A Whistleblowing System: One-Week Prototype in Next.js + Prisma, Then Launched as PM-Led Delivery

What changed

• Prototype delivered
  A working build shown in one week
• Effort
  About 5 person-months to release
• Team
  1 developer + a team of about 10

Challenge

A whistleblowing system has to fully protect the anonymity of the reporter while routing each report only to the right handler through a well-defined escalation flow. Who can see which report, at what stage anyone gets notified, how the logs are kept — unless these are nailed down at the design level, the trustworthiness of the service itself is at stake. Speed was also a requirement: with a single developer supported by a PM, the client wanted to get something working out early and bring stakeholders on board.

Approach

1. 01 Mapped the lifecycle of a report and its roles (reporter, intake, handler, administrator)
2. 02 Built a prototype in one week with Next.js (App Router) + Prisma and put a working build in front of stakeholders
3. 03 After the prototype, refined it step by step while incorporating feedback
4. 04 Took on requirements, prioritization, and delivery management as PM so the single developer could stay focused
5. 05 Implemented the authentication flow with NextAuth and built in role-based access control
6. 06 Set up secure email notifications (escalation) with Resend and error monitoring with Sentry

Key success factors

The impact of a one-week prototype

Getting a working build out early shifted stakeholder discussion from the abstract to something concrete.

PM-led delivery support

Even with a single developer, separating requirements, prioritization, and delivery management kept implementation focused.

Rigorous role design

By clearly separating the four roles — reporter, intake, handler, administrator — we secured the permission boundaries at the design level.

A modern stack choice

A full-stack combination of Next.js App Router + Prisma + NextAuth balanced development speed with maintainability.

Solution

We built it as a full-stack application on Next.js + Prisma + NextAuth, shaped a working prototype in one week, and reached release in about five person-months. The PM focused on requirements and delivery management so the developer could concentrate on implementation. We stood it up as a foundation that keeps its momentum while balancing reporter anonymity with a clear escalation flow.