Full-Stack Developer  ·  DevOps Engineer  ·  Applied AI  ·  Founder & CEO of Hiprax

I build web applications end to end, and then I keep them alive.

That second half is where it gets interesting. Shipping a demo is easy. Surviving real traffic, a bored attacker, and a bad deploy on a Friday afternoon is a different job, and it's the one I actually like. I founded Hiprax to do that work with two engineers I've known for years.

Most of my time now goes to the seam between production engineering and applied AI: retrieval pipelines, agents that take real actions, voice interfaces, and the deeply unglamorous plumbing that keeps them predictable on the days a model decides to get creative.

Ten years and sixty-odd projects in, every client has come back for more. That's the metric I care about.

Every project I take on gets deployed the same shape. One compose file, one root .env, one port on the loopback interface, and an Nginx on the host holding the only certificate. There is exactly one door into the stack, and everything else talks over the compose network where the internet can't reach it.

Here's the detail that decides it. Publish a container port without binding it to 127.0.0.1 and Docker DNATs it in the nat table before your firewall ever gets a say. The packet is routed through FORWARD, where Docker's own rules accept it, and never reaches the INPUT chain where your ufw rules live. So the port you believe is closed is open to the whole internet, and ufw status will happily tell you it's blocked. Plenty of "firewalled" stacks are wide open for exactly this reason.

None of this is clever, and that's the point. I can rebuild it on a bare VPS in an afternoon, and so can whoever inherits it from me.

Products I've built with Hiprax. Most are under NDA, so these are the shapes rather than the client names.

Seven packages on npm — four under the @hiprax scope, three unscoped — all MIT. Around 11,600 downloads in the last year: modest, real, and not a vanity number. @hiprax/crypto and @hiprax/logger publish from CI through npm's OIDC trusted publishing, so no token ever touches a laptop.

Package	What it gives you
@hiprax/crypto	AES-256-GCM authenticated encryption with Argon2id key derivation, file streaming, and constant-time comparison. Zero runtime dependencies.
hppx	HTTP Parameter Pollution shield for Express: blocks prototype pollution, null-byte injection, and DoS vectors with nested whitelists.
pixel-serve-server	Sharp-powered image middleware: on-the-fly AVIF and WebP conversion, resizing, strict path validation, smart caching.
pixel-serve-client	The React half of Pixel Serve: multi-format srcset, lazy loading, a skeleton loader, SSR-safe fallbacks.
@hiprax/use-seo	One React hook for titles, Open Graph, Twitter Cards, hreflang, and JSON-LD. SSR-safe and fully tested.
@hiprax/logger	Winston-based structured logging with daily rotation, verified IANA timezones, and an Express middleware that masks secrets automatically.
@hiprax/errors	Modular error handling for Express: structured, typed error classes and consistent API responses.

Vue, Svelte, Angular, Flask, PHP, and Laravel are in the toolbox too, when a project already lives there.

No shortcuts. No hand-holding frameworks. No blind dependency on AI.
Just engineers who understand what they build, top to bottom.

I'd rather ship something I can debug at 3am than something I can only demo.

Open to full-time roles, contracts, and the occasional interesting collaboration. I work remotely with teams anywhere.

The fastest way to reach me is email. Tell me what you're building, what it runs on, and what's currently on fire.

_{Three hand-written SVGs and a few live npm badges. No stats card, no streak counter, no snake.
Every animation is CSS and respects prefers-reduced-motion.
The stats card is missing on purpose: almost everything I build is under NDA in private repos, so it would only ever measure the sliver that isn't.}