # Exit shell
jobs                     # List background jobs
fg %1                    # Bring job to foreground
help                     # Show help information

2. Alias System

alias ll="ls -lah"       # Create alias
alias                    # List all aliases
unalias ll               # Remove alias

3. Background Job Management

sleep 10 &               # Run in background
jobs                     # List background jobs
fg %1                    # Bring to foreground

4. I/O Redirection

ls > output.txt          # Redirect output
cat < input.txt          # Redirect input
echo "hello" >> log.txt  # Append output

5. Globbing Support

ls *.txt                 # List all .txt files
cp file?.txt backup/     # Copy files matching pattern

The "Aha!" Moments

Process Groups and Sessions

I never fully understood how Ctrl+C works until I implemented it. When you press Ctrl+C, the kernel sends a SIGINT to the entire process group. The shell needs to:

Create a new process group for each command
Handle signals appropriately
Restore the shell's process group when the command finishes

Environment Variables

I always knew about PATH, but seeing how the shell searches for executables was enlightening. It's just a simple loop through directories, checking if the file exists and is executable.

The Challenges I Faced

Memory Management Nightmares

C doesn't have garbage collection, so every malloc() needs a corresponding free(). With complex command parsing and multiple processes, memory leaks were a constant threat.

Signal Handling Complexity

Getting Ctrl+C to work correctly was surprisingly tricky. The shell needs to:

Ignore SIGINT for itself
Forward SIGINT to child processes
Restore signal handlers after child completion
Handle signals during pipeline execution

Cross-Platform Quirks

While C is portable, Unix systems have subtle differences:

Different signal behavior between Linux and macOS
Varying limits on file descriptors
Different implementations of readline

Deep Dive: How C Talks to the Operating System

Let's trace through what happens when you type ls -la in my shell:

1. The Fork-Exec Dance

pid_t pid = fork();
if (pid == 0) {
    // Child process
    execvp(expanded[0], expanded);
    perror("execvp");
    exit(1);
} else if (pid > 0) {
    // Parent process
    if (background) {
        // Background job
        printf("[%d] %d\n", job_count, pid);
        add_job(pid, line);
    } else {
        // Foreground job - wait for completion
        int status;
        waitpid(pid, &status, 0);
    }
}

What's happening:

fork() creates an exact copy of the current process
The child gets a new process ID but identical memory
execvp() replaces the child's memory with the ls program
The parent waits for the child to finish

2. How Redirection Works

When you type ls > output.txt, here's what happens:

/* Handle output redirection */
if (outfile) {
    int flags = O_WRONLY | O_CREAT;
    if (append) flags |= O_APPEND;
    else flags |= O_TRUNC;

    int fd = open(outfile, flags, 0644);
    if (fd == -1) { 
        perror("output"); 
        exit(1); 
    }
    dup2(fd, STDOUT_FILENO);
    close(fd);
}

The magic is dup2(fd, STDOUT_FILENO). This makes file descriptor 1 (stdout) point to the same place as our file descriptor.

3. Globbing Implementation

For ls *.txt:

void expand_globs(char** args, char** expanded_args, int* expanded_count) {
    *expanded_count = 0;
    glob_t results;
    results.gl_offs = 0;
    results.gl_pathc = 0;
    results.gl_pathv = NULL;

    for (int i = 0; args[i] != NULL; i++) {
        int flags = GLOB_TILDE;  /* Expand ~ to home directory */
        if (strchr(args[i], '*') || strchr(args[i], '?')) {
            /* Pattern contains glob characters */
            if (*expanded_count > 0) flags |= GLOB_APPEND;
            if (glob(args[i], flags, NULL, &results) != 0) {
                /* Glob failed, use original argument */
                expanded_args[(*expanded_count)++] = args[i];
            } else {
                /* Add all matched files */
                for (size_t j = 0; j < results.gl_pathc; j++) {
                    expanded_args[(*expanded_count)++] = results.gl_pathv[j];
                }
            }
        } else {
            /* No glob characters, use as-is */
            expanded_args[(*expanded_count)++] = args[i];
        }
    }
    expanded_args[*expanded_count] = NULL;

    /* Free the glob structure */
    if (results.gl_pathv != NULL) {
        globfree(&results);
    }
}

What I Learned About Real Shells

Building my own shell gave me a new appreciation for tools like Bash and Zsh. They handle edge cases I never considered:

Complex quoting rules
Job control with multiple background processes
Signal handling in pipelines
Performance optimizations
Cross-platform compatibility

The Takeaway

Building your own shell isn't just an academic exercise. It's a practical way to understand:

Process management: How the OS handles processes
I/O systems: File descriptors, pipes, redirection
Signal handling: How programs communicate with the OS
System calls: The interface between user and kernel space
Build systems: How to create robust, portable software

Try It Yourself

If you're interested in low-level programming, I highly recommend building a shell. Start simple:

Basic command execution
Add argument parsing
Implement I/O redirection
Add pipes
Build in job control

The codingchallenges.fyi shell challenge is an excellent starting point. you can also check

What's Next?

