Fellipe Pavin

Software Engineer · Full Stack (TypeScript, React/Next.js, Node.js, .NET, Go)

fellipe306@gmail.com +55 85 99268-8102Fortaleza, Ceará, Brazil · Open to Remotepavin.me github.com/fap233 linkedin.com/in/fellipe-pavin

Summary

Full Stack Software Engineer with 9+ years of production experience owning the entire lifecycle: architecture, code, tests, CI/CD, deployment, monitoring, incident response and support. Founded and scaled a multi-tenant SaaS from zero to 10,000+ paying recurring users at 99.9% uptime as a single-person tech team. Since 2024, working as an independent engineer for B2B clients with 20+ engagements delivered across healthcare, real estate, tourism, e-commerce, entertainment and legal (marketplaces, SaaS platforms, dashboards, CRM automation, AI agents, security audits and production infrastructure). Core stack: TypeScript, React/Next.js and Node.js, with shipped production work in C#/.NET, PHP/Laravel and Python. Fluent English, remote-async by default.

Technical Skills

Languages: TypeScript / JavaScript, C# (.NET), PHP, Python, Go, SQL, Bash / PowerShell
Frontend: React 18/19, Next.js 14–16 (App Router, Server Actions), Blazor WebAssembly, Vue 3, Tailwind CSS, shadcn/ui, Vite, PWA / offline-first
Backend: Node.js (Express), Laravel, ASP.NET Core (EF Core), Flask / FastAPI, REST APIs, Supabase (Auth, RLS, Realtime), background jobs (BullMQ, cron, APScheduler)
Databases: PostgreSQL (PostGIS, RLS), MySQL / MariaDB, SQL Server, MongoDB, Redis, SQLite · Prisma, Drizzle, EF Core, Mongoose
DevOps & Infra: Docker, GitHub Actions (CI/CD), Linux (Ubuntu / Debian / Arch), Nginx, Cloudflare (WAF, CDN, APO), Vercel, AWS Lambda, DigitalOcean, Backblaze B2, 3-2-1 encrypted backups
Integrations: Stripe, Mercado Pago, Twilio, Zoho CRM, Mercado Livre API, WhatsApp (Evolution API), Telegram, Bunny.net (video/CDN), Google (GA4, Ads, Search Console), SMTP / Resend
AI & Automation: Claude API, OpenAI GPT, Gemini, AI agents, n8n, Chrome Extensions (MV3), web scraping (Playwright, BeautifulSoup)
Security: White/black-box audits, Supabase RLS review, LGPD compliance, Linux hardening, incident response & forensics
Data & BI: Power BI (dashboards, on-premises Gateway)
Practices: Clean Architecture, SOLID, TDD (Vitest, Playwright, RSpec), Code Review, Agile / Scrum
Languages (spoken): Portuguese (Native), English (Fluent)

Experience

Independent Software Engineer (Contract) · Self-Employed

January 2024 — Present · Fortaleza, Brazil · Remote

Delivered 20+ B2B engagements end-to-end (scoping, architecture, implementation, tests, deploy and support) across healthcare, real estate, tourism, e-commerce, entertainment and legal verticals, as sole engineer from first call to production.
Built and operate MEDSPACE (medspacebrasil.com.br), a marketplace connecting doctors to clinics: Next.js 16, React 19, Prisma/PostgreSQL and Auth.js. MVP live in ~4 weeks, evolved in paid cycles with multi-advertiser accounts (CPF/CNPJ validation), a medical-education module, end-to-end LGPD compliance, 105 automated tests (unit/integration/E2E) and Google Ads/Meta conversion instrumentation.
Ran a self-initiated security audit on that same production platform and fixed all 13 findings (1 critical, 3 high: moderation bypass, fail-open rate limiting, login timing oracle), shipping CSP/HSTS headers and fail-closed rate limiting (Upstash Redis).
Modernized a legacy PHP/MySQL tourism portal: responsive redesign of 8 pages refactored into 23 reusable components, real-time search and SEO. Accepted and paid in 8 days against a 12-day contract, including a read-only staging environment running over the production database and fail-safe automated FTP deploy tooling.
Developed a Mercado Livre seller dashboard in .NET 8 (ASP.NET Core) + Blazor WebAssembly + EF Core/MySQL: OAuth 2.0 with automatic background token refresh, listing sync with competitor (Buy Box) analysis, a 3-mode price-suggestion algorithm writing back through the official API, and 17 REST endpoints.
Automated a real-estate auction CRM on Zoho: consolidated 11 modules into 3, migrated 2,051 properties and 49 deduplicated clients with zero failures, and operate a daily Python capture robot (AWS Lambda + n8n) generating flyers and WhatsApp notifications in production.
Security & infrastructure: white/black-box audit of a multi-tenant ERP SaaS (Supabase RLS across 14 tables) uncovering tenant-breakout and privilege-escalation vulnerabilities, delivered with a prioritized SQL fix plan; designed a 3-2-1 client-side-encrypted backup pipeline (rclone crypt + Backblaze B2) covering 7 MongoDB databases and 6.15M files with bit-for-bit validated restores at ~US$0.30/month; led ransomware incident forensics and server hardening (fail2ban, service isolation).
Built and run Lorflux (lorflux.com), a vertical streaming and cinematic-comics PWA in production: React 19, Node.js/Express, MongoDB, Stripe subscriptions, BullMQ/Redis job queues, Bunny.net adaptive HLS streaming, multi-language content and multiple audio tracks.
AI & automation portfolio: multi-provider AI agents (Claude, GPT-4o, Gemini), Chrome MV3 extensions, Python desktop monitors, a Flask/Telethon Telegram campaign panel and Power BI dashboards with an on-premises Gateway to AWS RDS PostgreSQL.
Currently delivering: a real-time sports-odds API with arbitrage detection (Python, PostgreSQL, Redis), a React Native key-custody app for a real-estate holding, an AI WhatsApp SDR funnel (GPT-4o + n8n + Evolution API) and technical SEO consulting (WordPress, Search Console).

