Shadoof - Feature Flag and Progressive Delivery Service for a Marketplace's Engineering Teams

Dashboard, flag list with quick view, flag detail with 6 tabs, change requests with the review panel, and kill switches with the engage and restore panel.

In Production the toggle and every targeting edit become a change request with a readable diff, raw JSON and an impact estimate. The requester can never approve their own change, and bulk approval is not allowed.

On-call engineers can engage a kill switch without prior approval, but only with a reason and an incident reference. The owning team must review the change within 24 hours.

Release, experiment, operational, kill switch and permission flags across 5 projects, with 16 change requests, 12 kill switches and 13 staff users in 7 teams.

Turning Off Meant Redeploying

Toggles lived in environment variables, a shared JSON file and if-statements in code. During an incident, switching a feature off meant a redeploy that took 20 to 40 minutes while buyers kept hitting the broken path.

Hundreds of Toggles Without Owners

About 600 "temporary" toggles had piled up. Nobody could say which were still in use, who had changed the checkout toggle before the last outage, or which buyers had seen the new payment sheet.

Rollouts That Must Stay Sticky

A partial rollout only works if the same buyer gets the same variation on every request and every server, and raising 10% to 25% only adds people. Without that, teams froze releases for weeks before every sale campaign.

No Evidence for Auditors

Auditors preparing for SOC 2 asked for proof that production changes were reviewed by someone other than the author, and there was none for configuration changes. Evaluation contexts also carry buyer and seller data under Egypt's Law No. 151 of 2020.