I'm thinking about adding:

Tab completion
Better error handling
More built-in commands
Scripting capabilities
Performance optimizations

But honestly, the learning experience was the real reward. Understanding how the tools I use daily actually work has made me a better engineer.

The next time you type a command, take a moment to appreciate the complexity hidden behind that simple prompt. And maybe, just maybe, consider building your own shell to see what's really happening under the hood.

Happy coding! 🐚

End:

That's all!

I hope you've found the article useful. You should try building your own shell if you haven't already. Feel free to share your thoughts in the comments below.

Check more on

Integrating Bitbucket MCP with Cursor: A Practical Guide for Developers

Mir Mursalin Ankur — Mon, 21 Jul 2025 15:44:40 +0000

As developers, we all want our workflows to be smooth and efficient. Managing repositories, reviewing pull requests, and keeping track of changes can get tedious—especially when it means switching between your editor and browser. Recently, I set up the Bitbucket MCP (Model Context Protocol) server with Cursor IDE, and it’s made these tasks much more convenient.

While Cursor supports bugbot for GitHub PR reviews, there’s nothing similar out-of-the-box for bitbucket users. Setting up Bitbucket MCP with Cursor changed that for me—and made my dev life a lot smoother.

Here’s a practical guide based on my experience, with tips that apply even if you use other tools.

Why Integrate Bitbucket MCP with Cursor?

The main benefit is reducing context switching. With Bitbucket MCP, you can:

List and manage repositories
Create, review, and approve pull requests
Access commit history and diffs
Adjust repository settings

All from within Cursor, so you spend more time coding and less time navigating web UIs.

What You’ll Need

Cursor IDE
Node.js v16 or higher
Bitbucket account with repository access
Bitbucket Repository Access Token (not an app password)

Step-by-Step Setup

1. Install the Bitbucket MCP Server

In your project directory, run:

pnpm install -D bitbucket-mcp

You can use npm if you prefer.

2. Configure MCP

Create a .cursor/mcp.json file in your project root. Example:

{
  "mcpServers": {
    "bitbucket": {
      "command": "npx",
      "env": {
        "BITBUCKET_URL": "https://api.bitbucket.org/2.0",
        "BITBUCKET_TOKEN": "your-repository-access-token",
        "BITBUCKET_WORKSPACE": "your-workspace"
      },
      "args": ["bitbucket-mcp"]
    }
  }
}

Replace the placeholders with your actual token and workspace name (not the URL).

3. Get a Bitbucket Access Token

Follow this guide to generate a token. Make sure it has Read/Write permissions for repositories and pull requests. Use a repository access token, not an app password.

4. Test Your Credentials

Before moving on, it’s a good idea to verify your token. Here’s a simple Node.js script:

const axios = require('axios');
const tokenCredentials = {
  url: "https://api.bitbucket.org/2.0",
  workspace: "your-workspace",
  token: "your-repository-access-token"
};

(async () => {
  try {
    const res = await axios.get(`${tokenCredentials.url}/workspaces/${tokenCredentials.workspace}`, {
      headers: { 'Authorization': `Bearer ${tokenCredentials.token}` }
    });
    console.log('Token is valid! Workspace:', res.data.name);
  } catch (e) {
    console.error('Token test failed:', e.response?.status, e.response?.statusText);
  }
})();

Save it as scripts/test-bitbucket-credentials.js and run:

node scripts/test-bitbucket-credentials.js

If you see your workspace name, you’re set.

5. Restart Cursor

Close and reopen Cursor to load the new MCP server. You should see Bitbucket MCP under Settings → Tools & Integrations → MCP Tools.

Everyday Usage

Once set up, you can run Bitbucket commands from Cursor’s agent chat or command palette. For example:

List repos: /bitbucket listRepositories
Get repo details: /bitbucket getRepository --workspace your-workspace --repo-slug your-repo
Manage pull requests: /bitbucket getPullRequests --workspace your-workspace --repo-slug your-repo

You can also create or approve PRs, check commit diffs, and manage branching models—all from your editor.

Troubleshooting Tips

MCP server not loading? Double-check your .cursor/mcp.json and environment variables.
Auth errors? Make sure you’re using a repository access token (not an app password) and that it hasn’t expired.
Commands not recognized? Restart Cursor and verify the MCP server is loaded.

If you want to avoid confirmation prompts for MCP tools, enable “Auto-run MCP Tools” in Cursor’s chat settings.

Deep Dive: How MCP Works (and How the Cursor and Bitbucket MCP Server Uses It)

To really understand the power of this integration, it helps to know what’s happening under the hood.

What is MCP?

MCP stands for Model Context Protocol. It’s an open protocol designed to let tools (like editors, IDEs, or AI agents) communicate with code hosts (like GitHub, GitLab, Bitbucket, etc.) in a standardized way. Instead of every tool building its own custom integration for each code host, MCP defines a common set of commands and data structures for things like repositories, pull requests, branches, and commits.

Think of MCP as a universal translator for developer tools. It lets your editor ask questions (“What pull requests are open?”) or take actions (“Create a new branch”) in a way that works across different platforms, as long as there’s an MCP server for that platform.

