marcopayan.dev
Theme

Full Stack Developer DevSecOps & application security

MarcoPayan

I build systems where the data has to be right: e-invoicing at one of Mexico’s largest retailers, field-operations platforms for financial companies, and my own multi-tenant SaaS. Now focused on DevSecOps — authorization enforced by the database, hardened deployments and security baked into the pipeline.

Based in
Culiacán, Mexico
Time zone
UTC−7 · overlaps US Mountain & Pacific
Status
Open to remote roles with US teams
View projectsDownload CV

Projects

Things I built, shipped and hardened.

CASE-001Live2026

Recepcion.net

Multi-tenant booking SaaS — every business gets its own site.

A “digital front desk” for barbershops, salons and clinics. Each business gets a white-label site at name.recepcion.net with online booking, promotions and a customer CRM, while customers keep one account across every business on the platform. I designed the product, the data model and the infrastructure, and built it end to end.

  • Subdomain-based tenancy with single sign-on across the business panel, the booking hub and every tenant site.
  • Double booking is impossible: availability is checked inside a serializable transaction, so two customers can never take the same slot.
  • Stateless modular monolith (7 domain modules) that scales horizontally behind a reverse proxy.
  • CI/CD: GitHub Actions builds images to GHCR; production only pulls and restarts. Sentry and Uptime Kuma for monitoring.

Hardening

  • Two locks on tenant data: every query is scoped by tenant in code, and Postgres Row Level Security rejects cross-tenant reads. The API’s database role cannot bypass RLS.
  • JWT in httpOnly cookies, bcrypt, idempotency keys on bookings and Redis-backed rate limiting per IP and per tenant.
  • No container publishes host ports: traffic enters only through Cloudflare (WAF, origin certificates) and Nginx Proxy Manager on an internal Docker network.
  • Cloudflare Zero Trust Access on admin surfaces; SPF, DKIM and DMARC on the mail domain.
Request path
  1. Browser
  2. Cloudflare WAF
  3. Nginx Proxy Manager
  4. Next.js apps
  5. Express API
  6. Postgres + RLS · Redis
Role
Solo — product, development, infrastructure
Stack
  • TypeScript
  • Node.js
  • Express
  • Prisma
  • PostgreSQL
  • Redis
  • Next.js
  • Tailwind
  • Docker
  • GitHub Actions
  • Cloudflare

Live site (Recepcion.net, opens in a new tab)Live demo (Recepcion.net, opens in a new tab)

CASE-002In production2026

Route Collections

Offline-first cash collection for amusement-machine routes.

Field staff visit stores along a route, read each machine’s counters, count the cash and photograph the evidence, even with no signal. The office follows every route live, reconciles cash against what each machine produced and settles store commissions. One React codebase ships as an Android app for the field and a web panel for the office.

  • Offline-first: every collection is written to IndexedDB and synced by a retrying queue. IDs are generated on the device, so a re-sync can never duplicate money.
  • All money math lives in Postgres as generated columns, in integer cents. The on-screen preview is checked against it with 500 generated test cases.
  • QR-tagged machines, GPS geofencing, signed commission handovers and live route tracking.
  • Declarative reports with Excel and PDF export.

Hardening

  • Authorization lives in Row Level Security, not in the UI: field users read only their own routes and can record collections only while their route is in progress. 54 API tests exercise RLS with real sessions.
  • Collections are immutable: triggers allow only valid → cancelled with a reason, and block deletes.
  • Audit log written by database triggers; private evidence storage partitioned per user.
  • Public sign-up disabled. Accounts are provisioned by an admin through SECURITY DEFINER functions.
Request path
  1. Android app
  2. Offline queue
  3. Supabase Auth
  4. Postgres + RLS
  5. Realtime web panel
Role
Solo — full stack
Stack
  • React
  • TypeScript
  • Vite
  • TanStack Query
  • Dexie (IndexedDB)
  • Capacitor
  • Supabase
  • PostgreSQL
  • Mapbox
  • Cloudflare Pages

Live demo (Route Collections, opens in a new tab)

CASE-003In development2026

Zero Trust City

A cyberpunk game that teaches DevSecOps with real code.

An educational game in development for Steam. Players fix real Terraform, Dockerfiles, CI pipelines and Kubernetes manifests while a pixel-art city reacts: lock down a public bucket and the drones stop getting in. Eight districts take players from Linux basics to supply-chain security and zero trust.

  • 74 missions and bosses across 8 ranks; 37 written and playable so far.
  • Each mission runs Learn → Practice → Mission → Review, with spaced repetition and a searchable codex.
  • Content as data: a mission is a TypeScript object the engine discovers, and an automated test plays its solution end to end.
  • Pixel-art city at 384×216, procedural art and synthesized audio — no external assets.

Hardening

  • Simulates 25+ real tools (Checkov, Trivy, Gitleaks, Semgrep, kube-bench, OPA…) with realistic output and real rule IDs. Nothing touches a real cloud.
  • Curriculum: secrets, SAST, SBOM and signing, OIDC in CI, IAM and KMS, Kubernetes RBAC, SIEM and incident response, supply chain, zero trust.
  • The web build ships with a strict CSP and full security headers.
Gameplay loop
  1. Edit real code
  2. Run scanner
  3. Deploy
  4. City reacts
Role
Solo — design, writing, development
Stack
  • TypeScript
  • Vite
  • Canvas 2D
  • CodeMirror 6
  • Web Audio
  • Tauri 2
  • Cloudflare Workers

Live demo (Zero Trust City, opens in a new tab)

CASE-004Demo2026

POS General

Configurable point of sale and back office that keeps working offline.

