YumGott
Restaurant app with Swish payments, digital wallet, interactive reels and social features.
FlutterMVVM + BlocSwish
Senior Flutter Engineer — Fintech & Payments
I build the software that moves money.
Passkeys instead of passwords. Idempotent, tamper-proof transactions. Real-time everything. I shipped a production crypto & fiat wallet end to end — and it's live on the App Store and Google Play right now.
LIVE · APP STORE
LIVE · GOOGLE PLAY
US & TAIWAN MARKETS
Open to remote & relocation — Türkiye · EU Blue Card eligible · UAE
0+
money-moving flows secured
0+
files migrated to one design system
0k
LOC Flutter app, architected solo
0
locales, incl. full RTL
0
codebases led end to end
0
app stores shipped & co-owned
The signature move
Try to steal this transaction.
You can't.
A working demo of intent hashing — the industry-standard pattern I use to tamper-proof money-moving flows. A canonical hash over the transaction fields binds every payment from prompt to execution. Sign it — then try tampering with it.
①
Canonicalize
The intent is serialized deterministically — same fields, same order, every time.
②
Hash & bind
SHA-256 fingerprints the exact intent the user approved. Real hash, computed in your browser.
③
Server verdict
Any mutation after signing — amount, recipient, path — produces a mismatch and the transaction dies.
transfer_intent — SHA-256 · Web Crypto
SHA-256
…
Server-authoritative by default: the client displays and forwards — it never decides. The server recomputes this hash and rejects any mismatch before money moves.
The Lab — interactive proof
Intent hashing was pattern zero.
The lab holds seven more.
Working simulations of the systems behind my payment work — transfers that survive dying networks, webhooks that heal themselves, transactions that survive an app kill, sockets that reconnect without missing a cent. All hand-coded, all running in your browser.
01
Replay shield
Pay on a dying network — get charged exactly once.
TX.IDEMPOTENCY 02 Webhook sagaKill the endpoint mid-payment and watch the incident heal itself.
BILLING.SAGA 03 Four ticks, zero liesAck-driven delivery states that survive a dead socket, in order.
RT.DELIVERY_STATE 04 Challenge–responseSign with a key that never leaves the phone. Replay it — get burned.
AUTH.CHALLENGE 05 Threat queueA debugger detection never waits behind heartbeats. Server enforces.
SEC.PIPELINE 06 Crash recoveryKill the app mid-transfer. The journal + one key = exactly one charge.
TX.LIFECYCLE 07 Socket resumeReconnect with a cursor — replay the gap, drop the dupes, to the cent.
NET.REALTIMEFlagship — currently shipping
Production wallet. Real money.
My code between the two.
Senior Flutter Engineer · Better-Pro Limited · Jan 2026 — Present
HoyaPay — Crypto & Fiat Wallet
A cross-platform crypto & fiat wallet for a US fintech — deposits, withdrawals, transfers, exchange, buy/sell, and virtual & physical cards. I own the mobile side end to end: authentication, transaction safety, real-time, release engineering.
AUTH.PASSKEYS
Killed the password
Complete passwordless system: passkey (WebAuthn/FIDO2) registration & login, OTP fallback via email / Google Authenticator, step-up re-auth for sensitive actions, per-device credential management with multi-OEM & iOS hardening.
TX.IDEMPOTENCY
15+ money flows, zero double-spends
Idempotency across every money-moving flow, plus payload-freeze snapshots, double-submit guards, and on-device transaction lifecycle tracking with persistence and crash recovery for in-flight transactions.
TX.INTENT_HASH
Tamper-proof by construction
Intent hashing binds each payment to a canonical fingerprint that's rejected on any mismatch, tamper-protecting it from prompt to execution. (See the live demo above for how the pattern works.)
NET.REALTIME
Live transaction status
WebSocket layer with connectivity-aware reconnection; hardened Dio API stack with typed errors, encrypted requests, request signing, and strict logging hygiene — no tokens, balances, or PII.
REL.HARDENING
CI/CD built from scratch
Signed builds, secure keystore management, obfuscation with regression guards; co-owned iOS & Android store deployments and release sign-off with QA.
UI.SYSTEM
One design system, 250+ files
Spacing, color and typography tokens with full light/dark theming; centralized typed navigation; 7-locale i18n; bilingual (EN/中文) docs for an international team.
“Server-authoritative by default — the client displays and forwards; it never decides.”
Flutter / DartGetXDio
WebSocketsWebAuthn / FIDO2
Keychain / KeystoreGitLab CI/CD
Selected work
Architected. Built. End to end.
