Ricardo Sierra
Available for projects
Rio de Janeiro · GMT-3

Ricardo
Sierra.

Full Stack Developer

Developer since 2004, building ERPs, multi-tenant SaaS, GraphQL APIs, mobile/desktop apps and cloud infrastructure. Specialized in Laravel, Next.js, Rust and AWS ecosystems.

Experience 20+ years
In production 25+ systems
Research 2 CVEs
01 / Highlight
20+
Years of experience · since 2004
Shipping production software for more than two decades — from PHP 4 to Rust on native desktop.
02 / Stack
25+
Systems in production
↗ active
03 / Open Source
50+
Public repositories
↗ 1.6k/yr
04 / Research
2
Published CVEs
RSC/Next
about-me.md

From legacy monolith to serverless microservice — I design, build and maintain the whole stack.

Ricardo Sierra · Rio de Janeiro, BR · 2004 → present

I've been coding since I was 9: I learned scripting in RPG Maker back in 2004 and never stopped. From anima10 (my first site, a joke site) to two CTO roles (Bilo, Musicx) and products in production, I've built — from scratch or in a team — systems ranging from professional photography platforms with facial recognition at scale (Banlek, ~19 integrated modules, 120k DAU on iOS and Android, Top 69 App Store) to crypto futures trading bots in Rust+Tauri, movie social networks, school transport SaaS, and even published CVEs in RSC/Next.js security research.

I'm equally comfortable refactoring thousand-table PHP 7.4 monoliths and designing serverless microservices on Lambda. I've worked across web, mobile (React Native + Flutter), desktop (Tauri 2) and multi-cloud infrastructure with Terraform — when I join a product, I can usually cut through every layer without handing the problem off.

My obsession is leaving behind code that other devs can understand, maintain and evolve. Strong typing, tests, observability, documentation — not as a goal, but as tooling.

Well-written code is code that other developers can understand, maintain and evolve.
02Specialties

Eight disciplines,
from start to finish.

From API to deploy, from database to pixel — I work across the entire product lifecycle. Every discipline is hands-on, in real production systems.

/ 01
⚙️

Backend Engineering

RESTful APIs, GraphQL, clean architecture, DDD and complex integrations in production.

PHP 8.3Laravel 13Node 22Python
/ 02
🎨

Frontend Engineering

Responsive, accessible interfaces with SPA/SSR, carefully tuned performance and DX.

React 19Next.js 16InertiaLivewire
/ 03
🏗️

Software Architecture

Modular monoliths, microservices, GraphQL, event-driven with SQS/SNS, queues and DDD.

DDDCQRSEvent-DrivenSOLID
/ 04
🚀

DevOps & Cloud

AWS Suite (Lambda/S3/SQS/RDS), Docker, K8s, multi-cloud Terraform, Ansible.

AWSDockerTerraformK8s
/ 05
🔒

Security & AppSec

OWASP, cryptography (Ed25519/X25519/AES-GCM), RCE research with published CVEs.

OWASPEd25519JWTCVE
/ 06
🧪

Testing & Quality

TDD with Pest/PHPUnit/Vitest, code review and static analysis as routine.

PestPHPUnitVitestPHPStan
/ 07
📱

Mobile & Desktop

Cross-platform apps in production: iOS, Android and native desktop with Tauri 2.

React NativeTauri 2FlutterSwift
/ 08
⚡

Real-time & FinTech

WebSockets, Rust + Tokio, Binance/Kraken integration, Bitcoin/Lightning/BTCPay.

RustTokioBTCPayBinance
03Tech stack

Tools I use
every single day.

More than 60 technologies grouped into 8 categories — all battle-tested in production, not just in the README.

01

Languages

10 technologies
PHP 8.3TypeScriptJavaScript ES2024 RustPythonDart SQLBashHTML5CSS3
02

Backend

08 frameworks
Laravel 13SymfonyNode.js 22 ExpressNestJSTokio + Axum FastAPIDjango
03

Frontend

10 frameworks
React 19Next.js 16Inertia.js Livewire 3Vue.jsNuxt Tailwind v4Alpine.jsFlutterTauri 2
04

Databases

07 engines
PostgreSQLMySQL 8MariaDB MongoDBRedisElasticsearchSQLite
05

Cloud & AWS

10 services
LambdaS3Rekognition SQS / SNSRDSCloudFront Route 53IAMSESOracle Cloud
06

DevOps & IaC

09 tools
DockerKubernetesTerraform AnsibleGitHub ActionsGitLab CI/CD NginxLinuxSentry
07

FinTech & Crypto

07 integrations
BTCPay ServerBitcoin CoreLightning Liquid NetworkBinance FuturesKraken FuturesWebSockets
08

Practices

10 tools
GitVS CodePhpStorm Filament 5PostmanREST GraphQLTDDScrumKanban
04Projects · grid

Twelve projects,
a single filter.

SaaS, FinTech, mobile, desktop and security research — click the chips to filter.

🏢
SaaS

Banlek

Architect · 19+ modules · 120k DAU/app

Professional photography with AWS facial recognition. iOS + Android apps (Top 69 App Store) and Banlek Uploader in Rust.

