Product previewView full size
Multi-branch food delivery system with customer, rider, kitchen and HQ portals plus native mobile apps
01 / 08
Why Serveo App
What makes it better
than the alternatives
- 01
Five surfaces, one codebase
Customer and rider PWAs, branch kitchen screen, HQ console, and table QR ordering all share one ASP.NET Core backend and SQL Server database
- 02
Real-time everything
SignalR broadcasts order status changes, rider positions, and kitchen updates to all connected surfaces with automatic group scoping by branch
- 03
Row-level security at database
SQL Server security policies enforce branch isolation so queries automatically filter to the signed-in user's scope without application code
- 04
Demo mode with time travel
Clock abstraction and rider simulation let prospects advance time, trigger scheduled pricing changes, and watch synthetic deliveries complete in minutes
- 05
Audit-ready from day one
Append-only ledger table records every order state change with cryptographic hash chain; temporal tables track menu and pricing history
Customer Experience
- Progressive web app with offline support and install prompts
- Flutter native mobile app (iOS/Android) using same API
- Menu browsing with search
- categories
- dietary filters and item photos
- Real-time order tracking with live rider location on map
- Guest checkout or phone OTP sign-in (Google/Apple sign-in wired)
- Address book with serviceability check before cart build
- Promo code validation with single-use and per-customer limits
- Rating and review system with photo upload
- Order history with reorder and invoice download
- Multilingual UI (English/Arabic) with RTL layout
Delivery Operations
- Rider PWA and Flutter app with shift management
- Automatic assignment by distance to branch and drop-off
- Turn-by-turn navigation with polyline routes (Google Directions or seeded)
- Proof of delivery: photo capture and OTP verification
- Cash reconciliation with shift earnings report
- Live position broadcast during active trips (opt-in GPS)
- Pickup confirmation with order contents checklist
- Fare calculation with distance bands and time-based surge
- Rider performance metrics and trip history
Branch Portal
- Real-time order acceptance with audio alerts
- Kitchen display screen showing active orders by status
- Drag-and-drop order board (New → Preparing → Ready → Out)
- Per-branch menu and pricing management
- Operating hours with standard and holiday schedules
- Delivery zone editor with polygon drawing on map
- Branch-scoped reporting (sales
- items
- rider performance)
- Staff accounts with Kitchen and Manager roles
Head Office Console
- Multi-branch dashboard with live order counts and revenue
- Fleet map showing all active riders and their trips
- Operations board: assign riders
- cancel orders
- issue refunds
- Catalogue management: items
- categories
- modifiers
- pricing rules
- Promotional campaigns with time windows and usage limits
- Staff and rider account management with role-based permissions
- Audit log viewer with order state history and ledger verification
- Demo controls: advance time
- simulate riders
- reset platform
- Call centre view with customer lookup and phone order placement
- Analytics: sales trends
- popular items
- zone performance
Menu & Pricing
- Per-branch item availability and pricing
- Category hierarchy with display order
- Item modifiers (size
- extras
- removals) with price adjustments
- Dietary tags (vegetarian
- vegan
- gluten-free
- halal)
- Time-based pricing rules (lunch specials
- happy hour)
- Minimum order enforcement per delivery zone
- Dynamic delivery fees by zone and distance
- Service fee and VAT calculation
- Tip suggestions with custom amount option
Authentication & Access Control
- Customer: phone OTP
- Google sign-in
- Apple sign-in (wired)
- guest checkout
- Staff: username/password with lockout after 5 failures
- Passkey support for returning customers (web demo)
- Two cookie schemes (staff and app) for surface isolation
- Role-based permissions: Admin
- Ops
- Finance
- Kitchen
- Rider
- Per-action permission checks via RequirePermission attribute
- Mandatory password change on first staff sign-in
- Password policy: 16+ chars
- upper/lower/digit/symbol required
- Row-level security: branch staff see only their branch data
Real-Time & Notifications
- SignalR hub with automatic group joins by branch and role
- Order status broadcasts to customer
- kitchen and HQ
- Rider position updates every 2-5 seconds during trips
- Kitchen alerts for new orders with audio notification
- Push notifications for order updates (web and mobile)
- Live fleet map updates for operations team
- Chat system for customer support (wired
- UI present)
- Connection state management with automatic reconnection
Reporting & Analytics
- Sales dashboard: today/week/month with trend graphs
- Popular items report by branch and time period
- Rider earnings and trip count summaries
- Delivery zone performance (order volume
- average value)
- Promo code usage and discount totals
- Customer acquisition and retention metrics
- Invoice generation with VAT breakdown
- Audit log export for compliance
