# Nasir Mollah

> Nasir Mollah is a full-stack developer based in Dhaka, Bangladesh who builds production-ready web apps, platforms and websites end to end — marketplaces, booking and scheduling systems, admin dashboards, Stripe payments and subscriptions, and API integrations — that are fast, secure and built to rank on Google and in AI assistants. Works remotely with clients worldwide, with overlap for US and European hours.

Contact: nasir@nasirmollah.com · https://nasirmollah.com/contact

## Services
- [Web apps & platforms](https://nasirmollah.com/services#web-apps-and-platforms): Custom software that runs a real part of your business.
- [Websites & landing pages](https://nasirmollah.com/services#websites-and-landing-pages): A fast, professional site you can update yourself.
- [APIs, payments & integrations](https://nasirmollah.com/services#apis-payments-and-integrations): Connect your product to the services it depends on.
- [Performance & SEO](https://nasirmollah.com/services#performance-and-seo): Fast pages that Google — and AI assistants — understand.
- [Ongoing care](https://nasirmollah.com/services#ongoing-care): Someone who looks after your product after launch.
- [Therapy practice websites](https://nasirmollah.com/therapy-practice-websites): clinician pages, clear fees, consultation booking, local and AI search.
- [Car rental websites](https://nasirmollah.com/car-rental-websites): direct mobile booking, location pages, multilingual sites, WhatsApp.
- [AI search readiness](https://nasirmollah.com/ai-search): what AI assistants need from a website and what gets checked and fixed.

## Work (live client projects)
- [Elephant In The Room](https://nasirmollah.com/work/elephant-in-the-room): Healthcare platform. Healthcare platform for a Colorado therapy practice: therapist directory with a map, consultation booking, a role-based admin and encrypted patient data. Role: Full-stack development & SEO.
- [Bittengo](https://nasirmollah.com/work/bittengo): Two-sided rental marketplace. Two-sided rental marketplace for Ticino and Italy: Mapbox search, partner onboarding, Stripe subscriptions and promoted listings. Role: Frontend & backend development, SEO.
- [Coastal Motor](https://nasirmollah.com/work/coastal-motor): Auto broker lead & finance platform. Lead and finance platform for a California auto broker: live deals, quotes, credit applications, VIN decoding and car appraisals. Role: Web development.
- [Trobits](https://nasirmollah.com/work/trobits): Crypto community platform. Crypto community platform: user accounts, points-based rewards with claims and withdrawals, a leaderboard, a live news feed and browser games. Role: Web development.

## About
- [About](https://nasirmollah.com/about): background, skills and education.
- [Résumé](https://nasirmollah.com/resume): one-page résumé.