How Does the Bitbucket MCP Server Leverage MCP?

The Bitbucket MCP server is an implementation of this protocol, acting as a bridge between Cursor and Bitbucket’s API. Here’s how it works in practice:

Command Flow: When you run a Bitbucket command in Cursor (like listing repositories or creating a pull request), Cursor sends a standardized MCP request to the Bitbucket MCP server.
Translation Layer: The MCP server receives this request and translates it into the appropriate Bitbucket API call, handling authentication and formatting as needed.
Data Exchange: The server fetches the data from Bitbucket, then converts the response back into the MCP format so Cursor can display it in a consistent way, regardless of the underlying code host.
Authentication: The MCP server uses your Bitbucket repository access token to authenticate API requests securely, so you never have to expose your credentials directly to Cursor or other tools.

This architecture means you get a seamless, unified experience in your editor, while the heavy lifting of talking to Bitbucket’s API is handled by the MCP server. It also makes it easier for new tools and platforms to integrate in the future—just implement the MCP protocol, and you’re good to go.

In summary, MCP is the glue that connects your editor to your code host, and the Bitbucket MCP server is the translator that makes it all work smoothly for Bitbucket users.

How AI Chat Agents of Cursor Leverage MCP

One of the most powerful aspects of MCP is how it enables AI chat agents (like those in Cursor) to interact with your repositories in a smart, automated way. Here’s how it works:

User Request: You ask the AI agent to do something—like review a pull request, summarize recent changes, or list open issues.
MCP Command Generation: The agent formulates a standardized MCP command based on your request (for example, "get pull request details").
Data Retrieval: The MCP server fetches the relevant data from Bitbucket, translates it into the MCP format, and returns it to the agent.
AI Processing: The agent analyzes the structured data—such as code diffs, comments, or commit history—and generates a human-friendly summary, review, or action.
Action or Insight: The agent presents its findings to you (e.g., a PR review summary, a list of suggested changes, or even automates a merge if you approve).

Because MCP provides a consistent, structured interface, the AI agent doesn’t need to know the details of Bitbucket’s API. This makes it much easier to build powerful, context-aware automation and insights directly into your development workflow, regardless of which code host you use.

Broader Lessons

Even if you use GitHub, GitLab, or another platform, the principle is the same: integrating your tools saves time and helps you stay focused. Investing a little effort in setup pays off in smoother workflows and fewer distractions.

Final Thoughts

Integrating Bitbucket MCP with Cursor has made my daily work more efficient and less fragmented. If you’re looking to streamline your repo management, I recommend giving it a try—or finding similar integrations for your stack. The right tools should help you focus on what matters: building great software.

End

That's all!

I hope you've found the article useful. You should try to use mcp server if you haven't already. It has many interesting use cases. Feel free to share your thoughts and experiences.

Check more on

Give Google Sheet Access Only to Form Submitters — With Apps Script

Mir Mursalin Ankur — Sun, 20 Jul 2025 16:23:40 +0000

As a lead software engineer, I've seen teams across companies rely on Google Forms + Sheets for quick data collection — feedback surveys, attendance tracking, event registration, you name it.

But here’s a common issue that comes up:
How do you restrict access to the Google Sheet so only the people who submitted the form can view it?

Google Forms doesn't offer this natively (which is honestly surprising given how common this need is). But with a little Apps Script magic, you can make it happen.

The Problem

Let's say you're running a private beta program. You collect sign-ups via Google Form. Now you want only those who signed up (and no one else) to see the list.

Manually adding viewers to the Sheet? Not scalable.
Leaving it public? Not secure.
The goal:

Give view access only to people who submit the form.
Remove access from people who are no longer in the list.
Keep certain admin/owner access always intact.

The Approach

We hook into Google Apps Script and:

Read the email column from the sheet.
Add new emails as viewers.
Remove emails who shouldn't have access anymore.
Always preserve admin users (like yourself).

Here's the battle-tested script I've used in my projects:

function updateSheetSharing() {
  const spreadsheet = SpreadsheetApp.getActiveSpreadsheet();
  const sheet = spreadsheet.getSheets()[0]; // First sheet

  // update this column according to your sheet
  const emailColumnIndex = 2; // Column B = 2
  const startRow = 2; // Header on row 1

  const lastRow = sheet.getLastRow();
  if (lastRow < startRow) {
    return;
  }

  const ownerEmails = ['admin@gmail.com']; // Add your admin email(s)

  const emails = sheet.getRange(startRow, emailColumnIndex, lastRow - startRow + 1)
    .getValues()
    .flat()
    .filter(email => email && typeof email === 'string' && email.includes('@'));

  const uniqueEmails = [...new Set(emails.map(email => email.trim()))];
  const currentViewers = spreadsheet.getViewers().map(user => user.getEmail());

  // Add new viewers
  for (const email of uniqueEmails) {
    if (ownerEmails.includes(email) || currentViewers.includes(email)) {
      continue;
    }

    try {
      spreadsheet.addViewer(email);
    } catch (e) {
      Logger.log(`Failed to add ${email}: ${e}`);
    }
  }

