Chinmay Bhat

Product developer in Bangalore with 3+ years of full-time experience. I build websites that bring in businessproducts for a regulated fintechSEO that compoundssecurity for a fleet of Macswebsites that bring in business

Works with
Chinmay Bhat

Currently, 3+ years full-time

Product developer at EximPe

100×

organic traffic

Next.jsReactTypeScriptTailwind CSSPostgreSQLPrismaSupabaseTerraformDockerSwiftGoogle Chrome
LaravelWordPressGhostGitHub ActionsGoogle AdsMetaMakeClaudeFigmaGSAPVercel
3+
years of full-time experience
2,640
GitHub contributions since January 2025
100×
organic traffic growth at EximPe
500+
qualified leads from forms I built

One person across design, code, growth and security, so nothing gets lost between handoffs.

Websites that convert

Design and build in Next.js, fast by default, with forms and tracking wired in from day one.

  • Next.js
  • Design
  • CMS

SEO and growth

Content, landing pages and free tools that rank, plus Google and Meta campaigns.

  • SEO
  • Ads
  • Analytics

Compliance and security software

ISO 27001 consoles, access reviews and data loss prevention, built for audits.

  • ISO 27001
  • DLP
  • AWS

Internal tools and automation

The dashboards, approval flows and AI assistants your team is paying three SaaS tools for.

  • Automation
  • MCP
  • Claude

Five live websites, designed and built end to end, for a fintech, two agencies, a SaaS product and a fashion label.

eximpe.com
EximPe website
FeaturedFintech

EximPe

Cross-border payments that let global merchants collect UPI from Indian customers.

Moved the whole site from WordPress to Vite to Next.js, then wrote the SEO content, tools and lead forms that took it from 15 visitors a day to about 2,000.

100×
organic traffic
19.8k
URLs in sitemap
500+
qualified leads
  • Next.js
  • SEO
  • Lead capture
  • Automation
Visit eximpe.com
markenza.co.in
Markenza website

Markenza

Marketing agency

Designed and built the full company site, plus the blog backend the team publishes from.

  • Design
  • Development
  • Blog CMS
Visit markenza.co.in
mediavantage.co.in
Media Vantage website

Media Vantage

Entertainment

A bold, type-led site for celebrity campaigns, talent management and brand IP.

  • Design
  • Development
  • Motion
Visit mediavantage.co.in
pyrelo.in
Pyrelo website

Pyrelo

SaaS

The product site: features, pricing, a live demo flow and a library of 100 free tools.

  • Product site
  • Next.js
  • SEO
Visit pyrelo.in
triqiofit.com
Triqio website

Triqio

E-commerce

An e-commerce storefront with collections, product pages, a studio edit and bestsellers, in a clean editorial style.

  • E-commerce
  • Design
  • Development
Visit triqiofit.com

  1. 01

    Discover

    A call to understand the business, the audience and what success looks like.

  2. 02

    Design

    Wireframes, then a polished design you can click through before any code.

  3. 03

    Build

    Fast, accessible, SEO-ready code, shared on a live preview link as it grows.

  4. 04

    Launch and grow

    Hosting, analytics and search set up, then improvements based on real numbers.

Jul 2026 to now, 162 releases

EximPe Compliance Toolkit

A self-hosted GRC and work-management platform that replaced Sprinto and ClickUp.

The console EximPe runs its ISO 27001:2022 programme on. Employees accept policies, finish security training and request access or hardware. Compliance managers run frameworks, controls, evidence, access reviews, drills and the regulatory calendar. Auditors get a read-only view that leads with what would fail. People can also file requests from Claude through its own MCP server.

Next.jsReactTypeScriptPostgreSQLPrismaTailwind CSSTerraformDockerGitHub ActionsClaude

Compliance program

ISO 27001:2022 controls

  • A.5.172-step verification is on for every accountfrom Google WorkspaceNot checked yet
  • A.8.24Every laptop has disk encryption onfrom JamfNot checked yet
  • A.8.8Macs run a macOS Apple still patchesfrom JamfNot checked yet
  • A.5.18Access is reviewed every quarterfrom Access reviewsNot checked yet
  • A.5.1Everyone accepted the security policyfrom PoliciesNot checked yet
Proven today0%

Interactive. Press the button to run the checks.

