Lead the backend of the biggest Web3 security competition, building systems that handled thousands of concurrent participants under real attack conditions.
Owned the entire backend for Remedy CTF on r.xyz — the largest Web3 CTF to date. Designed challenge infrastructure, managed real-time state, and kept the platform stable under adversarial load from global security researchers.
Built the product full-stack, including a custom ClickHouse layer that queries 200M+ smart contracts in milliseconds.
End-to-end delivery for Token Risks API — high-throughput on-chain analysis and a public playground for security teams to explore contract risk at scale.
Designed a reusable, modular microservices system in Go — auth, file upload, events, API gateway, email — deployable independently or as a stack.
Built each service to be self-contained and plug-and-play via a shared platform package. Includes event analytics and JWT fingerprint auth to prevent token sidejacking.
Solved a real security gap in JWT auth: protecting the token refresh endpoint against XSS — something most articles skip entirely.
Implemented the OWASP JWT Fingerprint pattern in Python/Django and published a detailed breakdown on Medium — covering the refresh endpoint gap that nobody else addressed.