Fullstack software engineer. I build scalable backends and secure authentication.

Problem

Customer and conversation lookups could return another tenant's records, and a channel resync endpoint lacked a role check.

What I did

Scoped every lookup by tenant and enforced role-based access on the resync endpoint.

Employer-confidential, no public link.

Problem

Chat clients silently missed messages that arrived while their socket was disconnected.

What I did

Resynced the missed data after each socket reconnect.

Employer-confidential, no public link.

Problem

Messaging platforms returned payloads that differed from what the integration assumed, so messages mapped wrongly.

What I did

Typed the real payloads, mapped message types and API errors explicitly, and synced customer tags into CRM profiles.

Employer-confidential, no public link.

Problem

Bulk actions had no upper bound, and a cached channel stayed bound to its old tenant after being relinked.

What I did

Capped bulk deletes per request, moved the logic into the service layer, and invalidated the channel cache on relink.

Employer-confidential, no public link.

Problem

AI coding agents can push failing code, or edit the file that sets their own limits.

What I did

Built a push gate that denies on failing checks, and moved the direct-to-main opt-out out of repo files an agent can edit into user-owned config.

Result

Denied on red A push on a failing check is blocked, and a marker file in the repo no longer disables the gate.

Proof: PR #100

Problem

An optional Google Drive backup could upload secrets or trust a forged sign-in redirect.

What I did

Used the least-privilege drive.file scope, withheld credential-looking files from upload, and accepted only the OAuth redirect that carries our state.

Result

Least-privilege scope drive.file only, credential-looking files withheld, and the OAuth redirect accepted only with our state.

Proof: PR #97

Problem

An older version of a tool should not write to a database a newer version created.

What I did

Stamped the SQLite schema version, made the CLI refuse a newer database, and added a doctor command that reports install version and declared gates.

Result

Refuses newer schema The refusal is tested, and the doctor output is machine-readable.

Proof: PR #98

Problem

Marketplace and point-of-sale orders and stock had to stay in sync, and a failed call must not duplicate or lose an order.

What I did

Contributed to order and stock sync between marketplaces and point-of-sale on a retail ERP, as a 3-month backend intern; implemented retries and idempotency.

Employer-confidential, no public link.