Maruf Sheikh
Developer • Creator • Problem Solver
Founder of Biznetrix
Building AI-powered ERP, SaaS, CRM & business automation systems.
Featured Works
Recent projects showcasing my skills.
Maruf Sheikh — Founder Portfolio + AI Automation
A founder-built personal platform that doubles as a live AI automation showcase — portfolio, blog, daily logbook, multi-language CMS, social CRM with OAuth, HITL review, and end-to-end Biznetrix ERP integration.
View Project →
Biznetrix SaaS Engine — Multi-Tenant Platform Hub
A production-capable multi-tenant SaaS engine — separate database, separate domain per tenant — that hosts every business module on one chassis. My main business control hub.
View Project →
SalesStock — Stock-Based Sales Platform
Lightweight stock, sales, and finance platform built for distributors, wholesalers, and trading businesses where purchase and sales prices are negotiable and every invoice can vary in price.
View Project →Latest Blog Posts
Thoughts and insights on web development.
Why I Built My Own Workflow Engine
In a world rife with complex workflow engines that often miss the mark, one developer shares their journey to create a custom workflow engine tailored to the unique needs of their PHP product. By focusing on simplicity and efficiency, this bespoke solution handles essential tasks like lead routing and AI replies without the overhead of traditional systems, proving that a lean, in-house engine can be the most effective choice for small-to-medium businesses. Discover the insights and lessons learned from building a streamlined workflow engine that integrates seamlessly into existing codebases and processes.
Read More →
Designing AI-Powered CRM Systems — A Layered Architecture
In the quest to create truly AI-powered CRM systems, it's crucial to move beyond superficial features and adopt a layered architectural approach. This article outlines how an integrated AI framework, grounded in robust data management and observable AI services, can transform CRM functionalities—from lead handling to customer interactions—into a seamless, trustworthy experience that enriches every operational decision without sacrificing human oversight. By focusing on foundational elements and clear design commitments, businesses can unlock the full potential of AI in their customer relationship management.
Read More →
AI Lead Scoring Architecture — What Actually Goes Into the Number
In the world of CRM, lead scoring often falls short due to lack of transparency and a reliance on oversimplified metrics. This article outlines a robust, multi-layered architecture for effective lead scoring that integrates deterministic rules, AI signals, and human oversight, ensuring each score is not just a number, but a well-documented, explainable assessment that truly prioritizes which leads should be contacted first. By emphasizing clarity and flexibility, this approach transforms lead scoring from a vanity metric into a trusted tool that sales teams can effectively use.
Read More →Latest Logbook Entries
Daily reflections and progress.
Social Publishing Fixed, SEO Overhaul — 40-File i18n Sprint
Two major threads shipped today. Social publishing fixes: Post scheduling was broken in three separate ways. First: scheduled times were being stored as local time instead of UTC — a 6-hour offset for the configured timezone. Second: the timezone was being read from the wrong settings key (dot notation versus underscore format). Third: token decryption was failing for every social account because an extra base64_decode() was applied to data that CodeIgniter's encrypter had already encoded — this caused an "authentication failed" error on every decrypt attempt. Fixed all three. Posts now schedule correctly, display in local time in the UI (database stores UTC, UI converts to app timezone), and publish to Facebook through the scheduled cron command. Added a timezone selector to Admin → General Settings so the app timezone is database-configurable, not hardcoded. Posts management page built with status filters, stats cards, and timezone-aware time display. 40-file SEO and i18n sprint: Complete overhaul of the public-facing frontend for technical SEO correctness, AIO readiness, and full 12-language internationalisation. Duplicate H1 fixed (navbar logo demoted from <h1> to styled <span>). noindex added to thin pages (search results, FAQ keyword mode). Canonical URL strips the ?lang= parameter so hreflang carries the language signal, not the canonical. BreadcrumbList JSON-LD on all content pages. FAQPage JSON-LD with HTML stripping and 20-item cap, eligible for Google FAQ rich results. Article JSON-LD with dateModified and mainEntityOfPage for rich article results. WebSite JSON-LD with SearchAction on homepage for Google Sitelinks Search Box. hreflang for all 12 language variants plus x-default on every page. og:locale mapped to correct locale format per active language. <html lang dir> dynamic per active CMS language. Language helper autoloaded in BaseController. KB article search covers all 11 translated title and content columns. Language switcher correctly appends lang parameter without duplicating. Migration adds 22 translation columns to KB articles (11 languages × 2 fields). Input sanitisation on search and FAQ query parameters with strip_tags and truncation before use in meta tags. Three new test files: 40 assertions covering SEO data contract, FAQ branching, and header variable logic.
