Backend & Full Stack Developer · Python · Application Security
Software developer with 3+ years of freelance experience shipping web, mobile and SaaS products for clients in Argentina and the United States. I build APIs and full stack applications with Python, FastAPI, Django, TypeScript and React, and I have released native apps to Google Play and the App Store.
I bring a security mindset to everything I build: authentication, authorization, multi-tenant isolation and secure APIs. In parallel I train in offensive security (Hack The Box, Hack4u) and publish security tooling and proof-of-concepts for authorized environments.
📍 Buenos Aires, Argentina · 🌎 Remote / hybrid · 🗣️ Spanish (native), English (B1 spoken, B2 reading/writing)
Open to: Backend / Python developer · Full stack developer · IT support · Security analyst / AppSec
| Product | What it is | Stack |
|---|---|---|
| Fix! | Service marketplace — native apps live on App Store & Google Play | Swift, Kotlin, Firebase, APNs/FCM, Mercado Pago |
| RACE.COM | Client app for motorsport scales, live on Google Play | Kotlin, Bluetooth Low Energy (GATT) |
| Oops | Mobile app live on Google Play | TypeScript |
| Spotter Route Planner | Logistics planner for a US client: routing, maps, HOS daily logs | Python, Django REST, React, Leaflet, Vitest |
| Vulnex | SaaS for breach exposure, leaked credentials and typosquatting monitoring | TypeScript, PostgreSQL, external APIs |
| Vandal Health | Multi-tenant clinical management SaaS | Next.js, PostgreSQL/Supabase, RBAC, Row Level Security |
| Healthcare Interoperability API | Backend for exchanging sensitive clinical data between systems | Python, OAuth2 Client Credentials, JWT, tenant isolation, Redis rate limiting, security tests |
| ARGOS (in development) | Desktop cyber threat intelligence platform: OSINT collection, threat actors, entity graphs and intelligence reports — offline-capable, encrypted local storage | Tauri 2, React/TypeScript, Python, SQLite/SQLCipher, NetworkX |
| Lightmoon | Social platform with OAuth, posts, comments and reactions | Python, Flask |
Most product and client source code is private (client confidentiality / commercial products). Happy to walk through architecture and code in an interview.
| Backend | Python, FastAPI, Django / DRF, Flask, REST APIs, OAuth2, JWT |
| Frontend | TypeScript, React, Next.js |
| Mobile | Kotlin (Android), Swift (iOS), Firebase |
| Data & infra | PostgreSQL, Supabase, Redis, Docker, Nginx, Cloudflare, Vercel |
| Systems | Linux (Kali, Debian), Bash, networking, macOS |
| Security | Web & API security, OWASP Top 10, pentesting, Active Directory, DFIR basics |
| Project | Description |
|---|---|
| Luna | Modular REST API security scanner: IDOR, auth, SQLi, XSS, HTTPS — JSON reports and unit tests |
| Vandal | Web scanner: reflected XSS, SQLi, security headers, subdomains, Wayback URLs |
| Astral Sniffer | Packet capture and traffic analysis with Scapy, PCAP/CSV/JSON export |
| Good Luck | Multithreaded SYN/TCP/UDP port scanner with banner grabbing |
| Pentest Reports | Pentest report templates: OWASP, PTES, CVSS v3.1 |
| Project | Focus |
|---|---|
| CVE-2026-4480 — Samba | Unauthenticated command injection via print job substitution |
| CVE-2026-3888 — snap-confine | Local privilege escalation via race condition |
| AD CS ESC1 | Active Directory certificate template abuse |
| PyYAML → AWS CodeBuild escape | Unsafe deserialization + container escape |
| Gitea/Gogs symlink → RCE | .git/config poisoning through the contents API |
| SOAP/WCF XXE | Out-of-band XXE and server-side file disclosure |
| SQLi detection over NTLM | Error-based SQL injection detection on NTLM-authenticated endpoints |
- Hack The Box: Pro Hacker rank · 37 machines · 41 challenges · 12 Sherlocks (incl. Hard: Garfield, Nimbus, Ghostlink, Checkpoint, Snapped)
- Hack4u: Ethical Hacking · Offensive Python · Linux · Professional Linux environments
Security tools and proof-of-concepts are intended exclusively for authorized testing, research and education.