## Articles
- [Google’s September 2026 spam update is done: how to check if your site was hit](https://nasirmollah.com/blog/google-september-2026-spam-update): Google’s fourth spam update of 2026 took almost 14 days to roll out — far longer than the others. Here’s a simple Search Console check to see if your traffic was affected, what spam policies usually trip up small business sites, and how to recover.
- [Node2Shell (CVE-2026-111497) explained: is your Node.js app exposed, and how to patch it](https://nasirmollah.com/blog/node2shell-cve-2026-111497-nodejs-brotli): Node2Shell is a high-severity bug in the Brotli decoder bundled with Node.js that can lead to remote code execution. Here’s who is exposed, how to check your servers, Docker images and CI, and which versions fix it.
- [Next.js security update October 2026: which versions are vulnerable and how to upgrade](https://nasirmollah.com/blog/nextjs-security-update-october-2026): Next.js 16.4.1 and 15.5.28 fix two critical remote code execution bugs and a Server Actions denial of service. Here’s how to tell if your app is affected, how to upgrade safely, and what the November 3 security release means for you.
- [AI coding agents on a real codebase: a production playbook](https://nasirmollah.com/blog/ai-coding-agents-production-playbook): Tools like Claude Code, Cursor and GitHub Copilot can now plan, edit files, run tests and open pull requests. Here’s how to use AI coding agents on production code without losing quality, security or understanding — with concrete team guidelines.
- [Shipping LLM features to production: evals, guardrails, cost and monitoring](https://nasirmollah.com/blog/shipping-llm-features-to-production): A demo that works on ten examples is not a product. Here’s a practical production checklist for AI features — evaluation sets, guardrails, fallbacks, cost and latency control, monitoring and rollout — so your LLM feature stays reliable after launch.
- [Context engineering: the skill that’s replacing prompt engineering](https://nasirmollah.com/blog/context-engineering-guide): The best AI features aren’t built on clever prompts — they’re built on giving the model exactly the right information at the right moment. Here’s what context engineering is, why it matters more as models get smarter, and production guidelines for doing it well.
- [How to get your business recommended by ChatGPT, Perplexity and Google’s AI answers](https://nasirmollah.com/blog/get-recommended-by-ai-search): More customers now ask an AI assistant instead of scrolling through search results. Here’s how AI search actually finds and chooses businesses — and the practical steps that make yours easy to recommend.
- [How large language models actually work — a plain-English guide for developers](https://nasirmollah.com/blog/how-large-language-models-work): Tokens, embeddings, attention, training and sampling — what really happens between your prompt and the model’s answer, explained without the hype and without a math degree.
- [Authentication explained: sessions, JWTs, OAuth and passkeys](https://nasirmollah.com/blog/authentication-explained): Every login form hides a set of design decisions — sessions or tokens, cookies or headers, passwords or passkeys. Here’s how modern web authentication works and how to choose a setup that’s secure without being complicated.
- [Prompt engineering that actually works: a practical guide](https://nasirmollah.com/blog/prompt-engineering-guide): Forget magic phrases. Good prompts are clear briefs — context, a precise task, examples, structure and a way to check the result. Here are the techniques that consistently make AI output better.
- [Embeddings and vector databases, explained for web developers](https://nasirmollah.com/blog/embeddings-and-vector-databases): Embeddings turn text, images and products into lists of numbers that capture meaning — the technology behind semantic search, recommendations and RAG. Here’s how they work and how to use them in a real app.
- [RAG explained: how to make AI answer from your own data](https://nasirmollah.com/blog/retrieval-augmented-generation-explained): Retrieval-augmented generation lets a language model answer questions using your documents instead of its memory. Here’s how the pipeline works — chunking, embeddings, vector search, prompting — and how to build one that’s actually reliable.
- [Web security essentials: the OWASP Top 10 explained for developers](https://nasirmollah.com/blog/web-security-owasp-top-10): Most web breaches don’t need genius hackers — they exploit a familiar list of mistakes. Here’s a practical tour of the OWASP Top 10 risks, with concrete examples and the habits that prevent them.
- [AI agents, tool use and MCP: how AI goes from talking to doing](https://nasirmollah.com/blog/ai-agents-tool-use-and-mcp): An AI agent is a language model in a loop with tools. Here’s how tool calling works, what the Model Context Protocol (MCP) standardizes, and how to build agents that are useful without being dangerous.
- [Build a neural network from scratch in PyTorch — then let PyTorch do the work](https://nasirmollah.com/blog/neural-network-from-scratch-pytorch): The best way to understand deep learning is to build a small network by hand — forward pass, loss, backpropagation and gradient descent — and then rebuild it the idiomatic PyTorch way. A beginner-friendly, code-first walkthrough.
