Curriculum Vitae

Professional summary

Full-stack software engineer, strongest on the frontend, with ~2.5 years shipping production systems for a hospitality software company. I lead the page-by-page migration of a multi-tenant management SaaS from legacy Razor / jQuery to React 19, and own an e-commerce platform's payment, kiosk and marketplace surfaces end-to-end — including an exactly-once Nexi payment flow over a non-idempotent downstream.

Now: At Sibylla I lead the page-by-page React 19 migration of a multi-tenant hospitality SaaS (Portal) and own the e-commerce platform's payment, kiosk and marketplace surfaces (Network) — including an exactly-once Nexi flow over a non-idempotent downstream — while running the team's AI-augmented engineering workflow on Claude Code.

Impact highlights

• Exactly-once Nexi payment flow

  Beforea non-idempotent downstream booking system risked double bookings and lost confirmations on retransmitted gateway callbacks.

  Aftera local payment-lock keyed by a unique transaction code and a MediatR state machine (pending → nexi_paid → confirmed | failed) that no-ops on replays, plus a guard against silent "HTTP 200 but failed" responses.

  Resultno payment confirmed without a real booking; double bookings and lost confirmations eliminated.

• React 19 frontend as three independent SPAs

  Beforethe rebuilt e-commerce platform needed marketplace, kiosk and quote-landing surfaces owned end-to-end.

  Afterthree SPAs on Redux Toolkit + RTK Query with a single-flight 401-refresh auth layer, a ports-and-adapters payment architecture (Nexi / wallet / discount behind one interface), and react-hook-form + Zod over legacy payloads.

  Resultprincipal contributor and top author by commit volume; booking, cart, checkout, wallet and account from zero to production.

• Multi-tenant SaaS migration without a big-bang rewrite

  Beforea multi-tenant hospitality-management SaaS was locked in legacy ASP.NET MVC / Razor / jQuery.

  Aftera page-by-page React 19 migration mounted behind a backend-for-frontend, with a route manifest deciding per page whether to SPA-navigate or full-reload.

  Resultpages move incrementally with no big-bang rewrite; deploy pipeline hardened against stale frontend bundles.

• Security & tenancy audit (IDOR + CSRF)

  Beforemulti-tenant data isolation and CSRF handling had not been adversarially reviewed.

  Afterled a security and tenancy audit, filtering the tenant claim on the row (not via a parent join) and reviewing the request path end-to-end.

  Resultsurfaced cross-tenant access (IDOR) and an issued-but-never-validated CSRF token, among other findings.

• AI-augmented engineering framework (Claude Code)

  BeforeAI-assisted migration was ad-hoc and risked unbounded blast radius.

  Afterper-layer instruction files, narrow tool-scoped specialist subagents, an orchestration skill that classifies a task and injects the right invariants, and a plan-first process where a human approves before anything mutates.

  Resulta repeatable migration pipeline; read-only review subagents surfaced three latent payment-flow bugs before release.

Selected projects