KarobarX
Startup · Live in Production

KarobarX

The Unified Social-Commerce Protocol for Pakistan

Trust-first, all-category commerce platform. Think OLX with a zero-scam guarantee, a TikTok-style discovery feed, and a student ecosystem — all running on zero-cost infrastructure.

Live AppSecurity PolicyContact
VISION

Built in Karachi, for Pakistan

Millions of rupees change hands daily in Pakistan through unverified, risky deals. Small entrepreneurs, mechanics, students, and homemakers are either excluded from digital commerce or forced to accept scams as a cost of doing business.

KarobarX exists to formalise the informal. A free, privacy-first, trust-guaranteed infrastructure that brings the street-smart merchants of Nazimabad, Saddar, and all of Karachi into a secure digital economy — without extracting their data, charging them fees, or treating them like products.

PLATFORM

What It Does

Four pillars. One protocol.

Trust Protocol

  • Handshake PIN — optional 6-digit delivery confirmation, no escrow, no platform liability
  • Ghost-Cart masked P2P chat — phone numbers never exposed until both parties agree
  • CNIC Verification — manual admin review for high-risk categories (vehicles, bulk)
  • Karobar Score — dynamic reputation from completed transactions, account age, CNIC status
  • Privacy Mode — 30-day auto-purge of chat logs and transaction history via scheduled function

Commerce Engine

  • Structured listing metadata — condition, warranty, authenticity, price type, geotag
  • Hyper-local "Nearby Now" — bounding box + Haversine distance, default 2km radius
  • All-category taxonomy — Consumer Goods, Vehicles, Real Estate, Food & Agriculture, Industrial, Medical
  • Delivery flow — buyer requests, seller accepts, InDrive/Yango/Bykea booking, no platform liability
  • Manual listing verification — every listing admin-approved before going live

Discovery & Engagement

  • TikTok-style Reel Feed — 15s vertical MP4 videos, Cloudflare R2 storage, location + score curated
  • New Arrivals — auto-highlights listings from last 14 days filtered by user location
  • Optimised for 3G/4G — low bitrate MP4, no adaptive streaming dependency

Student Ecosystem

  • Study Graph — university, degree, courses; verified via .edu.pk or admin approval
  • Book Exchange — ISBN-based textbook lookup, filter by semester and course code
  • Student Alerts — instant notifications when matching listings go live
TECH STACK

Zero-Cost Infrastructure

Production-grade, zero hosting bill

Frontend

React 18 + TypeScript (Strict Mode) + Vite + Tailwind CSS v3 + shadcn/ui

Backend / DB

Supabase (PostgreSQL, Realtime, Auth PKCE, RLS on 40+ tables, 35+ functions)

Storage

Cloudflare R2 (images, videos, avatars) + Supabase Storage (CNIC docs, RLS protected)

Hosting

Cloudflare Pages (auto-deploy on push to main)

Mobile

Capacitor (Android APK + PWA)

Email

Resend API (warnings, admin broadcast, waitlist launch)

Maps / Geo

Bounding box + Haversine distance (jsonb lat/lng, no PostGIS)

Security

Cloudflare Turnstile, HttpOnly admin cookies, TOTP 2FA, immutable audit log, CSP headers

SECURITY

Built by a Security Researcher

EC-Council Hall of Fame · 9 vulns, 3 critical

KarobarX is built by a security researcher with EC-Council Hall of Fame recognition. Security is the foundation, not an afterthought.

PKCE auth flow — token leakage impossible
RLS on every table — users only access their own data
WITH CHECK on all UPDATE policies — prevents privilege escalation
Presigned R2 URLs — R2 credentials never touch the browser
Column-level security — sensitive columns (role, cnic_verified, is_banned) UPDATE revoked from users
Cloudflare Turnstile — replaced hCaptcha for better bot protection
HttpOnly cookies for admin — sessionStorage instead of localStorage
30-minute idle session timeout — automatic sign-out on inactivity
Immutable admin_audit_log — RLS: admin-only read, no UPDATE/DELETE
Stricter CSP on /admin/* — Referrer-Policy: no-referrer, no-cache headers

Vulnerability Disclosure Program: security@karobarx.pages.dev · Policy: karobarx.pages.dev/security

GET INVOLVED

Built with zero budget, maximum intent

KarobarX is open to contributors, security researchers, and anyone who believes commerce in Pakistan deserves better.

Visit karobarx.pages.devGet in Touch
Built in Karachi 🇵🇰