Founder · Tech Lead · Full Stack Engineer · Crescigram (SaaS Platform)

January 2018 — December 2023 (6 years) · Fortaleza, Brazil

Founded, launched and scaled a multi-tenant SaaS platform from zero to 10,000+ paying recurring users: full-cycle ownership across engineering, product, billing, customer support and infrastructure as a single-person tech team.
Sustained 99.9% production uptime on a PHP/Laravel + MySQL monolith over 6 years; ran an on-call rotation of one, from incident detection to root-cause fix.
Reduced legacy SQL query response times by ~40% via targeted refactoring and indexing, eliminating bottlenecks during peak-traffic windows.
Operated production infrastructure end-to-end: Cloudflare edge (WAF, DDoS mitigation, CDN, DNS, SSL), Nginx reverse proxy, Docker-containerized Linux servers (Ubuntu/Debian) and automated CI/CD deployment pipelines.
Authored Shell automation that eliminated hundreds of hours of manual operational toil per year and sustained the unit-economics of running engineering + ops solo.
Drove the full product lifecycle (discovery, scope, build, ship, support, retention), translating user feedback into roadmap and shipped features without a PM in the loop.

Selected Projects

MEDSPACE — medspacebrasil.com.br — Marketplace connecting doctors to clinics (rooms, equipment, medical education). Next.js 16, Prisma/PostgreSQL, in production with LGPD compliance and 105 automated tests.
Fresh Cleaning 4U — Operations SaaS for an Australian cleaning company: recurring-jobs engine, offline employee PWA, geofenced clock-in/out, GST-compliant PDF invoicing, Twilio SMS, payroll (Next.js 15, Prisma, PostgreSQL).
Lorflux — lorflux.com — Vertical streaming & cinematic comics PWA: Stripe subscriptions, Bunny.net HLS, BullMQ/Redis, multi-audio dubbing (React 19, Node.js, MongoDB).
CidadeTur — cidadetur.com.br — Legacy tourism portal modernization: 8 pages redesigned into 23 reusable PHP components, SEO, real-time search; delivered in 8 of 12 contracted days.
Mercado Livre Seller Dashboard — .NET 8 + Blazor WebAssembly + EF Core: OAuth 2.0 auto-refresh, competitor analysis, 3-mode price-suggestion algorithm, 17 REST endpoints.
Auction Real-Estate CRM Automation — Zoho CRM restructure (11 → 3 modules) + Python/AWS Lambda capture robot + n8n WhatsApp flyers. 2,051 properties migrated with zero failures.
Multi-tenant ERP Security Audit — White/black-box pentest of a SaaS ERP (Supabase RLS, 14 tables): found tenant-breakout and privilege-escalation flaws; prioritized SQL remediation plan.
VPS Backup & Hardening — 3-2-1 client-side-encrypted backup pipeline (rclone crypt + Backblaze B2, 7 MongoDB DBs, 6.15M files) with validated restores; ransomware forensics and hardening.
Macroluz — macroluz.com.br — Corporate site for a natural-lighting engineering firm: industrial product catalog and lead capture (Next.js).
LastMile Brasil — projeto-lastmile-brasil.vercel.app — Last-mile coverage platform for ISPs: PostGIS geographic viability search and integrated checkout.
Veritas Task Manager — github.com/fap233/desafio-fullstack-veritas — Full-stack Kanban: Go backend, React frontend, Docker, CI/CD.

Full portfolio: pavin.me

Education

Descomplica Faculdade Digital

Apr 2024 — Oct 2026 (Expected)

Associate's Degree in Systems Analysis and Development (CST: Análise e Desenvolvimento de Sistemas).

Certifications

Back-End Developer · Front-End Developer · Basic Front-End · Programmer