Not mockups — real systems under real constraints: a fintech wallet live on both stores, a multi-tenant SaaS in production, and client platforms owned from database to release.
Founder & Lead Backend Engineer · Solo architect · 2026 — Present
TruAlly — Multi-Tenant B2B Matchmaking SaaS
In productionyourtrually.com
A multi-tenant SaaS platform where the backend is the product — 27 bounded domains, 118 migrations, 1,570 tests — serving ranked, explainable B2B introductions with privacy enforced in the query layer, not the UI.
Next.js / Flutter (clients)
⇄
Laravel API (27 domains, tenant-scoped)
→
Queue + cron (embed → rank)
→
Stripe (billing + webhooks)
TENANCY.PROVEN
Isolation enforced by CI, not convention
A query-layer bypass guard plus a dedicated isolation suite that fails the build on any cross-tenant read.
BILLING.SAGA
Commerce as auditable state machines
draft → paid → refunded, quotas that hard-block at the limit, and a Stripe webhook incident lifecycle that retries itself to recovery.
DEBUG.2008
2,008 of 2,275 users, an empty feed
Root cause operational, not algorithmic — ranking runs had never executed. Fixed with debounced re-rank queueing on pool change.
AUTH.NO_ORACLE
Auth that leaks nothing
Constant-202 magic links, hash_equals comparison, throttled endpoints — the API won't confirm an account exists.
AUTHZ.FAIL_CLOSED
Server-side gates that fail closed
Four client-only entitlement checks moved server-side; unknown keys now deny by default, with a tenant-wide AI budget cap.
OPS.GATE
A CI pipeline that actually blocks
Pint, Larastan L8 no baseline, Gitleaks and 1,570 tests — and I run the production deploys.
PHP 8.3Laravel 13SanctumMySQL
RedisLaravel ReverbQueues + CronStripe
AWS S3PestPHPStan L8GitHub Actions
Next.jsPython ETL
Backend & Real-Time Engineer · Project Lead · Solo architect · 2022
Bubbles — Location-Based Social Platform
Not an app — a distributed system I designed and built solo across four codebases: a 109k-LOC Flutter client, a Laravel API that owns the truth, a Node.js real-time layer, and a Next.js moderation console. The hard part wasn't the screens — it was making location, presence and money-grade trust behave correctly across all four. Live on TestFlight, iOS & Android.
Flutter · ~680 files · 109k LOC · Clean Arch + Cubit + GetIt
Laravel 12 · 44 models · 74 migrations · ~249 endpoints · Sanctum
Node.js · Socket.IO fan-out · identity-verified sockets
Next.js 16 · React 19 · React Query · Leaflet admin
Flutter app (client)
⇄
Node Socket.IO (validate + fan-out)
⇄
Laravel API (source of truth)
→
Next.js admin (live console)
GEO.TERMINATED
Geofencing that fires with the app closed
OS-level geofence regions wake the app on boundary crossings even when fully terminated — handling the iOS 20-region cap and asymmetric enter/exit registration to kill false "you left" events. The genuinely hard part of a location app, done right.
PRESENCE.AUTH
Server-authoritative, anti-spoof presence
GPS only decides when to ask; the Laravel server decides inside/outside via Haversine and is the single source of truth. Every affirmative ping doubles as a presence refresh, and transient network errors never eject a user. Location integrity + anti-bot guards on top.
RT.THREE_ENGINE
Three-engine real-time architecture
Clients emit over Socket.IO; the Node layer verifies identity against Laravel (no client-supplied identity is trusted) and fans out; Laravel persists and authorizes every event over a shared-secret internal bridge. Room membership is replayed on reconnect, preserving nested join order.
CHAT.RICH
Chat with the details that are hard
4-state WhatsApp-style delivery/read ticks driven by acks, typing & voice-recording presence, live polls, reactions, mentions, pinning, nested "flows", and timed "sprint" matchmaking — plus a custom-built voice-note UI with waveform scrubbing.
MEDIA.S3
Presigned media, zero bytes over chat
Two-path upload contract — presign → PUT → complete to S3 with a multipart fallback. Messages carry only a media_id; private objects are served via short-TTL signed URLs. Client-side compression before upload.
ADMIN.LIVE
A real-time moderation console
Next.js 16 admin: a live firehose room surgically patches React Query caches for live sprint/DM monitoring, a Leaflet map moderates bubbles in place, plus approval queues, RBAC tiers, warnings/bans, and a versioned legal-document CMS.
Flutter / DartCubitGetItSocket.IO
Laravel 12SanctumNode.jsNext.js 16
React QueryAWS S3FCM (HTTP v1)Leaflet
Client project · Contract · 2023 — 2024
Rest Fort — Property Rental Platform
Cross-platform rental client — listings, media galleries, booking and payments — built from a single codebase for iOS and Android.