LaravelNext.jsReact NativeRust
🛰️
FinTech

RoboTrade

Rust · Desktop

Desktop crypto futures trading bot. Direct Binance/Kraken Futures connection over WebSocket.

RustTauri 2TokioAxum
🎬
Social

IndicaFilmes

Solo · Full stack

Letterboxd-style Brazilian Portuguese movie social network. Letterboxd/Netflix list import, TMDB.

Laravel 12Livewire 3PostgreSQLTMDB
🚐
SaaS B2B

Rotaë

Full stack · Flutter app

Multi-tenant school transport SaaS: GPS, route optimization, parent-school communication.

LaravelFilamentFlutterWebSocket
♻️
ESG

Ecoleta

Solo · Full stack

Corporate website for waste management with traceability and ESG metrics.

Next.js 16React 19Tailwind v4Resend
🪙
Crypto

BitTrade

Architect · Matching engine

Multi-currency wallet + matching engine. Bitcoin Core, Lightning Network, Liquid, USDT via BTCPay.

Laravel 12BTCPayBitcoinLightning
🧠
HealthTech

Crescere

Full stack · MVP

Mental health for caregivers of children with ASD. "Lia" chatbot powered by OpenAI for screening.

Next.jsLaravelFilamentOpenAI
⚔️
Real-time

RiCaFight

Architect · Rust · Server

1v1 game with deterministic replays. Authoritative Rust server + Tauri client.

RustTokioTauriCanvas 2D
💬
Cross-platform

Prompty

Solo · Tauri + Flutter

Prompt manager with desktop + mobile sync via Supabase. Backup, search, organization.

Tauri 2SupabaseReactFlutter
🔒
Security

CVE-2025-55182

Researcher · PoC + Toolkit

RCE in React Server Components / Next.js. Defensive toolkit on GitHub.

Chrome ExtPythonShodanRSC
05Full catalog

Portfolio,
expanded.

The whole catalog, grouped — from the Banlek ecosystem to my own products and security research.

📸

Banlek · apps in production

professional photography platform · real scale

120k DAU each · Top 69 App Store
🍎
iOS appReact Native · Swift modules · 120k DAU · Top 69 App Store
🤖
Android appReact Native · TypeScript · 120k DAU · Play Store
🖥️
Banlek UploaderNative Rust desktop · batch upload for photographers
🚀

Own products & shipped MVPs

original systems from scratch · concept, build and operation

8 products
🎬
IndicaFilmesBrazilian Portuguese movie social network
♻️
EcoletaESG site · waste management
🚐
RotaëSchool transport SaaS + app
🧠
CrescereHealthTech · AI for ASD
💬
PromptyCross-platform prompt manager
🛰️
RoboTradeCrypto futures trading bot
🪙
BitTradeBitcoin wallet/exchange + BTCPay
⚔️
RiCaFight1v1 multiplayer game with a Rust server
🌐

Corporate websites (Rica/Sierra Group)

all in production · self-managed multi-cloud infrastructure

5 sites · in-house IaC
🏢
ricasolucoes.com.brIT consulting services · digital transformation
⚙️
sierratecnologia.com.brCustom software development · transparent pricing
🛡️
segurossierra.com.brInsurance brokerage (Rita Sierra / SUSEP)
🏛️
sierraarquitetura.com.brArchitecture & civil construction
👤
ricardosierra.com.brThis portfolio
🧱
Self-managed infrastructureTerraform AWS + Oracle · Ansible · Nginx
🔒

Research & Open Source

Published CVEs and libraries with verifiable code

2 CVEs · public libs
🛡️
CVE-2025-55182RCE in React Server Components / Next.js
🛡️
CVE-2025-66478Complementary RSC/Next.js vulnerability
🧰
Defensive toolkitChrome Ext + Shodan Detection + Proxy Helper
🧾
Surfmaps NFSEPublic npm library for NFS-e (Brazilian e-invoicing)
security research

Security research, published.

CVE-2025-55182 and CVE-2025-66478 — RCE discovery and PoC in React Server Components / Next.js. Defensive toolkit (Chrome Extension + Shodan Detection + Proxy Helper) available on GitHub as a reference for AppSec teams.

view toolkit on github view on NVD →
Disclosed HIGH · 8.1 CVSS
CVE-2025-55182
Remote Code Execution via React Server Components serialization handler in Next.js apps.
Affects: Next.js < 15.1 · RSC pipeline
CVE-2025-66478
Complementary disclosure: payload-chain expansion in the RSC pre-render flow.
Status: Published · PoC available
open source

50+ public repositories
on GitHub.

Contributions, libraries and personal projects, all public. Real code, daily commits, issues closed — not a showcase.

visit @ricardorsierra
@ricardorsierra
Full Stack Developer · Rio de Janeiro, BR
54Repos
1.6kCommits/yr
2CVEs
PHP 28%
JavaScript 22%
TypeScript 18%
Rust 14%
Python 10%
Dart 8%
06How I can help

Four ways
to work together.

From product concept to evolving legacy codebases — continuous delivery and clear communication.

