Fahad Sabzwari AI & automation engineer

All work

Case study · AI in an existing product

Her method, moved where visitors can't copy it

Lynda Samphire runs a dream interpretation practice. Her Dream Decoder app was live and working. It was also handing two things to every visitor that it shouldn't have.

  • 2 to 3 days from brief to live
  • 23 tests covering the new backend
  • 626 lines of guide, written for a non-technical owner
  • Three projects so far, with a fourth reserved

What she asked for

The app called the AI provider straight from the browser. That meant two things travelled to every visitor who opened the page: the key to her AI account, and the prompt that holds her interpretation method.

The method is not a technical detail. It is the thing she sells. Anyone who opened the developer tools could have read it, copied it, or spent her AI budget on their own projects.

She knew exactly what she wanted protected and came to me to move both onto a server. That's the whole brief: a client who understood her own business, and an engineer to do the part that isn't her job.

What I built

A small Node.js and TypeScript service on Railway, in her own account, that sits between her Squarespace site and the AI provider. The app stopped talking to the provider. It talks to her server instead.

  1. The key and the method never leave the server

    Both live in the server's configuration. Nothing in the browser has a copy, so there is nothing left in the page for anyone to read.

  2. Nobody else can spend her budget

    The model, the prompt and the maximum length of a reply are fixed on the server. A visitor can send a dream. They cannot choose an expensive model or ask for a 50-page answer. Inputs and request sizes are capped, and only her own site is allowed to call the service.

  3. Errors stay friendly in front, detailed behind

    A visitor sees a plain apology. The actual error goes to the logs, with secrets scrubbed out. The service also refuses to start if its configuration is incomplete, so a half-configured deploy fails immediately instead of quietly misbehaving.

  4. One less moving part

    The signup step moved onto Squarespace's own form, so visitor details land in her Squarespace contacts. That removed a piece of backend nobody needed to maintain.

Handed over so she could run it

Delivered with 23 tests and a 626-line guide written click by click for someone who doesn't write code. The point of the guide isn't thoroughness for its own sake. It's that she can rotate a key, read a log or redeploy without booking me first.

Two months later she asked for a landing page redesign, delivered in two days. She has hired me three times now and reserved a fourth project before the third shipped.

Fahad was a pleasure to work with from start to finish. He built my Dream Decoder app with skill, patience and professionalism. The project evolved along the way as I refined my vision and he handled every change with flexibility and a solutions focused approach. He communicated clearly, responded quickly and delivered a working app I am proud to launch. I would highly recommend Fahad for any web development project and look forward to working with him again in the future.

Lynda Samphire Dream Decoder backend, April 2026. Rated 5.0 on Upwork.
See the review on Upwork Upwork review from Lynda Samphire for the Dream Decoder backend, rated 5.0.

Open my Upwork profile

Once again Fahad did amazing work and really quick! Thank you!!
Lynda Samphire Landing page redesign, June 2026. Rated 5.0 on Upwork.
Technical details, for the engineer you'll ask about this

Node.js, Express and TypeScript, with the Anthropic SDK, helmet for headers, pino for logging, and Vitest with Supertest for the 23 tests. Deployed on Railway into the client's own account, in front of a Squarespace site.

The server owns the model name, the system prompt and the output ceiling. Request bodies and input length are capped, and cross-origin requests are restricted to her domain. Configuration is validated at startup, so the process exits rather than running with a missing value, and log output is scrubbed of secrets.

Is your AI feature calling the provider from the browser?

If your app was built quickly, the key and the prompt are often still in the page. It's a small fix while it's small. Twenty minutes is enough to tell where yours stands.

Top Rated Plus on Upwork (top 3%), 100% Job Success, 21 completed jobs.

Book a free 20-minute call