762
commits, 752 mine
162
production releases
121
database tables
152
API endpoints
466
test files
165k
lines of TypeScript

How it fits together

Follow the blue dot: one request on its way through the system.

People

Employees

requests, policies, training

Compliance team

controls, reviews, evidence

Claude

MCP with personal API keys

Next.js 16 app

Auth gate

Cognito sessions, MFA wall

Service layer

one rule set per domain

RBAC engine

capabilities and resource grants

Data and jobs

PostgreSQL

121 tables via Prisma

Nightly sweeps

checks, digests, integrity

S3, SES, Secrets Manager

files, email, credentials

Integrations

Google Workspace

MFA and account checks

Jamf

FileVault, macOS, check-ins

Sophos

device coverage, alerts

What it does

  • Access requests

    Multi-stage approval chains, permalinks, evidence with due dates, risk ratings.

  • Custom request types

    Owner-built forms and approval chains on one request engine.

  • Policy document control

    Parallel reviewers and an approver, signed in turn, with version history.

  • Acknowledgements

    Re-attestation cycles with append-only acceptance history.

  • Frameworks and controls

    ISO 27001:2022, 100 requirements, Statement of Applicability, evidence review.

  • Automated checks

    Nightly tests against Google Workspace, Jamf and Sophos, adopted per control.

  • Access reviews

    Quarterly recertification: keep, revoke, reduce or except, signed off as evidence.

  • Audit view

    Leads with defect counts, treats unknown as its own severity, minimises personal data.

  • Asset register

    Lifecycle, Jamf sync, end-of-life risk assessments, QR stickers.

  • Exercises and CAPA

    Tabletops and DR drills, corrective actions, approver-decided risk acceptance.

  • Compliance schedule

    Regulatory calendar with reminder ladders, participants and findings.

  • Training and campaigns

    Versioned modules with quizzes; one email per campaign, not per item.

Engineering decisions

One service per domain

Every authorization rule lives in a single service file. The web routes and the AI tools are thin adapters over it, so Claude cannot bypass a rule the UI enforces.

AI integration that cannot do harm

Seven read tools and one create tool, no approve tool. User-written text reaches the model marked as untrusted, and API keys are HMAC-hashed with a dedicated pepper.

One security wall, fail-closed

MFA and password-expiry enforcement lives in one module that every page, API and admin route passes through. A test lists every file allowed to bypass it.

History is append-only

Accepting v3 of a policy adds a row instead of overwriting v2, so the proof an auditor needs is never erased.

Status is derived, never stored

Control status and whose turn it is in an approval chain are computed on read, from one pure function shared by the page, the inbox and the nightly chase.

Guard tests as architecture

Source-scanning tests pin route guards, PII minimisation, safe secret deletion, CSV-injection safety and email escaping.

Most of my work lives in private company repositories. These are the totals.

2,640
GitHub contributions since January 2025
1,577
commits in the last twelve months

Every day, October 2025 to October 2026

Busiest day, ringed in blue: 98 commits on 23 Sept 2026.LessMore

Commits counted from EximPe repositories, October 2025 to October 2026. Contribution totals are from my GitHub profile with private work included: 1,034 in 2025 and 1,606 in 2026 so far.

Where the commits went

  • eximpe.com

    909 commits since Apr 2025

    The company website: Next.js, Supabase, Ghost CMS, 126 pages, five free tools, Chinese, Japanese and Korean editions.

  • Compliance Toolkit

    836 commits since Jul 2026

    ISO 27001 console that replaced Sprinto and ClickUp.

  • DLP

    231 commits since Jul 2026

    Swift agent, Chrome extension and admin console.

  • Production infrastructure

    28 commits since Aug 2026

    Terraform for the toolkit's isolated AWS account.

  • Team Claude skills

    10 commits since Sep 2026

    Skills that file compliance requests from a chat.

Earlier side projects

GitHub (work)GitHub (personal)

3+ years full-time across product, web, growth and security, plus freelance client work.