  // Remove viewers not on the list
  for (const email of currentViewers) {
    if (ownerEmails.includes(email) || uniqueEmails.includes(email)) {
      continue;
    }

    try {
      spreadsheet.removeViewer(email);
    } catch (e) {
      Logger.log(`Failed to remove ${email}: ${e}`);
    }
  }
}

Deployment Tips

Trigger it on Form Submit:
Go to Triggers → Add Trigger → Choose updateSheetSharing → Event: On form submit. See Google's trigger documentation for more details.
Avoid Too Many Writes:
If your form gets hundreds of submissions daily, consider adding debounce logic or batching updates periodically.
Error Handling:
Some domains may block sharing or throw quota errors — log and monitor failures via Logger.
Security Reminder:
Never share sheet access based on user input unless you validate the email (i.e., restrict form to logged-in users and auto-capture email).
"Google hasn't verified this app" Warning:
You'll likely see this warning when first running the script. This happens because Apps Script is accessing sensitive Google services (Sheets, Drive) and requesting OAuth scopes that Google considers sensitive.

Solution for Personal/Internal Use:
When you see the warning screen:
1. Click "Advanced" at the bottom
2. Click "Go to your project name"
3. Accept the permissions manually for your account
This is safe for personal scripts or internal organizational use. The warning appears because Google hasn't reviewed your specific script, but you can authorize it yourself.
Domain Restrictions:
Some organizations block external sharing entirely. If you're in a corporate environment, check with your IT team about Google Workspace sharing policies.
Quota Limits:
Apps Script has daily quotas for API calls. For high-volume forms, monitor your usage in the Apps Script dashboard under "Quotas" to avoid hitting limits. Check Google's quota limits for current limits.
Testing in Development:
Test the script on a copy of your sheet first. Create a test form and sheet to verify everything works before deploying to production.
Execution Time Limits:
Apps Script has a maximum execution time of 6 minutes per invocation. If your script processes a large number of emails, it might timeout. For high-volume scenarios, consider batching operations or using time-based triggers instead of form submission triggers. See Google's execution limits for detailed information.
Monitoring Executions:
After setting up triggers, you can monitor their execution in the Apps Script dashboard:
- Go to Executions in the left sidebar
- See a list of all recent trigger runs with timestamps
- Check execution status (success/failed)
- Click on any execution to view detailed logs
- Failed executions show error messages and stack traces
- Successful runs show "Execution completed" status
This is crucial for debugging. If your script isn't working as expected, check the Executions menu first to see if triggers are firing and what errors might be occurring.

Deep Dive: How Google Handles Millions of Triggers

Ever wonder how Google manages Apps Script triggers for millions of users worldwide? Here's what's happening behind the scenes:

Google's Trigger Infrastructure

Event-Driven Architecture: Google uses a sophisticated event-driven system where every Google Workspace action (form submission, sheet edit, time-based events) generates events that flow through their infrastructure.

Distributed Processing: When you submit a form, Google's systems:

Detect the form submission event
Route it to the appropriate Apps Script project
Execute your script in a sandboxed environment
Handle the response and any side effects (like sharing permissions)

Scalability Challenges: Google processes billions of events daily across:

Form submissions
Sheet modifications
Time-based triggers
Calendar events
Email triggers

Why the 6-Minute Limit?

The execution time limit isn't arbitrary. Google's infrastructure needs to:

Resource Management: Prevent runaway scripts from consuming excessive resources
Fair Usage: Ensure all users get reasonable access to computing resources
Cost Control: Apps Script runs on Google's infrastructure, and they need to manage operational costs
Reliability: Shorter execution times mean faster recovery from failures

Event Processing Pipeline

Form Submission → Event Queue → Trigger Router → Script Execution → Result Handler

Event Queue: Google maintains massive queues of events waiting to be processed
Trigger Router: Routes events to the correct Apps Script projects
Script Execution: Runs your code in isolated containers
Result Handler: Processes the output and applies changes (like sharing permissions)

Why Triggers Sometimes Fail

Rate Limiting: Google implements sophisticated rate limiting to prevent abuse and ensure fair resource distribution.

Resource Contention: During peak hours, the system might be under higher load, causing occasional delays or failures.

Network Issues: Between Google's internal services (Forms → Sheets → Apps Script), network hiccups can cause temporary failures.

Quota Management: Google tracks usage across all services to prevent any single user from overwhelming the system.

The Magic of "Eventually Consistent"

Google's systems are designed for "eventual consistency" - meaning:

Your trigger might not fire immediately
There might be a few seconds delay
But the system guarantees it will eventually process your event

This design allows Google to handle massive scale while maintaining reliability.

Why I Use This

I’ve used this in social group's data collection, closed feedback loops, and classroom setups. It works beautifully when:

You want lightweight access control without complex infrastructure
You trust the form submitters (or validate their identity)
You don't want to set up a whole database + auth system
You need something that "just works" without ongoing maintenance

It's not enterprise-grade security — but for small teams and quick workflows, it's a surprisingly robust solution that I've seen work reliably in production.

