Victor Daniel
Backend / Full-Stack Engineer (NestJS, Next.js, TypeScript & Python) and AppSec & Web Pentesting Researcher.
Scalable REST APIs, async worker queues, and offensive security auditing against critical OWASP Top 10 and business logic flaws.
- Years Engineering
- 2+
- Years Engineering
- Systems & APIs
- 12+
- Systems & APIs
- Organizations
- 4
- Organizations
Backend & APIs
NestJS, Node.js, TypeScript, Python (FastAPI), Prisma ORM, PostgreSQL, BullMQ/Redis, and Docker.
AppSec & Hardening
BOLA/IDOR prevention, JWT/OAuth2, CASL RBAC, RLS, Rate Limiting, and strict DTO validation.
Offensive Security
Web Pentesting (SQLi, XSS, SSRF, CSRF, Business Logic) and Python exploit automation.
Full-Stack & Mobile
Next.js 15, React Native (Expo), WebSockets, and AWS Serverless architectures.
Production Systems & APIs
Real-world systems combining Backend/Full-Stack Engineering, mobile apps, and Offensive Security research.
Pentest & AppSec Labs
The most effective way to harden production systems is mastering how to break them. Continuous web exploitation practice, Python automation, and architectural remediation.
PortSwigger Web Security Academy
Hands-on exploitation of SQLi, XSS, CSRF, SSRF, BOLA/IDOR, and business logic flaws using custom Python scripts.
SQLi · XSS · CSRF · SSRF · BOLA/IDOR · Business Logic · JWT
HackerOne & Bug Bounty Recon
Vulnerability research on real-world targets, subdomain enumeration, REST API auditing, and access control testing.
Web Recon · Subdomain Enum · API Security · CVE Triage
TryHackMe
Practical intrusion labs, Linux network enumeration, privilege escalation, and traffic analysis.
Linux Hardening · Network Recon · OWASP Top 10 · PrivEsc
Hacker101 CTF
HackerOne CTF challenges focused on session hijacking, parameter tampering, and broken authorization.
Broken Access Control · IDOR · Session Tampering · Crypto
Red Team vs. Blue Team (Exploit & Patch)
An attacker swaps the order UUID on GET /api/v1/orders/:id using their own valid JWT. Because the backend queries only by primary key without checking ownerId, sensitive data and third-party S3 URLs leak.
GET /api/v1/orders/9b1deb4d-3b7d-4bad-9bdd HTTP/1.1
Host: api.target-saas.internal
Authorization: Bearer eyJhbGciOi… (sub: "user_attacker_99")
Accept: application/jsonHTTP/1.1 200 OK
{
"orderId": "9b1deb4d-3b7d-4bad-9bdd",
"buyerId": "user_victim_01", "downloadUrl": "https://s3.amazonaws.com/raw-photos/signed?…"}Engineering & Security
Holding a degree in Internet Systems from IFMA, I engineer production systems with Node.js, NestJS, TypeScript, Python (FastAPI), PostgreSQL, React Native, and Next.js.
I bridge scalable backend architecture (BullMQ/SQS queues, microservices, RBAC/CASL, and S3) with an Offensive Security mindset (AppSec/Pentesting) — uncovering critical authorization and business logic flaws and fixing them at the code level.
- Engineering
- Node.js · NestJS · TypeScript · Python (FastAPI) · PostgreSQL · Prisma · Next.js · React Native · BullMQ · Redis · Docker · AWS
- AppSec & Web
- OWASP Top 10 · BOLA/IDOR · SQLi · XSS · CSRF · SSRF · JWT & OAuth2 · Business Logic
- Sec & DevOps
- Burp Suite · Nmap · Nuclei · FFUF · SQLMap · Wireshark · Linux · GitHub Actions
Professional Experience
Simplifit Academias · Full-Stack & Mobile Developer
September 2025 – February 2026Architected RESTful APIs in NestJS + Prisma + PostgreSQL, led the React Native mobile app, integrated OpenAI LLMs on AWS Serverless (Lambda, SQS, S3), and enforced OWASP controls (JWT, CASL RBAC, Rate Limiting).
Developer Community · Full-Stack Developer
November 2024 – September 2025Developed backend services for a SaaS platform (ConstructEasy) using NestJS, TypeScript, and PostgreSQL. Implemented Row Level Security (RLS), Docker + Nginx reverse proxy, Linux hardening, and CI/CD.
Timon Municipal Government (ATI) · Software Developer Intern
June 2025 – August 2025Deployed and integrated REST APIs for the Electronic Information System (SEI) and institutional portals in Next.js, Node.js, PostgreSQL, and Docker, applying CSP headers, HTTPS, and server hardening.
FAPEMA / IFMA · Research Fellow (IoT & Backend)
November 2024 – July 2025Engineered a real-time environmental telemetry system using ESP32 microcontrollers (ENS160 sensor), NestJS + Prisma backend, and Next.js dashboard, alongside Offensive Security research.
Higher Education
B.Tech in Internet Systems (Sistemas para Internet)
IFMA | Federal Institute of Maranhão (3rd Place Ideathon)
Education, Training & Certifications
Software Engineering degree from IFMA combined with specialized training in Offensive Security and Bug Bounty.
B.Tech in Internet Systems (Sistemas para Internet)
IFMA — Federal Institute of Maranhão
Graduated (2023–2025). 3rd Place at the IFMA Ideathon (Smart Cities), FAPEMA Research Fellow (IoT/NestJS), and English Teaching Assistant.
Completed · 2025Academic Lattes CV ↗Do Bug ao Bounty (Web Pentesting & Bug Bounty)
Academia Do Bug ao Bounty — Gabriel Pato
Intensive training in offensive web security, advanced reconnaissance (OSINT/Recon), OWASP Top 10 exploitation, and Bug Bounty methodology.
Completed · 2025SYCP — Solyd Certified Pentester & Solyd Training
Solyd Offensive Security
Professional Pentesting coursework by Solyd and active preparation for the practical SYCP certification exam, covering network and web exploitation.
In Preparation · 2026BSCP — Burp Suite Certified Practitioner
PortSwigger
Target certification focused on advanced web application security auditing and deep mastery of Burp Suite Pro and Web Security Academy.
Planned · 2026
Offensive Security Metrics
- 85+
- Labs & CTFs
- 10+
- OWASP Top 10
- 15+
- Scripts & PoCs
Current Technical Focus
- 01Active preparation for the SYCP (Solyd Certified Pentester) practical exam
- 02Automated exploit development and security scripting in Python 3
- 03Secure RESTful API architecture with NestJS, TypeScript, and Prisma ORM
Let's build and secure together
Looking for a Backend/Full-Stack Engineer with a Security-First mindset or an AppSec/Pentesting professional who deeply understands production code? Let's talk.