RT.CHAT
Real-time chat with delivery state
Live chat over the Pusher SDK, carrying delivery and read state through the message lifecycle rather than fire-and-forget sends.
PAY.GATEWAYS
Payments & third-party integration
Multiple payment gateways and third-party SDKs integrated behind a single checkout path, on Bloc + MVVM throughout.
FlutterBloc / MVVMPusherPayment Gateways
Founder & Solo Engineer · Flutter + Laravel · 2026
Usta Bey — Quote & Invoice SaaS for Tradesmen
BetaiOS & Android
A production Flutter app for Turkish tradesmen — quote in two minutes, invoice, chase the money. The hard part isn't the screens; it's that an usta works in a basement with no signal, so the whole thing is offline-first: every edit is a local op that reconciles against a Laravel 13 server which stays authoritative on conflict. Money is integer-minor end to end, PDFs are print-correct in Turkish and Arabic, and billing is gated by a server-verified entitlement.
Flutter · offline-first · Drift + SQLCipher · 168+26 tests
Laravel 13 · Sanctum · op-based sync · server-authoritative
Money · integer-minor · KDV · deterministic PDF totals
RevenueCat · entitlement from server, not the store SDK
SYNC.OFFLINE_FIRST
Built for the basement, not the demo
Every mutation is an op in a durable local queue, applied optimistically and replayed when signal returns. Replay is idempotent (dedupe by op id) and the server wins conflicts by version — nothing is silently lost.
MONEY.EXACT
Integer money, one source of totals
All amounts are integer minor units — no floats near money. The PDF, the list and the sync payload can never disagree because line and grand totals are computed once by a single pricing calculator and stored.
PDF.RTL_BIDI
Print-correct in Turkish and Arabic
Real bidi text layout with hand-mirrored tables for RTL pages — after chasing a bug where Latin text reversed per character on Arabic pages (font fallback, not bidi). Three PDF templates, locale-aware money digits.
BILLING.SERVER_TRUTH
The store SDK doesn't decide who's Pro
Entitlement comes from Laravel, not the RevenueCat SDK — one canonical billing identity bound to the account, so the free-tier gate (6th document/month) can't be spoofed by a client. Paywall trigger is attributed for the funnel.
Flutter / DartCubitDriftSQLCipher
Laravel 13SanctumRevenueCat7-locale · RTL
Masar — Store + Admin
Flutter client plus a React admin panel, kept synchronized over Laravel APIs on one shared data contract.
FlutterReactLaravel
Teacher–Student Platform
Clean Architecture + BLoC with payments, role-based access and Arabic RTL — 95%+ code reuse.
FlutterFirebaseRTL i18n
Nabda Charity
Data showcase app for a charitable organization with validated form submission, responsive across devices.
FlutterDart
LARAVEL · SOCKET.IO
AqarClick — Real-Estate Platform
Laravel 12 API (100 migrations, Services/Policies/Observers, policy-driven RBAC) plus a Node.js Socket.IO tier on a strictly Laravel-authoritative contract — the API persists, then fans out; clients emit only typing, presence and read acks, never state.
Laravel 12Node.jsSocket.IOSanctumReact / TS
PYTHON · ASYNC · DOCKER
AI Job Hunter
Containerised async Python agent: SQLAlchemy 2.0 over asyncpg and PostgreSQL 16, Alembic migrations as their own compose service, Pydantic v2 config, and httpx ingestion with tenacity retries and aiolimiter rate limiting.
Python 3.12SQLAlchemy asyncPostgreSQL 16AlembicDocker
ZERO-SERVER · 164 TESTS
Reckon — Daily Puzzle Engine
Deterministic generation seeded purely from the calendar date, so every player worldwide gets byte-identical puzzles with no server, no accounts and no network calls — verified by an automated three-year forward sweep in CI.
DartDeterministic PRNG164 tests
LARAVEL · MYSQL
Laravel E-Commerce
Full store backend: product/variation/inventory CRUD, order tracking, auth and role-based admin dashboards.
LaravelBladeMySQL
Who you'd be hiring
Security-first. Product-obsessed.
Ships anyway.
I'm Saed — a senior Flutter engineer who found his edge where most mobile developers stop: the point where the app touches money. Payments punish sloppy engineering, so I build server-authoritative, idempotent, tamper-evident flows by default — then obsess over the design system, the animations and the i18n so it feels effortless to the user.