Final Thoughts

Apps Script has a quiet superpower: It brings automation to everyday Google tools that teams already use daily.

What I love about this approach is its simplicity. With just ~50 lines of code, you can build a simple access control system that feels like it was always meant to be there — tailored to your specific workflow.

And that's why I still reach for Apps Script for glue code like this — it's the Swiss Army knife of Google Workspace automation.

Feel free to adapt this script for your own use case. If you're dealing with something more complex (like edit permissions, or syncing to multiple sheets), you'll want to add further checks — but this core pattern will get you a long way.

End

That's all!

I hope you've found the article useful. You should try to use Apps Script if you haven't already. It has many interesting use cases. Feel free to share your thoughts and experiences.

Check more on

📬 My Go-To Engineering Newsletters (30+ Summarized)

Mir Mursalin Ankur — Thu, 22 May 2025 02:19:25 +0000

Engineering newsletters offer a streamlined way for professionals to stay informed about industry trends, learn new skills, and connect with a community. They are a convenient way to access curated information and expert insights, keeping you ahead of the curve in a rapidly evolving field.

Here’s a quick breakdown of the newsletters I read regularly, their key topics, and why they’re valuable for software engineers.

🧠 A. Software Engineering & System Design

1. ByteByteGo

Focus: System design, scalability, and backend architecture.
Why Read: Offers visual explanations of complex system design concepts, beneficial for technical interviews and architectural understanding.
Subscription: bytebytego.com

2. Quastor

Focus: System design, big tech engineering blog summaries, technical deep dives.
Why Read: Summaries of big tech engineering blogs and guides on API design, database paradigms, and performance optimization
Subscription: blog.quastor.org

3. System Design One by Neo Kim

Focus: In-depth system design case studies and architectural patterns.
Why Read: Provides practical insights into designing robust systems, enhancing your architectural skills.
Subscription: systemdesign.one

4. Michael Thiessen

Focus: Vue.js development, component design, and frontend architecture.
Why Read: Delivers actionable tips and patterns for building scalable Vue applications.
Subscription: michaelnthiessen.com

🧑‍💼 B. Engineering Leadership & Management

5. Engineering Leadership by Gregor Ojstersek

Focus: Engineering management, career growth, industry insights, career development, and personal journey.
Why Read: Covers team scaling, stakeholder management, and overcoming imposter syndrome to improve leadership skills for tech leads/EMs.
Subscription: newsletter.eng-leadership.com

6. The Pragmatic Engineer by Gergely Orosz

Focus: Software engineering leadership, industry insights, and career development.
Why Read: Offers deep dives into engineering practices and management strategies from a seasoned leader.
Subscription: newsletter.pragmaticengineer.com

7. Pointer by Suraj

Focus: Curated articles for engineering leaders, covering management and technical topics.
Why Read: Provides a concise selection of high-quality reads to stay updated on leadership trends.
Subscription: pointer.io

8. Refactoring by Luca Rossi

Focus: Engineering management, team dynamics, and productivity.
Why Read: Delivers practical advice on improving team performance and engineering processes.
Subscription: refactoring.fm

9. Manager.dev by Anton

Focus: Resources and insights for engineering managers.
Why Read: Offers tools and articles to enhance management skills and team leadership.
Subscription: manager.dev

10. The Caring Techie by Irina Stanescu

Focus: Empathetic leadership and team well-being.
Why Read: Emphasizes the human aspect of tech leadership, promoting a caring work culture.
Subscription: thecaringtechie.substack.com

11. Engineer’s Codex

Focus: Engineering principles and leadership insights.
Why Read: Explores the intersection of technical excellence and effective leadership.
Subscription: engineercodex.substack.com

12. Thrive Engineering

Focus: Engineering team growth and productivity.
Why Read: Provides strategies to build thriving engineering teams and foster innovation.
Subscription: thriveengineering.substack.com

📈 C. Product, Growth & Career Development

13. Lenny's Newsletter by Lenny Rachitsky

Focus: Product management, growth strategies, and career advice.
Why Read: Offers actionable insights from industry experts to accelerate your career.
Subscription: lennyrachitsky.com

14. Sarah Tavel's Newsletter

Focus: Investment perspectives and product-market fit.
Why Read: Provides valuable insights into building products that resonate with users.
Subscription: sarahtavel.substack.com

15. One Useful Thing by Ethan Mollick

Focus: Practical applications of research in work and life.
Why Read: Translates academic findings into actionable advice for professionals.
Subscription: oneusefulthing.substack.com

16. Nathan Baugh from World Builders

Focus: Storytelling and content creation strategies.
Why Read: Enhances your ability to communicate and build a personal brand.
Subscription: nathanbaugh.substack.com

17. The Developing Dev by Ryan Peterman

Focus: Weekly insights to accelerate your software engineering career, written by a Staff Software Engineer at Instagram.
Why Read: Offers actionable advice and mentorship for engineers aiming to progress from junior to senior roles.
Subscription: read.developing.dev

