What happened to the small-business website?

Slow pages, stale content, and owners locked out of their own site. I’ve been fixing that.

See the work

Meet
Brayden

I build and run production marketing sites end to end, from content modeling and components through deployment, performance and the tools people use to update them. Most of it runs on Cloudflare in strict TypeScript.

For nine years I’ve worked as a maintenance technician on an injection-molding floor, where downtime costs money by the minute. I bring the same habits to software: find the root cause, check the fix under real load, and add a check so it stays fixed.

One little
portfolio.

Real projects for real businesses, most of them live today. Open any card to see what made it hard.

04 Personal tool

Ops Tasks PWA

A mobile task app built in Next.js 14 and React. You type a rough idea, an agent turns it into structured tasks, and the app installs to the home screen.

What made it hard

Model output is never trusted as state. Replies end in fenced JSON blocks that the client parses, checks field by field against enums and then applies. The API key stays server side behind an edge route, and I got next-on-pages running on Cloudflare after pinning around a version mismatch.

  • Next.js 14
  • React 18
  • Edge runtime
  • PWA / service worker
  • Cloudflare Pages
05 Kalama Silvas

Wix to Cloudflare migration

Rebuilt a hospitality design and procurement firm’s site as a static build on Cloudflare Pages, moved the domain off Wix with 301s for every old URL, and set up Search Console.

What made it hard

After launch, a duplicate preview domain was fully indexed and an iframed brochure gave Google credit to the wrong URL. I found it with URL Inspection, then fixed it with noindex headers, a proper URL for the brochure, and a verified property so the removal would stick.

  • Cloudflare Pages
  • Static HTML/CSS
  • Search Console
  • Redirects
06 SEO Ops

Secrets vault + MCP server

An AES-GCM encrypted secrets vault on Workers KV with a remote MCP server in front, so AI tools can fetch a credential without me pasting it into chat.

What made it hard

Access is scoped by the password you use at the OAuth consent step. A contractor’s scope only sees secrets tagged for them (default deny, even for direct ID lookups). A new tier is one Worker secret, not a code change, and repeated bad passwords trigger an IP lockout.

  • Workers
  • KV
  • OAuth 2.1 / DCR
  • MCP
  • WebCrypto
07 Midnight Services

Shared SMS + call inbox

Replaced a CRM’s conversations tab for a hauling company. Threads, web push, delivery status, lead assignment and one timeline of calls and texts, plus a ring chain that tries each person for 10 seconds before a voice screener picks up.

What made it hard

It exists to enforce one rule: never contact a lead twice. Whoever answers a call claims the thread without stealing an existing owner, and a banner shows who spoke to the customer and how long ago.

  • Workers
  • D1
  • Twilio
  • Web Push
  • ElevenLabs
08 The Learner

Crew agent console

A self-hosted console for named AI agents that I can DM, pull into group chats, send off on background tasks or schedule on cron.

What made it hard

Long jobs survive failures. Each step checkpoints to D1, stale leases get requeued, and the cron pass repairs jobs that a database hiccup dropped. It has zero npm dependencies.

  • Workers
  • D1
  • Cron Triggers
  • Anthropic API
09 PL Pages

plp-outbound

Outbound call dispatch with signed webhooks, calling-window and attempt-limit gating, a concurrency cap, and Airtable sync every 5 minutes.

What made it hard

The webhooks use HMAC with replay protection, so a captured request cannot be sent again, and a 40-test Vitest suite covers the gating logic.

  • TypeScript
  • Workers
  • D1
  • Vitest

Scope

01Find the real ask behind the request

Build

02Components, content model, then pages

Ship

03Deploy, then smoke-test production

Measure

04LCP, INP, CLS, and what editors feel

Fix

05Root cause first, then a check so it stays fixed

Quality is built right in

  1. 1. Guardrails before magic

    Anything a non-engineer can trigger gets server-side validation, reversible deletes and an activity log. The model or the editor is never the security boundary.

  2. 2. Measure, don’t guess

    Core Web Vitals, live DOM measurements at real breakpoints, and Search Console data decide what gets fixed next.

  3. 3. Checks that block the build

    If a mistake can happen twice, a check goes into the build that fails it. Validators, copy linting and tests all block the deploy.

  4. 4. I can explain every line

    I build with Claude Code every day. I read and question what it writes, and I push back when it’s wrong.

Brayden with his partner and two young sons
Why this matters to me

Built by a dad of two.

Screens usually pull my boys onto the couch. I’d love to spend my days on a product that gets them off it, and on the website that makes families want to try it.

Read the resume