© 2026 Arshia Heravi
Ideas into working software.
Senior Software Developer
I turn ideas into dependable Python applications, connecting clear APIs, thoughtful interfaces and well-tested backend systems.
Python · Django · Flask
Hamilton, Ontario, Canada
I’m a senior software developer based in Hamilton, Ontario. I enjoy taking an idea from an open question to a working application: understanding the problem, choosing a practical design, building the interface and backend, and checking how the pieces behave together.
My independent work spans vehicle research, business discovery, market monitoring and developer tooling. AutoFlip makes vehicle cost assumptions visible. LeadRadar organizes business research. PolyEdge brings together accounts, subscriptions and scheduled monitoring. AutoAgent explores how a development workflow can track state and recover from failures.
My main focus is Python, Django and Flask: RESTful APIs, relational data, background jobs and the tests that keep them dependable. I connect backend work to HTML, CSS and JavaScript interfaces, using Figma and UI/UX thinking to make each workflow clear. My earlier projects also use FastAPI and React; their case studies show the actual stack behind each application.
My latest project is a private, autonomous AI bug bounty harness. It handles reconnaissance, security testing, finding validation and reports with remediation guidance, combining persistent memory, evolving security skills and collaboration between AI models. A Supervisor requests researcher input when a task needs human involvement. See the project capabilities and current account report totals, along with my public writeups.
I’m interested in senior software development opportunities where I can contribute across the product, discuss technical decisions openly and turn ambitious ideas into manageable work. The project case studies show the code and verification behind my approach.
Python is at the center of my work. These are the tools and engineering practices I focus on, from the data model to the interface and delivery pipeline.
Structure Django and Flask applications around clear business rules. Design predictable API contracts, validate inputs and keep authentication and authorization explicit.
Python · Django · Flask · Django REST framework · RESTful APIs
Model relationships, review ORM queries and manage schema changes with migrations. Treat caching and queued work as part of the application’s consistency and failure behavior.
PostgreSQL · Django ORM · SQLAlchemy · Redis · Celery · RabbitMQ
Use SOLID principles, design patterns and separation of concerns to keep code understandable. Start with clear module boundaries; choose microservices when independent operation justifies the complexity.
Clean code · SOLID · Design patterns · Modular architecture · Microservices
Use test-driven development for important behavior, with focused unit tests and integration checks at real boundaries. Verify APIs, failure paths and complete browser workflows.
TDD · pytest · unittest · API testing · Integration tests · Playwright
Keep changes reviewable in Git and automate checks through CI/CD. Focus on repeatable containers, explicit configuration and useful logs when preparing applications for cloud deployment.
Git · Docker · Kubernetes · AWS · CI/CD · GitHub Actions
Connect backend capabilities to responsive, accessible interfaces. Use Figma to explore flows and layouts, then build forms, navigation and feedback that work with touch and keyboards.
HTML · CSS · JavaScript · Bootstrap · Figma · UI/UX
My learning path through Claude Academy focuses on practical development: planning work, managing context, reviewing generated code and verifying results. I bring the same standards of readable code and useful tests to AI-assisted work.
Web applications and developer tools spanning frontend work, APIs, data, integrations and testing. The linked source repositories include project-specific tests and setup instructions.
Application security research and published writeups on Medium. I connect these investigations to defensive engineering: validating inputs, enforcing access rules and understanding business logic.
Software Development (559)
Hamilton, Ontario
Explore my projects and technical focus in my résumé, or visit my LinkedIn profile.
Turn an idea into a usable application, connecting the user journey to the backend and data that support it. My projects include research dashboards, account-based tools and developer workflows.
Start with the user and the decision the software needs to support. I map the essential workflow, identify the data it needs and keep the first useful version small enough to evaluate.
AutoFlip is an example: its interface surfaces the cost breakdown behind a vehicle assessment. LeadRadar pairs search results with scoring, filters and export so the research can support a next step.
My approach is to choose a structure that fits the problem, explain the tradeoffs and refine it as the requirements become clearer. A straightforward service and data model can be the right starting point.
Build application services that connect interfaces, databases and third-party systems. Work includes REST APIs, authentication, scheduled jobs, Google Places data and Stripe subscription events.
An API is a contract with its callers. In Django and Flask applications, I focus on validation, access rules, pagination and useful errors. Django ORM and SQLAlchemy help express a data model, but transactions, indexes and query behavior still need deliberate review.
For background work, my focus includes Celery task queues, Redis caching and RabbitMQ messaging. I consider what can be retried, which operations must be idempotent and how to avoid presenting a partial result as completed work.
