ZLAN
Client work · LiveA vertical-drama streaming platform for Myanmar and Thailand, rebuilt end to end
Handed over by an outsourced vendor, compromised and down.
Six services rebuilt and shipping on a regular release cadence, at a tenth of the cloud bill.
The product
ZLAN is a short-drama streaming app for viewers in Myanmar and Thailand. Viewers unlock episodes with tickets, buy those tickets through local payment routes or the app stores, and watch vertical video on iOS and Android. Creators publish through their own portal and see what their titles earn.
I took engineering over from an outsourced vendor in April 2026. The handover was a Laravel application (the API and the admin dashboard in one codebase) and a Flutter mobile app. By then the API and dashboard had been compromised and the production database dropped, and the platform was down. There were no automated tests or checks and little protection against abuse, on a system that takes real money.
I own the platform end to end: architecture, delivery, security, infrastructure and cost.
What changed
Six pieces, over four months:
- Backend API. I wrote a new Go API from scratch, with PostgreSQL and Redis, and migrated off the Laravel backend onto it. It handles accounts, the catalogue, billing, rewards and playback.
- Mobile app. The Flutter app for iOS and Android came with the handover. Most of its code today was written after it, and it now ships with an automated test suite.
- Admin back-office. First on an off-the-shelf framework, to learn what the business needed, then replaced by a single Go service once the requirements were real.
- Creator portal where filmmakers see earnings, withdrawable balance and payout history.
- Marketing site in SvelteKit on Cloudflare.
- Video pipeline that turns uploads into encrypted adaptive streams.
How it is built
- One ledger for money. Two regional gateways plus Apple and Google billing all post to a single accounting ledger. Prices are decided on the server, never by the app.
- Playback is gated. Stream access is released only to genuine app installs, and the check denies by default.
- Small, boring services. The admin and creator portals are each one Go binary that serves both the API and its web app, so the two can never deploy out of step.
- Quality gates in the pipeline. The vendor handover had no usable tests. Automated checks now run on every change, so standards hold without reading every diff.
- Reversible migrations. Cloud cost fell by roughly 90% through a phased migration where every step could be undone.
Where to read more
The three hardest problems (money, video and trust) are written up in Four Payment Routes, One Ledger. I also use DoneWhen, my own open-source tracker, to plan and review the AI-assisted work on this platform.