Suleyman Musayev
I connect Intercom, Slack, Salesforce, Stripe, and the rest of your stack, and build the dashboards, secure logins, and in-house AI tools that take the busywork off your team. Senior engineer, custom code, fixed price per project.
10×
core business scale as sole architect
5×
faster backend after my fixes
Fixed
price per project, agreed up front
Yours
code, accounts, and credentials
What I build
Custom code in Ruby on Rails, Go, Python, React, or Hotwire. No chains of no-code automations that break quietly when one step changes.
Conversations tagged and routed on arrival, account and billing context pulled into the inbox so agents stop switching tabs, escalations posted to the right Slack channel, and SLA risks flagged before they turn into churn.
AI that runs on your own servers, so customer data never goes to a third-party AI provider. That matters for security, for your customers' privacy, and for rules like GDPR, HIPAA, and the data residency terms in your contracts. I fine-tune lightweight open-source models into experts on your subject, connect them to your internal tools, and debug them when the answers go wrong.
Intercom, Salesforce, Stripe, Slack, your own app, or any REST API. Verified webhooks, retries, and idempotent handlers, so a record is never written twice and a failed call never disappears silently.
Single sign-on over SAML and OpenID Connect with Entra ID, Cloudflare Access, or any identity provider. OAuth sign-in, passkeys, two-factor authentication, and bot protection with reCAPTCHA and Cloudflare Turnstile that stops fake signups without punishing real users.
REST APIs for your product with API keys, scopes, rate limits, and OpenAPI docs. OAuth provider or client, depending on which side of the connection you are. Clients for third-party APIs that handle pagination, retries, and token refresh.
Admin panels, ops consoles, and approval flows with roles and an audit log. The spreadsheet three people edit at once becomes a tool with one source of truth.
The numbers someone assembles by hand every Monday, live on one screen, plus scheduled digests to Slack or email.
My background is security engineering. Least-privilege API scopes, secrets kept out of code, signed webhooks, and audit trails come standard, because your tools touch customer data.
Recent work
Client and employer names are left out. Happy to walk through any of these on a call.
In-house AI, self-hosted
Lightweight open-source models fine-tuned into experts in one specific field, so they run in house on modest hardware instead of an expensive general model. Tuned the output language so answers read naturally to customers and improve their experience.
Top-10 global certificate authority
Sole architect of login and identity for tens of thousands of daily users: OAuth2, OpenID Connect, SAML, external identity providers, and the OAuth provider side, not only the client. Extracted authentication into its own service with sessions that work across services, and closed account-takeover and second-factor-bypass paths.
Top-10 global certificate authority
Layered signup defense with reCAPTCHA v2/v3 and Cloudflare Turnstile, plus countermeasures for human CAPTCHA farms that solve challenges by hand. Fake accounts stopped without adding friction for real customers.
SaaS product, Ruby on Rails
Full subscription lifecycle - checkout, upgrades, cancellations, refunds, failed payments, trial reminders, and disputes - driven by eight Stripe webhook events. Every event is recorded before it is processed, so Stripe's retries never charge, refund, or downgrade anyone twice.
SaaS product, Ruby on Rails + Python
Seventeen tools that let Claude work inside a user's own account, behind OAuth with PKCE, dynamic client registration, a mandatory consent screen, and the same read/write/admin scopes as the REST API. Shipped as a published Claude Code plugin with slash commands, skills, and an eval suite run before each release.
Standalone service, Go
A Go service where the web UI, the MCP endpoint, and a JSON API all run through one tool registry, so they cannot drift apart. Callers subscribe to state changes through HMAC-signed webhook callbacks, and every state change is written to an event log in the same transaction.
SaaS product, Ruby on Rails
Per-team notifications over Slack, email, and custom webhooks. Destination URLs are resolved and checked before use, so a customer-supplied webhook cannot be pointed at internal infrastructure.
SaaS product, Ruby on Rails + Hotwire
Internal console for users, teams, subscriptions, capacity, and monitoring stats. Moved the newsletter off a third-party email platform onto Amazon SES, with bounce and complaint handling over verified SNS notifications.
Top-10 global certificate authority
Internal detection and review tooling that pairs LLM-assisted pattern matching with human-led forensics, taking the team from first signal to mitigation in minutes instead of days. Also covered staff and admin activity, not only customer accounts.
How it works
01
A 15-minute call or a short message. Which tools, which steps, and how often.
02
What it will do, what it will not do, and how we will both know it is done. You pay per project, not per hour.
03
Code lives in your repository and credentials in your accounts from day one. You see working pieces at each milestone, not a big reveal at the end.
04
Setup notes, a runbook for when something breaks, and a fix window after launch included in every quote.
Stack
Ruby on Rails is home, but the job is to pick the right tool. I've shipped production code in everything below.
Open source
Libraries I built or maintain. Most live at the intersection of authentication, cryptography, and security tooling for Ruby.
Strict domain-name validation the way a certificate authority must: RFC 1035 labels, IDN/punycode, Public Suffix List, CA/Browser Forum wildcard rules, and IP, reserved-range, and reverse-zone detection.
View on GitHub
Safe, dependency-free CSR and X.509 certificate inspection - subject, SANs, key strength, weak-signature checks, and a pluggable Baseline Requirements policy.
View on GitHub
Lint or sanitize untrusted SVG - blocks scripts, event handlers, XXE, and external references, with a CLI and SARIF output for CI pipelines.
View on GitHub
OmniAuth strategy for OpenID Connect (OIDC) with first-class support for Microsoft Entra ID and Cloudflare Access.
View on GitHub
Lightweight IP geolocation lookup for Ruby - useful for fraud detection, access control, and request enrichment.
View on GitHub
Implementation of the Balloon memory-hard password hashing algorithm.
View on GitHub
Yescrypt password hashing implementation, the successor to scrypt.
View on GitHub
Advisory
Not every problem needs a full project. Sometimes your team needs a senior engineer to look at the plan, point out the risks, and say what to do next.
Running AI on your own infrastructure instead of sending data to an outside provider, for security, privacy, and compliance. Choosing the model, fine-tuning it, debugging it, and connecting it to your systems.
How your systems should talk to each other: API design, connecting tools like Stripe, Salesforce, Intercom, and Slack, and webhooks that never lose data.
A review of your login, account recovery, and payment flows, and a plan to stop fake signups, account takeover, and abuse.
Choosing and rolling out SSO, OAuth, passkeys, and 2FA without locking out your real users.
Certificate lifecycle, automation, and what new browser and industry rules mean for your systems.
Finding out why the app is slow, what to fix first, and what will break at the next 10x.
One-off review
A written report with what I found, why it matters, and what to do next.
Monthly advisory
Regular calls with your team, plus questions by email or Slack between calls.
Hands-on help
I work with your engineers on the fix, not only on the report.
Contact
Book a 15-minute call or send a short note about the tools involved and the steps someone repeats every week. You get a written scope and a fixed price back.