Babul Jack — Full-stack engineer & web security specialist

Full-stack engineer · Web security

I build secure, real-time software — and I know how it breaks.

Full-stack engineer with 6+ years in web development and web security. I build web platforms, AI pipelines, Android apps and cloud infrastructure — from an NFC payment ring to an AI supplier-sourcing platform. My toolkit: Python, Django, FastAPI and React, plus a bug-bounty hunter’s instincts.

Explore my workContact me

01Secure payments
02Real-time systems
03AI-driven products
04Offensive security

01About

Builder by trade, breaker by training.

I’m Babul Jack — a full-stack engineer with more than six years in web development and web security: building platforms, and learning exactly how they fail. Today I work on the backend and AI pipeline of Zourvex, an AI supplier-sourcing platform under Dragon Sourcing. Before that, at VezoPay I led the web dashboard and designed and built the Android app behind its NFC payment ring; at FourtCourt I designed a fuel-station management system from scratch; and at VL Inc I developed and supported an AI-driven web platform.

Alongside product work I hunt vulnerabilities on platforms like HackerOne and Bugcrowd. Security teams at organizations including the BBC and Facebook have thanked me for my work, and I’ve been invited to 40+ private programs. That habit shapes how I build — card details kept off the device at VezoPay; IP-based authentication, role-based access and device fingerprinting on the fuel platform — and it’s why I chase hard problems down to the root cause.

ProfileOpen to new projects

Focus: Full-stack · Payments · Security
Experience: 6+ years
Recent work: Zourvex · VezoPay · FourtCourt · VL Inc
Core stack: Python · Django · FastAPI · React · Kotlin · AWS
Languages: English · Bangla · Hindi · Urdu

How I work

01
Secure by construction
Threat-model early and keep sensitive data out of places it doesn’t need to be — card details kept off the device.
Tokenized payments at VezoPay
02
Real-time where it matters
When operations move by the minute, the software should too. WebSockets and caching turn raw events into decisions.
Live pump monitoring, FourtCourt
03
Own the whole path
Database, APIs, web, Android and cloud in one head means fewer handoffs, faster fixes and clearer ownership.
Dashboard, Android app and AWS at VezoPay
04
Measure what moved
Work is judged by outcomes, not output — profit, reliability and time saved for the people using it.
+12% in testing · contributed to 30%

02Technical expertise

A full stack, secured at every layer.

Skills organized the way products are built — layer by layer, each one paired with the work it relates to. No percentages, just evidence.

Backend & APIs

Python services and APIs that integrate cleanly with payments, messaging and devices.

Python
Django
Django REST Framework
FastAPI
Django WebSockets
Payment processor integrations
Twilio

Related work

Backend services and APIs for Zourvex (Django / FastAPI)
Django + WebSockets for live pump status and transaction tracking
Secure backend APIs and tokenized bank / processor integrations at VezoPay

Everyday toolsGitRESTWebSocketsLinuxBurp SuiteTwilioRedisCI/CDOWASPPandas

03Selected work

Products that move money, data and devices.

Four products I’ve worked on, told through the problems they solve. The platforms are proprietary, so the visuals are concept visualizations — the roles, work and results are real.

02VezoPaySouth Africa2025—26

VezoPay

Contactless payments via NFC ring

A payment ring needs far more than a chip. For VezoPay’s wearable I led full-stack development of the web dashboard, designed and built the Android app that integrates the ring’s NFC and tokenization SDK, and architected the backend and AWS infrastructure underneath.

Web & Software Engineer

VezoPay · ring lifecycle

Concept visualization

Ring paired · activated

01 / 04
Pair & activate
Every ring is paired, activated and managed through its whole lifecycle — with activation built into the web dashboard I led.
02 / 04
Tokenize the card
Card details are tokenized through payment processors and banks, in line with Visa and Mastercard security standards, so they stay off the ring.
03 / 04
Tap to pay
The Android app I designed and built integrates the wearable's NFC / tokenization SDK, so a tap at the terminal is all it takes.
04 / 04
Monitor & control
Card onboarding and activity monitoring run on the dashboard over secure APIs — and lost or stolen rings are handled as a first-class case.