🧪 D. Data, AI & Analytics

18. Chartr

Focus: Data storytelling and visualizations.
Why Read: Simplifies complex data into engaging visuals, aiding in data literacy.
Subscription: chartr.co

19. SeattleDataGuy

Focus: Data engineering and analytics.
Why Read: Shares practical advice and industry trends in data engineering.
Subscription: seattledataguy.substack.com

20. DataEngineer.io by Zach Wilson

Focus: Data engineering education and career development.
Why Read: Offers courses and resources to advance in data engineering.
Subscription: dataengineer.io

🧰 E. Frontend & Web Development

21. Addy Osmani from Elevate

Focus: Web performance and frontend engineering.
Why Read: Provides deep dives into optimizing web applications.
Subscription: addyosmani.com

22. Hybrid Hacker

Focus: Full-stack development and tech tutorials.
Why Read: Shares hands-on guides and coding tips for developers.
Subscription: hybridhacker.substack.com

23. Tech World With Milan by Dr. Milan Milanovic

Focus: Technology trends and software development.
Why Read: Explores emerging technologies and their applications.
Subscription: techworldwithmilan.substack.com

🧑‍💻 F. Coding Challenges & Skill Development

24. Coding Challenges by John Crickett

Focus: Programming challenges and problem-solving.
Why Read: Enhances coding skills through regular challenges.
Subscription: codingchallenges.substack.com

25. Developing Skills by John Crickett

Focus: Career growth and skill enhancement.
Why Read: Provides strategies for continuous professional development.
Subscription: developingskills.substack.com

26. Craft Better Software by Daniel Moka

Focus: Software craftsmanship and best practices.
Why Read: Offers insights into writing clean and maintainable code.
Subscription: danielmoka.substack.com

27. Biweekly Engineering

Focus: Engineering updates and industry news.
Why Read: Keeps you informed about the latest in software engineering.
Subscription: biweekly-engineering.beehiiv.com

28. Level Up Coding by Trey Huffine

Focus: Simplifying complex programming concepts, system design, and AI through engaging visuals and tutorials.
Why Read: Ideal for developers seeking to deepen their understanding of coding and system design with accessible content.
Subscription: levelupcoding.substack.com

📰 G. General Tech & Industry News

29. The Engineer Newsletter

Focus: Cutting-edge engineering trends (semiconductors, space tech, clean energy) and industry breakthroughs.
Why Read: Quick updates on tech milestones (e.g., Intel’s 18A chips, SpaceX Starship launches) and premium deep dives.
Subscription: theengineernews.substack.com

30. The Medium Newsletter

Focus: Curated articles across various topics.
Why Read: Discover diverse perspectives and stories from the Medium community.
Subscription: medium.com/newsletter

By subscribing to these newsletters, you can stay updated on various aspects of software engineering, from technical skills to leadership and industry trends.

End

That's all!

I hope you’ve found the article useful. If you haven’t already, you should read the newsletters. They are full of knowledge and experience. Reading newsletters could be part of your career growth and personal improvement.

Check more on

Apps Script - List all the newsletters filling up your Gmail. Selective unsubscribing got easy

Mir Mursalin Ankur — Sun, 26 Jan 2025 14:57:46 +0000

Are you subscribed to many newsletters that are filling up your Gmail? You can clean up all newsletters by filtering Gmail's unsubscribe text. You may have known that already. And I am not writing to describe that procedure. You are intelligent enough to do that with a little googling.

The Problem

I am writing to tell you about a special case that happened to me. I was subscribed to many newsletters I felt interesting. I used to read newsletters almost daily. However, little by little I got overwhelmed with the increasing number of subscribed newsletters.

So, I decided to filter my subscribed newsletter. I didn't want to delete old newsletters. I just wanted to list my current subscribed newsletters (which are unique). Check them a bit and unsubscribe which feels unnecessary.

The Solution

Turns out, there is no easy way to do it from Gmail. So, I had to do a little code. Google has a service called Apps Script. It lets you run some code. You can fetch and manipulate data from your used Google products. So, you can automate many boring manual tasks. Believe it or not, I had subscriptions to around 100 newsletters from different websites, services, and tech newsletters. I reduced my subscribed newsletters to only those that seemed appropriate.

So, Here's the instructional summary of what I did:

Create a new Google Sheet
Go to Extensions > Apps Script of my new Google sheet
Write the necessary code in the code editor of Apps Script which does the following:
- Get unique mail list senders with other necessary info like name
- Wrote that data in an existing Google sheet
Save the script and give it a name
Go to Run > main, then grant permissions
The unique email addresses will populate your spreadsheet
After that, from Gmail you can unsubscribe from unwanted senders

My code had the following parts:

A main function that calls _getUniqueMailingListSenders function
The _getUniqueMailingListSenders takes the following parameters:
- applicable filter which will be applied to filter the Gmail
- The column title of the Google sheet
- A boolean parameter clearSheet, which declares if I want to clear my existing sheet or not
Inside the _getUniqueMailingListSenders function, it filters all the emails of my Gmail
Later, it loops through the filtered emails and adds the From email to a javascript set
The from field in Gmail filter also keeps the name of the email sender
So, A loop runs on javascript set, and regular expression gets applied to separate the name and email and save in a map
This could also be done in an earlier loop, but I kept it in a separate loop for simplicity.
The result can be checked via Execution log using the console.log() of javascript
However, adding that result in Google sheet is more convenient
So, the active sheet gets fetched (From where Extensions > Apps Script was called) and cleared (depending on clearSheet boolean parameter)
Then, it finds the last used column and sets the columns for emails and names dynamically after the last used column
It sets the column title of Google sheet (with current date info for checking later)
And writes each unique email address and corresponding name to the new columns

Full Code:

function _getUniqueMailingListSenders(
  searchOption,
  title,
  clearSheet = true,
) {

  // Search in Gmail to check all threads
  const threads = GmailApp.search(searchOption);

  // Use a Set to store unique senders
  const senders = new Set();

  // Loop through each thread
  threads.forEach(thread => {
    const messages = thread.getMessages();
    // Loop through each message in the thread
    messages.forEach(message => {
      senders.add(message.getFrom());
    });
  });

  const emailData = new Map();

  // Find email and sender name and save it in a map
  senders.forEach((sender) => {
    const emailMatch = sender.match(/<([^>]+)>/);
    const email = emailMatch ? emailMatch[1] : sender;
    const name = sender.replace(`<${email}>`, '').trim();

    if (!emailData.has(email)) {
      emailData.set(email, name);
    }
  });

  // Get the active sheet
  const sheet = SpreadsheetApp.getActiveSpreadsheet().getActiveSheet();

  if (clearSheet) {
    sheet.clear();
  }

  // Find the last used column
  const lastColumn = sheet.getLastColumn();

  // Set the columns for emails and names dynamically after the last used column
  const emailColumn = lastColumn + 1;
  const nameColumn = lastColumn + 2;
  const currentDate = new Date().toLocaleDateString();

  // Add headers with the current date in the new columns
  sheet.getRange(1, emailColumn).setValue(`${title} - Email - ${currentDate}`);
  sheet.getRange(1, nameColumn).setValue(`${title} - Name - ${currentDate}`);

  // Start writing below the header
  let row = 2;

  // Write each unique email address and corresponding name to the new columns
  emailData.forEach((name, email) => {
    console.log(`Adding data on column (${emailColumn}, ${nameColumn}) and row ${row}: `, {email, name});
    sheet.getRange(row, emailColumn).setValue(email);
    sheet.getRange(row, nameColumn).setValue(name);
    row++;
  });
}

function main() {
  // Search for emails that belong to a mailing list
  _getUniqueMailingListSenders(
    'list:(<*>)',
    'Unique Email Sender',
    false,
  );

  // Search for emails that belong to a substack mailing list
  // _getUniqueMailingListSenders(
  //   // 'list:(<*techworldwithmilan@substack.com>)',
  //   'list:(<*.substack.com>)',
  //   'Unique Substack Email Sender',
  //   false,
  // );
}

End

That's all!

I hope you've found the article useful. You should try to use Apps Script if you haven't already. It has many interesting use cases. Feel free to share your thoughts and experiences.

Check more on

pnpm - A better package manager for Node.js

Mir Mursalin Ankur — Sun, 28 Jan 2024 13:48:43 +0000

We will talk about pnpm but first let's have a brief introduction on package manager

Node.js is a popular choice for developers which allows using JavaScript on both client and server side. Having a big community, node.Js provides numerous public and private packages to integrate into projects. To manage these projects, we have package manager. npm is the standard package manager for node.js

How `npm` works

On a freshly installed device, npm reads package.json file and starts checking the defined version on npm registry
On matching the version, it firsts download the package in global cache directory of the device
Later copies the package on the node_modules directory of the project specific directory
While running the project, packages in the project specific directory is used
The global cache directory helps npm to find the specific version of package when that version is required again

It's kind of a good approach. However, there are some `cons` to this approach

Redundant use of device space - I am pointing inefficient use of non-volatile memory (SSD, HDD). It is common that one can have multiple similar project. In that case, most of the packages (and their version) will be same. However, for each one of them, a package will be copied to multiple project specific directory. Those node_modules directories will gradually take up device space which u need to store other resources. U may all have seen this meme 😀

Long installation time - U may not worry about disk space. But lengthy installation time will scare you. For a relatively simple project, required packages can be large. npm install requires a copy of the package twice. First in global cache directory and later in project specific directory. Copying this every time for every new project will surely kill your time

Better solution

You need to reduce your disk space and installation time. So that, u can focus on development. Now pnpm comes into the picture. The way pnpm works is simple but brilliant.

pnpm download packages from npm registry similar to npm
It stores packages in global cache directory same as npm
Now the magic happens. Instead of copying the packages to project specific directory one by one according to package.json file, it hard links the package to node_modules of project specific directory.
It seems copying, but it is not. As it just links (similar to file/folder shortcut) the package path from global cache directory to project specific directory without copying the whole file. Which saves both installation time and disk space.

