Multi-Site Affiliate Content Engine

The goal was to build a system capable of running several Amazon-affiliate niche sites from a single codebase, without ever letting AI-generated content publish unsupervised, and without breaking the strict rules of the Amazon Associates program (no rewriting product descriptions, no modifying product images, no affiliate links in emails). The technical challenge was compounded by a governance one: guaranteeing that no low-quality, hallucinated, or non-compliant content could slip through the publishing pipeline without genuine human review — not just a cosmetic safeguard.

Saad designed a multi-tenant headless CMS in Angular 19 SSR, where the same public-site codebase is deployed across 5 domains via different environment configs, each isolated by a shared site_id column across one read-only public API and one authenticated admin API (JWT, HttpOnly cookies, CSRF). Content follows a strict pipeline:

• topic idea sourced from real keyword data
• AI-drafted article (Gemini, Groq, Mistral)
• automated humanization pass
• automated content-quality gate
• mandatory manual approval in the admin dashboard before publishing

A dated internal security and quality audit found and fixed 3 release-blocking issues before any wider rollout: a fully bypassable content-quality gate, a bug that silently un-rejected failed AI content back into the publish queue, and a stored-XSS risk from unsanitized AI-generated HTML — plus 11 high-severity issues. The audit turned an instinct ("AI-generated content needs its own trust boundary") into explicit engineering rules, documented and enforced in code.

The stack embraces deliberate minimalism: no Redis, no Docker, no backend TypeScript, no ORM — plain JavaScript and the raw mysql2 driver on MySQL 8. Two separate Express backends split the public and admin surfaces; a full SEO subsystem handles SSR, JSON-LD, hreflang, sitemaps, and integrates directly with the Google Search Console API and IndexNow for faster indexing. Product data comes exclusively from Amazon's official Product Advertising API (OAuth2), never scraping.