Case study · US logistics marketplace
AllShip AI
Three fragile apps became one marketplace the business can run.
AllShip AI is a US marketplace for moving, vehicle, freight and heavy-equipment shipping. Shippers post a load, FMCSA-verified carriers bid, and the shipper's money waits in escrow until delivery is confirmed. I rebuilt it from scratch, alone: product, design, website, payments, security and moving the old data across.
- My role
- Solo — from audit to launch
- Budget
- ≈ $15,000
- What I built
- Website · marketplace · admin
- Who uses it
- Shippers, carriers, drivers

3 → 1
separate apps merged into one product
23
shipment types, each with its own form
4
workspaces: shipper, carrier, driver, admin
17
US states with verified carriers
72 h
longest a carrier waits for payout after delivery
34,921
fake sign-ups cleaned out before launch
01The product
A shipper needs something moved. A carrier wants work and to be paid on time. AllShip sits between them and holds the money until both are happy.
Step 1
Post a load
23 categories, each with its own form. No sign-up needed to start — the account is created when the form is sent.
Step 2
Verified carriers bid
Only FMCSA-verified carriers. Instant quotes come from each carrier's published rate card, not a guess.
Step 3
Pay into escrow
The shipper pays the bid plus a 10% fee through Stripe Connect. The money waits until delivery.
Step 4
Drive & prove it
The driver shares live GPS, photographs pickup and collects a signed proof of delivery on the phone.
Step 5
Carrier gets paid
When the shipper confirms — or after 72 h automatically — the carrier receives 100% of the bid.
Shipper accepts a bid
$940
carrier's price
Pays into escrow
$1,034
bid + 10% service fee
Delivery confirmed
$940
transferred to the carrier
AllShip keeps
$94
the 10% service fee
02Where it started
Before writing a line of the new app, I read the old database. The numbers decided the plan.
34,921of 34,938
accounts were bots
Sign-up had no rate limit or captcha. A script created them in ~36 hours — most likely to email-bomb real inboxes through AllShip's own sender.
117of 119
bids were generated
A script bid on every load automatically, the “best match” carrier was fixed in code, and some ratings were random numbers.
3
separate apps for one product
A server, a dashboard and a marketing site, built separately. Every change had to be made three times.
0
payment protection
“Payments” were just a paid flag, not money held until delivery — and the database stored full card numbers with CVV.
03How it was built
Each stage shipped something usable: first the foundation and the site, then the marketplace, operations, AI — and hardening before handover.
Old database · read-only copy
Users34,921 of 34,938 bot sign-ups
Bids117 of 119 generated by a script
Payments18 of 18 flags, not real money
Moved across: 16 real customers and 5 carriers, old passwords still work
Old database · read-only copy
Users34,921 of 34,938 bot sign-ups
Bids117 of 119 generated by a script
Payments18 of 18 flags, not real money
Moved across: 16 real customers and 5 carriers, old passwords still work
01Audit: what is real?
Before building anything new, I checked what the old system actually held.
- Read a copy of the old database without touching the live one
- Found 34,921 fake sign-ups, generated bids and stored card numbers
- Moved the 16 real customers and 5 carriers — they log in with their old passwords
02A website that brings in loads
Keep what already worked, rebuild the rest properly.
- Every old page address kept, so Google rankings carry over
- 31 pages plus 23 service pages, each leading to its own load form
- Sign-in by email, Google, magic link or passkey, with 2-step verification
03Post, compare, pay safely
The core of the marketplace.
- A short step-by-step form for each of the 23 shipment types
- Bids show carrier verification, real reviews and instant prices
- Stripe holds the payment until delivery; the carrier is paid automatically
04Everything after the payment
Trips, drivers and proof — visible to the shipper in real time.
- Carriers add drivers and assign them to loads
- Drivers share live location, photograph the pickup and collect a signature
- Chat, notifications, payouts and a fair way to settle disputes
05An assistant that saves time
AI that does the paperwork — and never acts on its own.
- Turns one sentence into a ready load or a bid draft
- Answers from the user's own loads and bids, not general knowledge
- Nothing is posted, bid or paid without the user's click; guided tours for new users
Security review · 109 pages and actions
Team and admin settings could be changed from outside — blocked
A carrier could pose as a shipper and bid on own loads — fixed
Carriers could see competitors' bid amounts — fixed
A double click could pay or accept twice — fixed
+ 2-step verification for admins · error monitoring · privacy export & delete
06Safe to run, ready to hand over
Checked from the attacker's side, then documented.
- Every page and action reviewed for who can see and change what
- Admin actions need 2-step verification; error monitoring is on
- Privacy export and delete for users, and full docs for the next developer
04Inside the product
Hover or tap the numbers. Every label on these screens comes from real data — that was the point of the rebuild.

