Ubaid Ullah

Developer and Security Engineer, freelance

• Found a business logic flaw during testing: "Contact for Price" products carried a hidden price of $0, and attackers were using it to place orders for free. Caught the fraudulent orders before any shipped, closed the flaw, and added detection for zero-value and suspicious orders.
• Built Cloudflare defenses against competitor price scraping, fake carts and orders, and form spam using custom WAF rules, rate limiting and bot management. Rolled new rules out as challenges first, tuned them against security events, and added skip rules for legitimate services before switching to blocks.
• Found and locked down publicly exposed files and endpoints.
• Automated security review with LLMs: an AI reviewer runs on every pull request in CI, and a Shopify order webhook sends each new order for fraud screening. Risky orders are held, tagged and alerted on.
• Built a custom Shopify app in TypeScript for catalog sync, bulk editing, bulk import and image uploads.
• Built internal automation for supplier data scraping, price monitoring, catalog cleanup, order reports, and on-demand retrieval of operation manuals from supplier websites.

Python Developer, freelance

• Build crawlers for large e-commerce targets protected by Cloudflare, Akamai, PerimeterX and Google's bot defenses.
• Use AI end to end: generating crawlers, detecting blocks and retrying with a new approach, repairing broken selectors, and agentic workflows that run whole fix cycles.
• AI-driven extraction reached 99% data point coverage on unstructured product pages.
• Resilient selectors cut data errors by 25% across 10+ projects.

Backend Python Developer, freelance

• Built the MVP backend with FastAPI and event-driven microservices on AWS.
• Secured the APIs with JWT and OAuth authentication.
• Set up Dependabot for dependency vulnerabilities and Copilot code analysis on pull requests.
• Designed RabbitMQ message handling with transactional patterns so no data was lost when services crashed.

Senior Software Engineer

• Built 100+ crawlers focused on ban evasion and browser fingerprinting, including authenticated social media targets like Facebook and LinkedIn.
• Bypassed bot protection with TLS/JA3 fingerprint matching, headless browser patching, reversing anti-bot JavaScript, and residential proxy and session management.
• Reverse engineered mobile app APIs by hooking apps with Frida and bypassing SSL pinning.
• Built and owned security for the internal ECS job dashboard (React, Python), which replaced AWS console access for the team:
  • Authentication with role-based permissions, a least-privilege IAM role for the backend, and no AWS secrets in code.
  • Audited it against the OWASP Top 10 and pentested it before rollout.
  • Audit logging of who ran, stopped or changed each job.
  • Automated ongoing checks with Dependabot and static analysis in CI.
• Built a daily AWS usage monitor with outlier detection and Slack alerts.
• Cut AWS storage cost by 80% by purging millions of stale files from EFS.

Live Data Operator, freelance

• Monitored live match data systems during esports broadcasts and fixed integrity issues in real time.
• Built a Chrome extension that automated workflows across ProDB, FACEIT and Ubeya, removing a large amount of manual work for operators.