Full-stack developer in Ho Chi Minh City (UTC+7). I build and ship apps, and I review Supabase/Postgres projects for the access-control mistakes that fast-built apps often have. Open to remote contract work, about 20–30 hours a week, async and in writing.

Need a Supabase RLS review, or help on a React Native or Python project? Contra · Upwork · Email

• 🔐 Supabase/Postgres security: Row Level Security and policy review, SECURITY DEFINER grants, Storage buckets. I wrote supabase-rls-check, an open-source CLI, MCP server and GitHub Action (17 catalog rules, a scan for secret keys in public env variables and client/agent configs, and a diff between two runs; 133 tests, CI on PostgreSQL 15).
• 📱 React Native apps: full-time developer at Madalena, a cosmetics retailer, since March 2026. I built its loyalty app as the only developer (React Native, Expo, TypeScript, PHP REST API, Electron admin). It is on the App Store and Google Play.
• ⚙️ Python automation: five public Apify Actors, n8n and Make workflows, Google Apps Script, webhooks.

supabase-rls-check: read-only checks for Supabase RLS, policies, SECURITY DEFINER grants and public buckets. CLI, MCP server and GitHub Action; 17 catalog rules, 133 tests. pipx install supabase-rls-check PyPI · Glama · Agent skill on Agensi · Cursor plugin

Race-safe salon booking (Cloudflare Workers + D1): five simultaneous requests for the same technician and time give 1 booking and 4 rejections. Per-technician iCal feeds, admin page, English/Vietnamese UI, 11 tests. Live demo (deposits are turned off on the demo)

supabase-multitenant-rls: reference migration for many customers in one shared Postgres schema on Supabase. Forced RLS, roles from a memberships table, composite keys that block cross-tenant references, tenant-scoped Storage. 19 tests sign in as real users and try to cross the boundary; CI also lints the schema with supabase-rls-check (0 findings).

market-data-pipeline: Python job that pulls free market data (indices, FX, crypto, commodities, bonds, VIX), normalizes OHLCV to UTC, validates it, adds indicators and upserts into Supabase on a GitHub Actions schedule. 23 tests.

remote-contract-jobs: CLI and MCP server that collects remote contract and part-time developer jobs from 8 public sources and filters out location, video-call and ID-document blockers. 84 tests. PyPI

n8n templates: n8n-retry-after reads Retry-After (seconds or HTTP date), falls back to jittered backoff and defers long waits instead of holding the workflow open (13 tests). n8n-lead-followup-drafts turns a Google Sheet of leads into AI-written Gmail drafts that a person reviews and sends; re-runs do not create duplicate drafts (27 tests). Both validated with n8n-mcp, not yet run against live accounts.

discord-membership-bot — Discord bot that gives a paid role to members with an active Stripe, Whop or Zapier/Make subscription and removes it when the paid period ends; posts Shopify order alerts without customer contact details. Node.js, discord.js, node:sqlite, 57 offline tests.

vn-sme-offline-tools — 9 offline browser tools for Vietnamese small businesses (VietQR cashier, debt aging, quotes, fleet fuel & toll reconciliation, e-invoice XML check). No server; data stays on the device.

The Apify Actors were published in October 2026 and are still new.

• Building a Faster Playwright MCP Server: Compact DOM Deltas, 1-Turn Form Filling, and Submit Guards
• Extension Tables, Expo Configs, and Static MCP Scanners in supabase-rls-check 0.6.3
• Reader Comments Shaped Three Releases of supabase-rls-check
• Five Supabase RLS Mistakes a Read-Only Query Can Catch

• tabloy/keygate#144 — fix(web): restore default border color for Tailwind v4 (open-source self-hosted license management platform, ~250 GitHub stars; +15 lines of CSS restoring the default border colour after the Tailwind v4 upgrade, merged 13 Nov 2026).