Full-stack developer specializing in the backend and realtime layer of multiplayer platforms — matchmaking logic, WebSocket sync, and the infrastructure that keeps thousands of concurrent players connected without a dropped frame.
Socket.io and raw WS services handling matchmaking, turn state, and reconnection for board and card games where a missed frame means a disputed move.
Express and Fastify services for wallets, session state, and server-authoritative game rules — the parts that can't be trusted to the client.
Reverse proxies, process managers, and certificate lifecycles for fleets of domains — including making sure renewal actually runs, not just exists.
One codebase, many branded frontends — shared game engine, isolated configs, and the routing that keeps a dozen properties from stepping on each other.
A real-time multiplayer Ludo game built end-to-end — WebSocket room sync, server-authoritative turn logic, and a matchmaking layer designed to hold up under concurrent play. My biggest project to date, and the one everything else on this page was built to support.
play.trthunder.com ↗A shared backend platform powering multiple Ludo-style frontends — including ThunderLudo — from one API surface: game state, matchmaking, and session logic exposed over a common backend instead of rebuilt per app.
apiv2.trthunder.com ↗A WebSocket-based live chat system built once and exposed over an API, so any platform I run can drop in real-time chat and presence without rebuilding it from scratch.
Outside of platform work, I do mobile app reverse engineering and vulnerability research — pulling apart APKs, inspecting client-server protocols, and reporting what I find through proper disclosure channels rather than sitting on it.
Frida is my main tool for this: runtime instrumentation, method hooking, and bypassing client-side checks to see how an app actually behaves under the hood, for security testing and research on apps I'm authorized to assess.
Taking on APK reverse engineering and mobile app security engagements — static and dynamic analysis, protocol reversing, Frida-based instrumentation. Reach out on Telegram or email.
Found a JWT validation weakness in Nagad's mobile financial services platform during independent research. Reported it directly to their team instead of exploiting it further.
Nagad rewarded the disclosure and patched the issue.
Building and running ThunderLudo along with the backend and infra layer behind it — WebSocket services, the apiv2 platform, nginx fleet, TLS lifecycle, and the deploy pipeline that pushes changes without dropping live rooms.
Built matchmaking and room-state services handling tens of thousands of concurrent connections; moved a monolith to a socket-service-per-game-type architecture behind a shared gateway.
Shipped end-to-end features across React frontends and Node APIs for consumer web products; first production exposure to WebSockets and horizontal scaling under real traffic.
Started on internal tools and CRUD APIs — learned the value of a boring, well-monitored deploy over a clever one.