A web POS for small businesses: sales, inventory movements, customers and credit, suppliers and reports. It grew into a back office for service companies, with quotes and a client portal, projects with profitability, scheduled maintenance routes and CFDI 4.0 e-invoicing. It runs offline on a shop’s own PC or online on a VPS, and a central hub lets me support every installation remotely.

  • One codebase, three ways to run: Postgres in Docker on a shop’s PC with no internet, app and Postgres on a VPS, or embedded PGlite for development.
  • Central hub: each installation pushes a snapshot of its data every 4 hours, so a store’s state can be checked without going on site.
  • CFDI 4.0 invoicing through a certified provider (PAC), quote PDFs, Excel import with column mapping and SKU de-duplication, and Ctrl+K global search.
  • Offline indicator with a browser-side sync queue, plus full JSON export and import to move data between installations.

Hardening

  • Role permissions across 13 areas (view, create, edit, delete, cancel, export) checked on the server in every private API route, not just hidden in the UI.
  • Client portal without customer accounts: revocable, expiring links with per-link privacy options and access tracking.
  • Audit log of sensitive actions: cancellations, approvals, exports, imports, logins and portal access.
  • Each installation authenticates to the hub with its own revocable API key, and snapshots never include users or password hashes.
Request path
  1. Browser + IndexedDB
  2. Next.js + Auth.js
  3. Drizzle ORM
  4. PostgreSQL
  5. Central hub
Role
Solo — full stack
Stack
  • Next.js 15
  • React 19
  • TypeScript
  • Auth.js
  • Drizzle ORM
  • PostgreSQL
  • PGlite
  • Dexie (IndexedDB)
  • Tailwind
  • Docker

Live demo (POS General, opens in a new tab)

Experience

  1. Present

    Full Stack Developer @ Red Kobra

    Remote

    Field-operations platform used by financial companies to manage accounts, collection visits and their field agents.

    • Designed and built the Angular admin system clients use to manage accounts, visits, products, permissions, rates and branches, with dynamic modules and custom reporting.
    • Built the Android app field agents use every day: real-time visit logging, geolocation, push notifications and offline mode that syncs automatically.
    • Added two-factor authentication and hardened the authentication flow.
    • Wrote batch processes that sync high-volume data between systems; designed and tuned PostgreSQL and MongoDB schemas.
    • Containerized environments with Docker and automated API testing with Postman in GitLab CI/CD.
    • Angular
    • TypeScript
    • RxJS
    • Java (Android)
    • Node.js
    • Express
    • PHP
    • PostgreSQL
    • MongoDB
    • Redis
    • Docker
    • GitLab CI/CD

  2. Senior Developer @ Coppel

    Culiacán, Mexico

    One of Mexico’s largest retailers. Worked on electronic invoicing (CFDI) and customer-account systems.

    • Migrated the e-invoicing system from CFDI 3.3 to 4.0 to meet new SAT (Mexican tax authority) requirements, refactoring the PHP modules behind it.
    • Built C++ processes for bulk validation and stamping of tax invoices, and C# tools for CFDI reporting and audits.
    • Built Angular components to view, edit and validate invoices, and a PHP backend for customer accounts and financing secured with JWT.
    • Moved legacy systems from MySQL to PostgreSQL and from monolithic PHP to Node.js services on Docker.
    • PHP
    • Angular
    • C++
    • C#
    • Node.js
    • MariaDB
    • PostgreSQL
    • SQL Server
    • XML
    • Docker
    • GitLab

  3. Education B.Eng. Software Engineering

    Universidad Autónoma de Occidente (UAdeO) · Guamúchil, Mexico

  4. 2024

    Courses Platzi

    • OWASP Top 10: Application Security Risks
    • ISO 27001 Certification Prep
    • Azure Fundamentals (AZ-900 prep)
    • Introduction to DevOps
    • Jenkins
    • Linux Server Administration
    • Bash Shell Scripting
    • Git & GitHub
    • TypeScript (advanced types, OOP & async)

  5. Languages

    Spanish — Native · English — Professional working proficiency

Skills

Frontend & Mobile

  • TypeScript
  • Angular · RxJS
  • React
  • Next.js
  • Tailwind CSS
  • Android (Java)
  • Capacitor

Backend & Data

  • Node.js · Express
  • PHP
  • C# · C++
  • Prisma
  • PostgreSQL
  • MongoDB
  • MariaDB / MySQL
  • Redis
  • Supabase

Cloud / DevOps

  • Docker · Compose · Swarm
  • GitLab CI/CD
  • GitHub Actions
  • Nginx
  • Linux servers
  • Cloudflare Workers & Pages
  • AWS & Azure fundamentals

Security

  • Postgres Row Level Security
  • Multi-tenant isolation
  • 2FA & JWT auth flows
  • Cloudflare Zero Trust & WAF
  • CSP & security headers
  • SPF / DKIM / DMARC
  • OWASP Top 10
  • Checkov · Trivy · Gitleaks

Contact

Hiring for a remote team? I reply within a day.

hello@marcopayan.dev