Before fintech I architected and led a four-codebase social platform solo — Flutter, Laravel, Node.js, Next.js — so I speak backend, infra and release engineering fluently, not just widgets.
B.Sc. Computer Systems Eng. — 87.12% "Very Good" · ANABIN H+
Arabic native · English C1 · Turkish C1
Türkiye · remote-first · EU Blue Card eligible · UAE
Bilingual EN/中文 feature docs for intl. teams
Professional journey
Every role shipped something real.
JUN 2026 — PRESENT
Founder & Lead Engineer
TruAlly — B2B event matchmaking platform · yourtrually.com
- Multi-tenant SaaS in production — Flutter client + Next.js web + Laravel API, architected and built solo
- Laravel 13 / PHP 8.3 API: 27 bounded domains, 118 migrations, Stripe billing, CI gate at PHPStan level 8 across 1,570 tests
- Server-side entitlement gating that fails closed; brand re-theme across five surfaces from one design-token source
JAN 2026 — PRESENT
Flutter Front-End Engineer
Better-Pro Enterprises Limited — HoyaPay · Remote, US company · full-time to May 2026, project-based since
- Shipped a production crypto & fiat wallet live on the App Store and Google Play (US & Taiwan)
- Passkey/WebAuthn passwordless auth with step-up re-auth; single verification orchestrator for all sensitive flows
- Idempotency + SHA-256 intent hashing across 15+ money-moving flows; crash-safe transaction lifecycle tracking
- Design system across 250+ files · 7-locale i18n · CI/CD, obfuscation and store releases built from scratch
SEP — DEC 2025
Flutter Developer — client project
Teacher–Student learning platform
- Clean Architecture + BLoC client: content management, payment flows and role-based access with Arabic RTL localisation
- Firebase (Auth, Cloud Messaging, Analytics) and a token-authenticated API layer, on a shared component library reused across feature modules
JUN — AUG 2025
Backend & Full Stack — client project
AqarClick
- Laravel 12 API (100 migrations, Services/Policies/Observers, policy-driven RBAC) + a Node.js Socket.IO tier on a Laravel-authoritative contract
- React + TypeScript client with advanced search/filtering, scheduling and Arabic RTL + English i18n with dynamic locale switching
OCT 2023 — JAN 2024
Flutter Developer — client project
Rest Fort
- Cross-platform rental client (Bloc, MVVM) with real-time Pusher chat carrying delivery and read state
- Multiple payment gateways and third-party SDKs integrated behind a single checkout path
JUN — JUL 2023
React & Flutter Developer — client project
Masar
- React admin panel + Flutter client on shared Laravel APIs, kept synchronized on one data contract
APR — MAY 2023
Flutter Developer — client project
Yumgott
- Restaurant app with Swish payments, digital wallet, auth, interactive reels and social features (MVVM + Bloc)
MAR — NOV 2022
Flutter Engineer & Project Lead
Bubbles — location-based social platform
- Architected 4 codebases end to end: Flutter (~109k LOC), Laravel REST API, Node.js Socket.IO server, Next.js admin
- Server-validated geofencing, live presence, typing/read receipts; FCM, deep linking, presigned S3, multi-provider auth
JAN — FEB 2022
Flutter Developer
Nabda Organization
- Data showcase app with form submission; responsive, cross-device UI
SEP 2021 — JUL 2025
B.Sc. Computer Systems Engineering
Al-Azhar University — Faculty of Engineering & Information Technology
- Cumulative average 87.12% — "Very Good" · 162/162 credit hours completed
- Recognised in Germany's ANABIN database (status H+)
- Advanced Software Engineering (97) · Advanced Software Design (97) · Data Structures (95) · Information Security (90)
Capability spec
The stack, audited.
Fintech
& Security
& Security
Passkeys / WebAuthn / FIDO2
Idempotency & intent hashing
Biometric & step-up auth
Keychain / Keystore
Certificate pinning & TLS
Anti-reverse-engineering
Payment gateways & wallets
Flutter
& Architecture
& Architecture
Flutter / Dart
GetX
Bloc / Cubit
Clean Architecture
MVVM
Design systems & theming
i18n — 7 locales, RTL
Accessibility
Platform
& Delivery
& Delivery
CI/CD (GitLab) & build hardening
Dio · REST · WebSockets / Socket.IO
Native iOS & Android integration
App Store & Play deployment
Firebase / GCP
Testing & QA
React / TypeScript
AI-assisted velocity (Claude Code, Cursor)
Currently open
Hiring for fintech mobile?
Let's talk before someone else does.
I answer fast on WhatsApp and email. Remote-first, EU Blue Card eligible, open to UAE relocation — and I can walk you through any of this code, live.