OAuth Refactor — HMAC State, Instagram Fixed, 467 Tests Green
The existing OAuth implementation used database-backed state storage. Every cross-site redirect from Facebook or Instagram was losing the session because the browser's SameSite cookie policy drops the session cookie on the redirect back from the OAuth provider. After multiple attempts to fix session persistence (session save handlers, cookie flags, session restoration tricks), the conclusion was clear: database-backed state is the wrong architecture for this problem. Refactored to HMAC self-validating state tokens. State format encodes the platform and app identifier with an HMAC signature. No database lookup needed on callback — just re-compute the HMAC and compare. The callback routes are now public with HMAC validation instead of admin-protected routes requiring a live session. Session is restored after HMAC validation from the admin ID stored at connect time. Instagram Business token exchange was also corrected. It was hitting the Instagram Basic Display endpoint, which is wrong — Instagram Business accounts are linked to Facebook Pages and use Facebook's Graph API for token exchange. Changed the endpoint and it works correctly. API health check fixed: tokens are cleaned of whitespace before use in Authorization headers to prevent RFC 7230 header validation errors. WhatsApp webhook GET verification wired (Meta sends a GET challenge before starting POST delivery). Webhook signature filter skips validation for GET requests. All 467 tests passing, 2086 assertions, no errors. The test suite now covers HMAC state validation, token exchange for both platforms, account saving with encryption, session handling, and webhook verification.
CI Quality Gates, Ads ROI Integration, Social Post Creation, Meta Platform Setup
Four sessions today. Quality pipeline: GitHub Actions workflow now runs PHPStan, PHPUnit, Composer Audit, and Semgrep on every push. PHPStan bootstrap required a CI4 helper loading setup to make static analysis understand the framework magic. Repaired a feature-access path referencing a model that did not match the real schema. PHPUnit now runs without migration warnings. The CI gate is real. Multi-platform ads ROI: Meta Marketing API and Google Ads API both integrated for automated campaign performance sync. Hourly cron commands pull impressions, clicks, spend, conversions, and leads from both platforms into a unified table. Calculated metrics (CPC, CPM, CTR, ROAS, cost per lead) stored alongside raw numbers. Real-time Lead Ads webhook handler auto-creates leads with campaign attribution on form submission. Google Ads OAuth 2.0 flow with refresh token support. Cross-platform dashboard shows campaigns side by side. Social post creation and inbox: Full two-panel post creation UI with AI drafting (three variants: Short, Long, Hook+CTA), AI image generation, live character counter, auto-schedule suggestions. Inbox got manual reply flows for comments (modal with AI draft prefill) and DMs (messenger-style chat bubbles). The credential storage bug was fixed: API settings fields not containing "secret" or "token" in their name were being stored as plaintext but always decrypted on read, returning false and blanking OAuth credentials. Fixed by encrypting every API setting unconditionally on write with a raw-value fallback on decrypt. Meta platform configuration: Completed the full Meta Business App setup — marketing API wizard, system user access token generation, Instagram business account linked. Policy pages seeded for Meta App Review compliance including data deletion policy with GDPR and CCPA workflows. Ad account and business manager configured in API Settings. API status dashboard updated to reflect connection state.