carlos@cesaints: ~/tldr.md — zsh

PT (Read this page in Portuguese)

Command: cat tldr.md

The 30-second summary

Who
Carlos Eduardo Gonçalves dos Santos · Brazil · fully remote

Software engineer. I build web systems end to end and I'm studying offensive security.

What I'm looking for
  • AppSec and secure development
  • Junior pentester (web and API)
  • Security-minded software engineering

Available for fully remote work only (home office), for roles and for freelance projects with a defined scope.

Languages: Portuguese (native) · English (technical reading and writing)

Three pieces of proof
  1. A study platform with payments, access control and timed exams: My own product: a sales site, a student app and an operations panel, three apps in one monorepo.
  2. A security review of the business logic of my own system: I reviewed the business logic of my own system, with payments, credits, rankings and paid content, and fixed thirteen classes of flaws, each with a regression test.
  3. A multi-company onboarding platform with isolation in the database: Two companies of a business group use the same platform to onboard new hires, in the same database, without either one seeing a single row of the other's data.
Stack with strong evidence

Architecture decision records · Astro · Auth.js with mandatory TOTP 2FA · Cloudflare Workers (D1, R2, KV) · CSP and security headers · SQLite and Cloudflare D1 · Gated deploys and migrations (backup, verification, rollback) · GitHub Actions · JavaScript (Node.js) · LLM in the product with validated output and a spend cap · Turborepo and pnpm monorepo · Next.js (App Router) · Custom authentication (modern hashing, opaque sessions, roles, audit trail) · PostgreSQL · Prisma · Criticality-based rate limiting · React · Multi-tenant isolation with RLS · Runbooks and operations docs · Security tests (isolation, role escalation, CSP, concurrency) · SQL (PostgreSQL, SQLite, MySQL) · Supabase (Auth, RLS, Storage) · Tailwind CSS · TypeScript · Vercel · Vitest · Schema validation with Zod

Full stack with evidence levels

Path
  • May 2026 – present Founder and engineer · Own product (study platform)
  • 2026 – present Product and technology director (CPTO) · Business group (two service companies)
  • Nov 2024 – present Software engineer and DBA (freelance) · National professional association
  • Apr 2024 – Dec 2025 Scrum Master · Software house (federal government systems)
  • Sep 2023 – Apr 2024 .NET developer · Software house (federal government systems)

Full career

Links

Contact