Using `pnpm` in projects

Install pnpm. U may install stand alone script install pnpm globally using npm
With node & npm, It is common to use nvm (node version manager) for different version of node.Js. Remember that, for each version of node, u need to install pnpm globally
Ensure your pnpm executable path is in your global bash PATH. You can add it in your .bashrc or .zshrc file in following way:
```
export PNPM_HOME="/Users/ankur/Library/pnpm"
export PATH="$PNPM_HOME:$PATH"
```
pnpm has a rich list of CLI commands for installation, update, run script. Common commands are:

Command	Meaning
`pnpm add sax`	Save to `dependencies`
`pnpm add -D sax`	Save to `devDependencies`
`pnpm add sax@3.0.0`	Specify version `3.0.0`
`pnpm i`	Install package from `package.json`
`pnpm rm sax`	Remove package from `package.json`
`pnpm run <command-name>`	Run command from `package.json`
`pnpm --filter <package_selector> <command>`	Filtering allows you to restrict commands to specific subsets of packages.

U can also create multiple workspaces inside your project and handle all the packages from from your root directory using pnpm. It is specially helpful for monorepo. To create workspace, just create a new pnpm-workspace.yaml. In that file you can define your workspaces. U can also use glob pattern. For example:
```
packages:
- "packages/*"
```
Now in the scripts section of package.json filter the workspaces
```
"w:server": "pnpm --filter server",
"w:client": "pnpm --filter client",
```
Then u can easily run workspace specific command. Something like this pnpm w:server build
You can easily use pnpm in docker
pnpm can easily be used in various continuous integration systems.

Bonus 😀

U can easily debug your server side using vscode with pnpm. U just need to add configuration in your .vscode/launch.json file

{
  "name": "Launch server via pnpm",
  "type": "node",
  "request": "launch",
  "cwd": "${workspaceFolder}",
  "runtimeVersion": "18.11.0",
  "runtimeExecutable": "pnpm",
  "runtimeArgs": ["w:server start"]
}

End:

That's all!

I hope you've found the article useful. You should try pnpm if you haven't already. Feel free to share your thoughts in the comments below.

Check more on

DEV Community: Mir Mursalin Ankur

Claude Code Configuration Blueprint: The Complete Guide for Production Teams

Who This Is For

The Configuration Layers

Part 1: Security — The Permission System

Pattern Syntax

Global Settings (~/.claude/settings.json)

Project Settings (.claude/settings.example.json)

Part 2: CLAUDE.md — Teaching Claude Your Codebase

The Instruction Budget Problem

The Template

Progressive Disclosure

What Works vs. What Doesn't

Part 3: Rules — Enforcing Patterns with Globs

Part 4: Plugins & Agents — Instant Capabilities

Plugins

Agents

Part 5: Skills & Commands — Building Workflows

Skills vs. Commands

The Spec-to-Ship Workflow

Key Skills

Ticket Directory Structure

Building Your Own Skills

Part 6: Advanced Patterns — Hooks, Subagents, Worktrees

Hooks — Automated Quality Gates

Subagents — Keeping Context Clean

Worktrees — Isolated Development

Part 7: Automation — Auto-Invocation & Memory

Auto-Invocation — Skills That Trigger Themselves

Auto Memory — Cross-Session Intelligence

Part 8: Putting It All Together

New Project Setup (5 Minutes)

How the Layers Work in Practice

Quick Reference

The Takeaway

References

Let's Connect

Navigating Bangladesh's Software Industry: A Practical Guide for Developers in 2026

The Brutal Truth: Too Many Developers, Not Enough Jobs

Why This Is Happening: The Training Glut

The University Problem

The Online Course Explosion

The Bootcamp Industry

The New Reality: Global Competition + AI

1. Remote Work Saturation

2. AI Coding Tools

Three Career Paths That Actually Work

The AI Reality: Don't Ignore It, Don't Overrate It

Action Plan: Your First 5 Years

Specialization Deep Dives

Targeting the Right Companies

Salary Breakdown: The Real Numbers (2024-2025)

Training: What Actually Works in 2026

Common Mistakes to Avoid

Where the Industry Is Headed

Final Thoughts

Resources

End

Inside Bangladesh's Software Industry: Companies, Models, and Opportunities

The Industry at a Glance

Why Bangladesh's Software Industry Exists

The Complete Business Model Breakdown

The Government Contract Giants

Datasoft Systems Bangladesh Limited

Tiger IT Bangladesh Limited

The Government Contract Controversy

The International Outsourcing Leaders

Brain Station 23

BJIT Group

Cefalo Bangladesh Ltd.

Enosis Solutions

Vivasoft Limited

Selise Digital Platforms

The Product Companies

NerdDevs

BDTask Limited

Ollyo (MuktoSoft)

REVE Systems Ltd.

The Embedded Systems & IoT Specialists

Samsung R&D Institute Bangladesh (SRBD)

Global Settings (`~/.claude/settings.json`)

Project Settings (`.claude/settings.example.json`)