  1. Jul 2024 to now2 yrs 4 mos

    EximPe

    Product Development & Marketing

    Bangalore, full-time

    An RBI-licensed cross-border payments company. I own the website and its growth, designed and built the company's internal compliance and security products, and run its IT.

    100×
    organic traffic
    500+
    qualified leads
    2,640
    GitHub contributions
    162
    toolkit releases

    Website and growth

    • Moved eximpe.com from WordPress to Vite to Next.js on my own, keeping search rankings with about 260 managed redirects.
    • Grew daily organic traffic from 10 to 15 visitors to about 2,000 with SEO-led content, comparison pages and four language editions.
    • Built six free trade tools, including an HSN finder with about 19,000 programmatic pages generated from government tariff data.
    • Built the lead pipeline behind 500+ qualified leads: validated forms, AES-256-GCM field encryption, sales alerts and a one-click follow-up.
    • Made the site readable by AI answer engines with llms.txt, structured data on about 39 page types and a grounded Ask AI feature.

    Compliance and security products

    • Designed and built the EximPe Compliance Toolkit, which replaced Sprinto and ClickUp and runs the company's ISO 27001:2022 programme: 121 tables, 152 API endpoints, 162 production releases.
    • Built EximPe DLP: a Swift macOS agent, a Chrome extension and an SMTP gateway sharing one detection engine with real checksums.
    • Wrote the MCP server and Claude skills that let anyone at EximPe file a compliance request from a chat, with no ability to approve one.
    • Set up the AWS infrastructure in Terraform: ECS Fargate, RDS, Cognito, S3 and SES, deployed from GitHub Actions with OIDC and no stored keys.

    IT and operations

    • Run the company's Mac fleet on Jamf: enrolment, configuration profiles, FileVault, patching and self-healing agents.
    • Manage endpoint security on Sophos and Google Workspace administration, including quarterly access reviews.

    Marketing

    • Planned and ran Google and Meta ad campaigns, with creatives cut in After Effects.
    • Automated content and lead workflows with Make.com and Relay.app.
    Next.jsTypeScriptPostgreSQLPrismaSupabaseSwiftTerraformDockerGitHub ActionsGoogle AdsMetaClaude

  2. Alongside full-time work5 live sites

    Freelance

    Web designer and developer

    Remote

    Websites for agencies, a SaaS product and a fashion label, designed and built end to end.

    Selected clients

    • Markenza, a Marathi influencer marketing agency: full company site and the blog backend the team publishes from.
    • Media Vantage, a Mumbai entertainment company: a type-led site for celebrity campaigns and brand IP.
    • Pyrelo, a work dashboard for Indian teams: product site, pricing, demo flow and a library of free tools.
    • Triqio, an activewear label: e-commerce storefront with collections, product pages and a studio edit.
    Next.jsReactTailwind CSSFigmaVercel

  3. Jan to Jul 20247 mos

    Alme App

    Full Stack Developer

    Bangalore

    Full-stack work across the product's web properties.

    What I did

    • Built and maintained features across Laravel, PHP, WordPress and Next.js.
    • Worked on backend logic, CMS customisation and frontend performance.
    LaravelWordPressNext.js

  4. Jan to Aug 20238 mos

    Shubhchintak Technology

    Frontend Developer

    Remote

    Frontend work on a React application.

    What I did

    • Turned designs into reusable React and Tailwind components.
    • Made the app faster and more consistent across devices.
    ReactTailwind CSS

  5. B.Tech, Computer Science & Engineering

    Graduated 2023

Capabilities

Build

  • Next.js
  • React
  • TypeScript
  • Tailwind CSS
  • PostgreSQL & Prisma
  • Supabase
  • Laravel & PHP
  • WordPress & Ghost
  • Swift (macOS agents)
  • Chrome extensions
  • MCP servers
  • Claude skills

Ship

  • AWS ECS Fargate
  • Terraform
  • Docker
  • GitHub Actions
  • Cognito
  • Secrets Manager
  • SES

Grow

  • SEO & content
  • Google Ads
  • Meta Ads
  • Conversion tracking
  • Make.com
  • Relay.app
  • After Effects creatives

Secure

  • ISO 27001
  • Jamf MDM
  • Sophos Endpoint
  • Google Workspace admin
  • Access reviews
  • Data loss prevention