System Overview

Code SCE is designed as a secure, distributed platform composed of client applications, a hardened Express API layer, PostgreSQL database, object storage for visual and code assets, and external integrations for crypto payments and social authentication.

System Components

1. Frontend Client Layer

• Modern Static Architecture: Pure HTML5, CSS3, and JavaScript adhering to the Code SCE design system (0px border-radius, monochrome contrast, responsive panels).
• Zero Build Dependency: Shared modules load via classic script inclusion attaching to window for reliable, low-overhead execution.
• Desktop Shell: An Electron companion wrapping the web client with native window frame controls, deep linking (codesce://), and OS-level file handling.

2. Backend API Services (Node.js & Express)

• Authentication & Account Linking (/auth/*, /api/auth/*): Supports Google & GitHub OAuth, interactive provider linking/unlinking in Security settings, and session token issuance.
• User & Onboarding Engine (/api/users/*, /api/profile/*): Manages the two-step profile completion lifecycle, unique handle reservation, and verified developer search (/api/users/search).
• Studio & Scanning Pipeline (/api/studio/*): Handles visual previews and documentation ingestion, executes automated security scanners (Semgrep, ESLint, dependency audits, NSFW moderation, Simhash deduplication), and persists schema configurations.
• Interactive Messaging Router (/api/messages/*): Powers direct peer-to-peer developer chat, conversation listing, unread counters, and thread history.
• Payment Verification Router (/api/payments/*): Creates NOWPayments invoices, tracks order state, and processes HMAC-SHA512 signed webhooks.
• Gated Secure Downloads (/api/modules/:id/download): Issues one-time, 60-second signed tokens and injects dynamic dual-layer watermarks.

3. Middleware & Security Infrastructure

• Helmet HTTP Security: Secures headers, prevents XSS, and enforces HSTS.
• Multi-Tier Rate Limiting: Global sliding window limits (150 req/15 min) and strict auth limiters.
• CWE-532 Redaction: Automatically scrubs authentication tokens, passwords, cookies, and payment secrets before logging.

4. Persistence & Storage

• PostgreSQL: System of record for users, sessions, module listings, dynamic config schemas, direct messages, transactions, and audit logs.
• Cloudflare R2: High-durability object storage partitioned into public CDN assets (screenshots, GIFs, READMEs) and private gated repositories (source code and interactive demos).
• Redis (Optional Fail-Open): Distributed store for rate-limit counters, fraud velocity metrics, and webhook idempotency locks.

Next Step

Explore the step-by-step lifecycles in Core Flows →.