My public project examples show those concerns in their own stacks: PolyEdge combines FastAPI, JWT and SQLAlchemy with subscription limits and Stripe webhooks; AutoAgent makes bounded retries and persisted execution state explicit.
Make important behavior checkable through focused tests, continuous integration and browser checks. Bring a security mindset to inputs, permissions and failure handling.
I use test-driven development to clarify important behavior before implementation, then refactor with the checks in place. Unit tests keep business rules precise; API and database integration tests check the boundaries that isolated tests cannot cover.
My Python testing focus includes pytest, unittest, fixtures and test doubles used where they help explain a dependency. AutoAgent separates unit checks from PostgreSQL integration work in CI; this portfolio uses Playwright for browser workflows and accessibility in both themes.
Clean code, SOLID principles and reviewable Git changes make failures easier to investigate. Security research informs the same discipline: enforce authorization, handle unexpected inputs safely and document what each check establishes.
Explore the implementation, the tests and the reasoning behind it. My project case studies connect each capability to a concrete application. The source repositories and technical writeups provide the detail.
Good engineering starts with a shared understanding of the problem. This is the working approach I bring to a product discussion.
Clarify who the software serves, what a useful result looks like and which constraints matter. Turn those questions into a focused scope.
Compare the options, explain the costs and choose a design that the next person can understand. Record assumptions that may need revisiting.
Keep changes reviewable and connect the interface, API and data early. Use feedback to check whether the implementation still solves the original problem.
Test the important paths, inspect failures and document setup and limitations. Make it clear what works, what was checked and what comes next.
I’m happy to walk through a repository, a design decision or the problem your team is working on.
Latest project · Private independent project
I built a fully autonomous, AI-driven bug bounty harness that handles reconnaissance, security testing, finding validation and report generation with remediation guidance. It combines persistent memory, evolving security skills and coordinated agents, with a Supervisor that requests researcher input for tasks requiring human involvement.
This overview covers selected capabilities. The source code, internal workflows and additional components remain private for now. My HackerOne profile and published writeups provide public context for my bug bounty work; the live totals below describe my account as a whole.
See my HackerOne profile for current report statuses.
Independent applications and developer tools. Each case study connects a practical problem to its implementation and repository tests.
A vehicle research application for estimating the costs and potential margin of an Ontario salvage-car purchase.
Independent project
A Python command-line tool and HTML dashboard for coordinating an LLM-assisted software development workflow.
Independent project
A research dashboard for finding and organizing local businesses that may need a website.
Independent project
A Polymarket monitoring application with account access, trader-following features and subscription management.
Independent project
Technical investigations into how web applications fail and what developers can learn from them. These published security writeups complement my software projects with a focus on access control, validation and application logic.
Medium
Some IDOR vulnerabilities expose highly sensitive data.
Medium
Some of the best bug bounty findings do not begin with a suspicious API endpoint.
Medium
Severity: Medium CVSS 3.1: 6.1 CWE: CWE-79 — Cross-Site Scripting Vulnerability Type: Reflected XSS
Medium
Sometimes the most interesting API vulnerabilities aren’t hidden behind complicated authorization logic.
Medium
Email verification is supposed to establish one simple security property:
Medium
Transactional email endpoints are an interesting target during a bug bounty assessment because they often sit at the intersection of authentication, authorization, user-controlled…
Medium
While testing a large e-commerce application, I found an interesting combination of weaknesses that turned an address-saving endpoint into an account identity modification…
Medium
While running my autonomous web-security hunting workflow, I discovered an interesting access-control issue involving a WordPress property that was intentionally not publicly…
Medium
An autonomous hunting harness I’ve been building — RedHunter — found a critical price-integrity / business-logic flaw in a large pay-per-item media store. The purchase endpoint…
Medium
While running my autonomous web-security hunting workflow, I identified a reflected cross-site scripting vulnerability on a payment/billing endpoint.
Medium
Some authorization vulnerabilities are difficult to find because the application appears to enforce access control correctly.
Medium
One of the biggest advantages of building your own security automation isn’t simply being able to scan more endpoints.
No articles match your search. Try a different topic or clear the search to see the collection.
More writing and publication updates on my Medium profile.
Hiring a Python developer or building a product with Django or Flask? Tell me about the problem, your team and the contribution you need. I’m happy to discuss backend systems, APIs, testing and the interface that brings it all together.
All fields are required. I’ll use your details to reply to this enquiry. Please don’t include passwords or confidential information.
Prefer email? arshia.heravi5@gmail.com