04Security research

Offense-informed engineering.

I hunt vulnerabilities alongside product work — and bring that instinct into every system I build. The result is software designed around how it will be attacked, not just how it should work.

~/security — zsh

01
Threat-aware architecture
Tokenized card data kept off devices, role-based access, IP-based authentication and device fingerprinting — patterns I’ve implemented in payment and operations platforms.
02
A reviewer who thinks like an attacker
The methodology I use on bug-bounty targets, pointed at your app before launch: authentication, access control, injection, SSRF and CSRF.
03
Hardening after launch
Security doesn't stop at release. I patch vulnerabilities and close gaps as part of post-launch support, as I did for VezoPay.

05Experience

Where I’ve shipped, and what it changed.

Fintech, fuel retail and AI products for companies in South Africa and the United States — from building platforms from scratch to post-launch support.

Feb 2025 — Mar 2026
South Africa
VezoPay
Web & Software Engineer · Contactless payments via NFC ring
Led full-stack development of the web dashboard for VezoPay’s payment ring, designed and built its Android app, and architected the backend and AWS infrastructure behind it.
Case study: VezoPay
- Led full-stack development of the VezoPay web dashboard: wearable activation, card onboarding and activity monitoring on secure backend APIs.
- Designed and built the Android app, integrating the wearable's NFC / tokenization SDK to enable secure contactless payments.
- Architected, deployed and maintained the backend server and database for scalability, high availability and consistent user data.
- Integrated third-party payment processors and banks via tokenization, in line with Visa and Mastercard security standards, keeping card details off the device.
- Worked on lifecycle management for wearables: pairing, activation, management and lost or stolen devices.
- Deployed and ran the platform on AWS with CI/CD pipelines and server monitoring.
- Worked with designers, QA and business stakeholders on a seamless end-to-end payment experience.
- Provided post-launch support: troubleshooting, patching vulnerabilities and improving features from user and payment-partner feedback.
Jun 2023 — Dec 2024
South Africa
FourtCourt
Senior Web Developer · Fuel Station Management System, built from scratch
Designed and developed a real-time fuel station management platform from scratch — monitoring, transactions, attendance, vehicles and the financial models behind them.
Case study: FourtCourt
Jul 2022 — Feb 2023
USA
VL Inc
Full-Stack Web Developer · Advanced Matrix Tree — AI-based web platform
Developed and supported the web application for an AI-based Advanced Matrix Tree system, including its affiliate program.
Case study: VL Inc
Alongside
Independent
Independent security research
HackerOne · Bugcrowd
Bug-bounty hunting on HackerOne and Bugcrowd, including invite-only programs. Security teams at organizations including the BBC and Facebook have thanked me for my work.

06Services

What I can do for your product.

Each service draws on my professional work or my bug-bounty research — framed by the outcome it buys you, with the proof right next to it.

One engineer from database schema to shipped dashboard.
Fewer handoffs, faster decisions and a codebase with a clear owner. I take a product from data model and APIs through web and Android front ends to a production deployment.
Proof: Led VezoPay’s web dashboard, designed and built its Android app, and architected the backend on AWS.
What you get
- Web apps and admin dashboards
- Django / FastAPI backends
- React front ends
- Android apps in Kotlin
Discuss this with me

07Milestones

Results, recognition and the paper trail.

years: 6+; years; across web development and web security
profit: +12%; profit; in initial testing of the fuel platform's margin and drive-away algorithms
profit increase: 30%; profit increase; that optimization work on VL Inc's platform contributed to
private programs: 40+; private programs; invitations to invite-only bug bounty programs

Recognition

Thanked by the BBC and Facebook
Recognized by security teams at organizations including the BBC and Facebook.
HackerOne & Bugcrowd
Researcher on both platforms, with invitations to 40+ private programs.