Comparing bids
What a shipper sees once carriers have bid. Every label is earned from real data.
- 1Honest labels“Lowest price” and “Top rated” appear only when they're true. No paid “Best match”.
- 2Verified carriers onlyGovernment (FMCSA) check, completed loads and real reviews on every bid.
- 3Instant quoteCalculated from the carrier's own price list — distance, volume and extras. No waiting for a reply.
- 4Accept and payThe shipper pays the bid + 10%. Stripe holds the money until the delivery is confirmed.
- 5Ask AIThe assistant can compare these bids in plain language — it reads, the user decides.

Following a trip
The same load after the carrier assigned a driver. The shipper watches every step live.
- 1Clear statusEvery step is recorded with a time, so both sides always know where the load is.
- 2Signal lostIf the driver's phone stops reporting, the shipper sees it instead of a frozen dot.
- 3Live GPSThe driver's phone shares its position about every 20 seconds — visible only to people on this load.
- 4Money in escrowThe carrier is paid after delivery — confirmed by the shipper or automatically after 72 h.
- 5DisputesSomething wrong? A dispute freezes the payout until an admin releases, refunds or splits it.
05Marketing site
No stock screenshots: scripted demos built from the app's own components play right in the page — and load only near the viewport.




06Mobile
Drivers do their whole job on one screen: start the trip, share location, photograph the pickup, collect a signature.

Home

Load wizard

Driver trip

AI tools
07Outcome
Project budget
≈ $15,000
For the full rebuild: architecture, design system, marketing site, four dashboards, admin console, payments, AI, security and the data migration.
- One product instead of threeWebsite, workspaces for shippers, carriers and drivers, and the admin console — one place to change anything.
- Payment protectionStripe holds the shipper's money until delivery, with refunds and disputes built in and every cent accounted for.
- A website that sellsOld pages and rankings kept; 23 service pages, price calculators and landing pages ready for Google Ads.
- Honest pricesInstant quotes from carriers' own price lists and real reviews only — and leads are saved even if a visitor leaves the form.
- AI that helps, safelyIt drafts loads and bids and answers questions, but can't post, bid or pay without the user — and can't be talked into it.
- Security you can show investors2-step verification for admins, a review of every page and action, safe file uploads and automated tests.
- Clean dataReal users and carriers migrated with their passwords; bots, fake bids and card data left behind.
- No lock-inFull documentation and a handover guide, so any developer can pick the project up.
Framework
- Next.js 16
- React 19
- TypeScript strict
- Tailwind v4
Data
- Postgres
- Drizzle ORM
- Supabase Realtime
- RLS
Money
- Stripe Connect
- Escrow ledger
- Webhooks
AI
- OpenAI Responses API
- Function tools
- Offline mode
Auth & security
- Better Auth
- Passkeys
- TOTP 2FA
- CSP nonces
Ops
- Vercel crons
- Sentry
- Resend
- Vitest
- Playwright

Have a marketplace, a booking flow or a legacy app nobody wants to touch?
Let's make it something you can run.