- [Vibe coding: what it’s great for, where it breaks, and how to do it responsibly](https://nasirmollah.com/blog/vibe-coding-explained): Describing what you want and letting AI write the code has gone from joke to everyday workflow. Here’s an honest look at what vibe coding does well, the risks it hides, and a practical way to use it without shipping a mess.
- [Web accessibility for developers: a practical WCAG 2.2 guide](https://nasirmollah.com/blog/web-accessibility-guide): Around one in six people lives with a significant disability — and accessible sites work better for everyone. Here’s what WCAG 2.2 asks for, the issues that matter most, and how to build and test accessible interfaces in everyday work.
- [Why learning AI is no longer optional — and what to actually learn](https://nasirmollah.com/blog/why-developers-should-learn-ai): AI isn’t replacing developers or businesses that adapt — it’s raising the bar for everyone else. Here’s why learning AI matters now, what skills are worth your time, and a realistic learning path that doesn’t require a PhD.
- [Local SEO for small businesses: how to show up when people search nearby](https://nasirmollah.com/blog/local-seo-small-business): When someone searches “therapist near me” or “car rental Lugano”, Google shows a map and a handful of businesses. Here’s how local search works and a practical plan to make your business one of them.
- [Building real-time apps with Socket.IO: a practical guide](https://nasirmollah.com/blog/socket-io-real-time-apps): Live chat, notifications, dashboards and collaborative tools all need the server to push updates instantly. Here’s how Socket.IO works, the core concepts — events, rooms, acknowledgements — and how to secure and scale it in production.
- [Monorepos with Turborepo: share code between your website, dashboard and API](https://nasirmollah.com/blog/turborepo-monorepos-guide): When a project grows into a website, an admin dashboard and an API, keeping them in separate repositories gets painful. Here’s how a Turborepo monorepo works, how to set one up, and the caching that makes it fast.
- [Docker for web developers: from “works on my machine” to production](https://nasirmollah.com/blog/docker-for-web-developers): Docker packages your app with everything it needs to run, so it behaves the same on your laptop, your teammate’s laptop and your server. Here’s how images, containers and Compose work — with a production-ready Dockerfile for a Node.js app.
- [Caching for web apps: browser, CDN, server and Redis — explained](https://nasirmollah.com/blog/caching-strategies-web-apps): Caching is the cheapest way to make a website faster and an API cheaper to run — and the easiest way to show users stale data. Here’s how each caching layer works, which headers to use, and how to keep caches correct.
- [CI/CD with GitHub Actions: automate testing and deployment for your web app](https://nasirmollah.com/blog/ci-cd-with-github-actions): Every manual deployment is a chance to forget a step. Here’s what CI/CD really means, how GitHub Actions works, and complete workflows that lint, test, build and deploy a web app automatically — safely.
- [Multilingual websites done right: URLs, hreflang and international SEO](https://nasirmollah.com/blog/multilingual-websites-hreflang): Translating your website can open new markets — or quietly confuse Google and frustrate visitors. Here’s how to structure a multilingual site, use hreflang correctly and avoid the mistakes that cost international traffic.
- [TypeScript for JavaScript developers: the parts that matter most](https://nasirmollah.com/blog/typescript-for-javascript-developers): TypeScript catches whole categories of bugs before your code runs and makes large codebases far easier to change. Here’s a practical tour of the features you’ll use every day — and how to adopt it without slowing your team down.
- [Core Web Vitals explained: how to make your website feel fast](https://nasirmollah.com/blog/core-web-vitals-guide): Google measures how fast your pages load, how quickly they respond and how stable they look — and visitors notice all three. Here’s what LCP, INP and CLS mean, how to measure them properly, and the fixes that make the biggest difference.
- [Structured data and JSON-LD: help Google and AI understand your website](https://nasirmollah.com/blog/structured-data-json-ld-guide): Structured data tells search engines and AI systems exactly what your page is about — your business, services, articles and reviews — in a format machines can’t misread. Here’s how JSON-LD works, which types matter, and how to add it correctly.
- [Building full-stack apps with Next.js and Prisma](https://nasirmollah.com/blog/building-fullstack-apps-nextjs-prisma): The Next.js App Router and Prisma ORM are a type-safe, productive pairing — database schema to UI in one TypeScript codebase. Here’s how the pieces fit together, from schema and queries to Server Actions, validation and caching.

## Optional
- [Privacy](https://nasirmollah.com/privacy)
- [Sitemap](https://nasirmollah.com/sitemap.xml)