- Catering enquiry pipeline report
Catering & Custom Orders
- Multi-step enquiry form with head count and event details
- Server-side quote calculation from head count (no client pricing)
- Package options (bronze/silver/gold) with per-person rates
- Dietary requirement capture and special requests
- Lead time enforcement (minimum 48 hours notice)
- Deposit calculation as percentage of quote
- Enquiry routing to branch that would fulfill
- Status tracking: Enquiry → Quoted → Confirmed → Completed
Platform Administration
- Database schema creation and seeding via DbInitializer
- Configuration validation on startup (connection string
- secrets)
- Rate limiting per endpoint (auth
- pricing
- promo validation)
- Request audit logging with correlation IDs
- Health checks for database and SignalR hub
- Docker Compose deployment with SQL Server container
- Environment-based configuration (Development/Production)
- Secrets management via environment variables or gitignored files
- Structured logging with Serilog integration ready
- Smoke test suite covering all surfaces and API endpoints
Languages & stack✓ Verified from the source · 53,172 lines of code
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| Dart | — | — | Mobile app | 26.6% |
| C# | — | — | Web, API, admin | 24.6% |
| JavaScript | — | — | Front-end | 22.4% |
| SQL | — | — | Database | 12.9% |
| C# (Razor) | — | — | Web pages | 8% |
| CSS | — | — | Styling | 5% |
| Swift | — | — | Mobile app | 0.1% |
| Java | — | — | API | 0.1% |
| Shell | — | — | Scripts | 0.1% |
| HTML | — | — | Front-end | 0.1% |
| Kotlin | — | — | Mobile app | 0% |
- Primary language
- C# 12 (.NET 9)
- Framework
- ASP.NET Core 9 MVC + Flutter 3.24
- Database
- SQL Server 2022
- Authentication
- Cookie (staff + customer), OTP, Passkey, Google OAuth
- Licence
- Single-site
- Screens
- 47
- Database tables
- 60
- Supported languages
- English, Arabic (RTL)
- Browser support
- Chrome 90+, Safari 14+, Firefox 88+ (PWA)
| Minimum | Recommended | |
|---|---|---|
| CPU | 2 vCPU | 4 vCPU |
| RAM | 4 GB / 20 GB SSD | 8 GB / 50 GB SSD |
| OS | Windows Server 2019+ or Linux with .NET 9 SDK, SQL Server 2022 (Express/Standard/Developer) | Windows Server 2019+ or Linux with .NET 9 SDK, SQL Server 2022 (Express/Standard/Developer) |
| Est. monthly hosting | $45 | $45 |
```bash cp .env.example .env # Edit .env: set DB_PASSWORD, STAFF_PASSWORD, RESET_KEY (openssl rand -base64 32) docker-compose up -d # Open http://localhost:5080 ```
```bash # Install .NET 9 SDK + SQL Server 2022 wget https://packages.microsoft.com/config/ubuntu/22.04/packages-microsoft-prod.deb sudo dpkg -i packages-microsoft-prod.deb sudo apt update && sudo apt install -y dotnet-sdk-9.0 # Configure connection string in appsettings.Production.json cd backend/src/RoyexBites.Web export ConnectionStrings__Default="Server=localhost;Database=RoyexBites;User Id=serveo_app;Password=<generated>;Encrypt=true;TrustServerCertificate=false" export Demo__StaffPassword=$(openssl rand -base64 24) dotnet publish -c Release -o /var/www/serveo sudo systemctl enable serveo sudo systemctl start serveo ```
```bash az group create --name serveo-rg --location eastus az sql server create --name serveo-sql --resource-group serveo-rg --admin-user sqladmin --admin-password <generated> az sql db create --resource-group serveo-rg --server serveo-sql --name RoyexBites --service-objective S1 az webapp create --resource-group serveo-rg --plan serveo-plan --name serveo-app --runtime "DOTNET:9.0" az webapp config appsettings set --resource-group serveo-rg --name serveo-app --settings ConnectionStrings__Default="<connection-string>" Demo__StaffPassword="<generated>" cd backend/src/RoyexBites.Web dotnet publish -c Release az webapp deployment source config-zip --resource-group serveo-rg --name serveo-app --src publish.zip ```
```bash # Prerequisites: .NET 9 SDK, SQL Server 2022 (or Docker for SQL) # 1. Start SQL Server (Docker) docker run -e "ACCEPT_EULA=Y" -e "SA_PASSWORD=Dev-Only-Pass-1!" -p 1433:1433 -d mcr.microsoft.com/mssql/server:2022-latest # 2. Configure backend cd backend/src/RoyexBites.Web cp appsettings.Development.json.example appsettings.Development.json # Edit appsettings.Development.json: set ConnectionStrings.Default export Demo__StaffPassword="DevPassword123!" dotnet restore dotnet run # 3. Open http://localhost:5080 # Staff login: hq.admin / DevPassword123! (change on first login) # Customer: any phone → OTP shown on screen (demo mode) ```
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (4 minor)
Flutter lockfile present but .net backend has no lockfile; several outdated packages; database access is parameterized and scoped; minor schema gaps in foreign key indexes; significant code duplication, oversized files, and hard-coded values scattered across codebase; weak default credentials and demo passwords committed; no live secrets found; build reproducible with gaps: missing .net restore step, flutter setup incomplete, connection string unclear. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
1.0.0
First release12 Oct 2026✓ Reviewed & audited
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