01 · Development

Custom software development

From MVP to production SaaS. Platforms, ERPs and mobile/desktop apps — concept, build, deploy, operate.

  • Technical discovery & stack definition
  • Scalable, modular architecture
  • Iterative delivery in sprints
  • Web + mobile + desktop when it makes sense
02 · Architecture

Legacy modernization & consulting

Migrating monoliths to modern architectures. GraphQL, serverless microservices, event-driven — without stopping the product.

  • Technical audit with an actionable report
  • Safe incremental refactoring
  • Cloud migration (AWS / multi-cloud)
  • DDD, CQRS and event sourcing patterns
03 · Mentoring

Code review & pair programming

1:1 mentoring for junior and mid-level devs, with pair programming, PR reviews and a personalized technical roadmap.

  • Code review with actionable feedback
  • Pair programming on real cases
  • Study plan by level and stack
  • Technical career design
04 · Performance & AppSec

Audit, hardening and optimization

Profiling, query and cache optimization, OWASP hardening, threat modeling. RCE research applied to defending your product.

  • Profiling and hot-path optimization
  • OWASP Top 10 hardening
  • Threat modeling and cryptography review
  • Cloud cost reduction
let's talk

Shall we work
together?

Available for freelance projects, architecture consulting, legacy modernization and custom software development. Get in touch and let's build something great.

[email protected] linkedin github

Frequently asked questions

Common questions from people about to commission custom software development.

Who is Ricardo Sierra?

Ricardo Rebello Sierra is a full stack developer based in Rio de Janeiro with more than 20 years of experience — he has been programming since 2004. He was CTO at two companies, Bilo and Musicx, and has served enterprise clients such as Ericsson, Merck Colombia, UERJ and DPVAT. Today he has more than 25 systems in production and 50+ public repositories on GitHub.

What kind of systems does Ricardo Sierra build?

He builds custom digital products: ERPs, multi-tenant SaaS, web platforms, APIs and mobile and desktop apps. The work covers the full cycle, from MVP to a system running in production — concept, build, deploy and operation. Delivered projects include the professional photography platform Banlek, the school transport SaaS Rotaë and the movie social network IndicaFilmes.

Does he build APIs and integrations between systems?

Yes — RESTful and GraphQL APIs, complex integrations and event-driven architectures are among his main areas of work. The backend follows clean architecture, DDD and CQRS, with queues and messaging via SQS/SNS when volume calls for it. Services such as TMDB, AWS Rekognition, Binance and Kraken Futures and BTCPay have already been integrated into production systems.

Which technologies and languages does he use?

The main stack is PHP 8.3 with Laravel 13 on the backend and React 19 with Next.js 16 on the frontend, plus Rust, Node.js 22 and Python. There are more than 60 technologies grouped into 8 categories, all proven in production — including PostgreSQL, MySQL 8, Redis and Elasticsearch for databases. On infrastructure, AWS, Docker, Kubernetes, Terraform and Ansible.

Does he build mobile and desktop apps?

Yes, with cross-platform apps in production for iOS, Android and native desktop. The Banlek iOS and Android apps were built in React Native and have 120k daily active users each, reaching the Top 69 most downloaded on the App Store. On desktop the stack is Tauri 2 with Rust, as in Banlek Uploader and the RoboTrade trading bot.

How does the working process and project delivery work?

The project starts with a technical discovery and stack definition, followed by system architecture design and iterative delivery in sprints. In practice, the client sees working software from the very first cycles instead of waiting for a single delivery at the end. Web, mobile and desktop enter the scope when they make sense for the product.

Does he work with legacy systems and refactoring?

Yes — migrating monoliths to modern architectures is one of the four areas of work, done incrementally and without stopping the product. It starts with a technical audit and an actionable report, then moves on to safe refactoring, cloud migration and the adoption of patterns such as DDD, CQRS and event sourcing. The experience ranges from PHP 7.4 monoliths with a thousand tables to serverless microservices on Lambda.

Does he handle infrastructure, servers and deployment?

Yes, DevOps and cloud are part of the scope: AWS with Lambda, S3, SQS and RDS, plus Docker, Kubernetes, multi-cloud Terraform and Ansible. The infrastructure behind the five Rica/Sierra group sites, for example, is provisioned with Terraform on AWS and Oracle Cloud, served by Nginx and configured with Ansible. Observability and error monitoring come in with Sentry.

Does he do security audits and performance optimization?

Yes — audit, OWASP Top 10 hardening, threat modeling and cryptography review form a practice of their own, alongside profiling and query and cache optimization. The foundation is applied security research: two published CVEs, CVE-2025-55182 and CVE-2025-66478, both remote code execution in React Server Components and Next.js, the first rated HIGH with CVSS 8.1. There is also a public defensive toolkit with a Chrome Extension, Shodan Detection and Proxy Helper.

How do I hire Ricardo Sierra?

Contact is by email at [email protected], with profiles also on GitHub and LinkedIn. He is available for freelance projects, software architecture consulting, legacy modernization and custom software development. There is also 1:1 mentoring for junior and mid-level developers, with code review, pair programming and a personalized technical roadmap. He is based in Rio de Janeiro, GMT-3.

English