Problem-solving

Critical proxy issue
Solved in hours after it had stumped a team for two weeks.
Complex network problem
Fixed in 10 hours — others hadn't solved it in a month.

Education & certification

Certification in database programming
GPA 5.00 / 5.00
Bangladesh Technical Board
Higher Secondary Certificate
GPA 4.50 / 5.00
Secondary School Certificate
GPA 4.33 / 5.00

08Contact

Have something to build — or something to secure?

Tell me about the product, the problem and your timeline. I’d like to hear from founders, product teams and companies — about new builds, integrations or a security review.

contact@babuljack.com

Elsewhere

Open to new projects

01Dragon Sourcing2026—now

Zourvex

AI supplier sourcing, from discovery to RFQ

Zourvex is an AI-powered supplier-sourcing platform under Dragon Sourcing that takes procurement teams from a sourcing requirement to a qualified, defensible shortlist ready for RFQ. I work on the backend and the AI pipeline behind it.

Backend & AI pipeline engineer

Zourvex · sourcing workflow

Concept visualization · simulated data

Requirement

›

01requirement
Define
—
Brief ready
Plain-language brief, refined keywords
02suppliers found
Discover & validate
—
Websites processed, relevance classified
03reachable
Contact ready
—
Usable contact details confirmed
04responded
RFI pre-screen
—
Qualification questions answered
05shortlisted
RFQ ready
—
Advanced with decision context

AI does the groundworkSearch refinementWebsite processingRelevance signalsQualification data

Final decision · the buying team

The problem

Procurement teams struggle to turn a broad supplier search into a qualified shortlist they can defend. The validation work between discovery and RFQ is slow, manual and hard to justify later.

What I work on

Building backend services and APIs for the sourcing workflow in Python (Django / FastAPI) on PostgreSQL.
Developing the AI pipeline for supplier discovery and validation — refining search language, processing supplier websites and classifying relevance signals.
Implementing the workflow logic that moves suppliers from discovery through contact readiness and RFI pre-screening to RFQ.

Under Dragon Sourcing

Zourvex sits under Dragon Sourcing, a global sourcing and procurement services company founded in 2004 with a presence in more than 50 countries. The platform is built for enterprise and mid-market procurement teams, and for tail-spend categories.

Babul Jack — Full-stack engineer & web security specialist

Secure by construction

Real-time where it matters

Own the whole path

Measure what moved

Backend & APIs

Pair & activate

Tokenize the card

Tap to pay

Monitor & control

Threat-aware architecture

A reviewer who thinks like an attacker

Hardening after launch

VezoPay

FourtCourt

VL Inc

Independent security research

01End-to-end product engineeringOne engineer from database schema to shipped dashboard.

02APIs & real-time systemsLive data your team can act on the moment it changes.

03Payments & fintech integrationPayment flows that keep card data where it belongs.

04Security review & hardeningFind the holes before someone else does.

05Cloud deployment & DevOpsShip often without breaking production.

06AI pipelines & data featuresAI that speeds up the analysis while people keep the final say.

Recognition

Problem-solving

Education & certification

Have something to build — or something to secure?

Secure by construction

Real-time where it matters

Own the whole path

Measure what moved

Backend & APIs

Pair & activate

Tokenize the card

Tap to pay

Monitor & control

Threat-aware architecture

A reviewer who thinks like an attacker

Hardening after launch

VezoPay

FourtCourt

VL Inc

Independent security research

01End-to-end product engineeringOne engineer from database schema to shipped dashboard.

02APIs & real-time systemsLive data your team can act on the moment it changes.

03Payments & fintech integrationPayment flows that keep card data where it belongs.

04Security review & hardeningFind the holes before someone else does.

05Cloud deployment & DevOpsShip often without breaking production.

06AI pipelines & data featuresAI that speeds up the analysis while people keep the final say.

Recognition

Problem-solving

Education & certification

Have something to build — or something to secure?