John Sabo
Full-stack engineer · Security automation architect

John Sabo

Shipping production systems since 1994

I build and ship software: SaaS platforms, data engines, security infrastructure. Most of it solo. Sixteen products and projects shipped in 2026.

30+
years in production systems
16
products & projects shipped in 2026
2.76M
rows at sub-second search
14 yrs
GoDaddy ran my WAF unchanged
100K+
lines of production code
359
products in my live store
460K
contacts in my outreach engine

Selected work

Three of the nine products I shipped in 2026. All live, all built and deployed solo.

Home Staked Pre-launch

homestaked.com

Home Staked is a two-sided marketplace for Arizona businesses. Owners stake their real identity on their listing. That's what makes the reviews and the leads mean something. Consumers search 2.76 million businesses. Owners get a portal for listings, leads, reviews, messages, ads and billing.

The hard part was scale and money. Search had to stay under a second at 2.76 million rows, which took materialized views and trigram indexes. Three admin surfaces needed separate auth guards. Stripe subscription billing had to survive webhook replay without ever granting one payment twice. 172 tests cover it, across 79 migrations.

It's deployed with queue workers and websockets running as managed services. Final audit now, public launch next.

Laravel 12Filament 3PostgreSQLStripe CashierReverbHorizon
Home Staked — Arizona business directory homepage
56Klines of code
172tests passing
2.76Mdirectory rows, indexed

Andale Advertising Live

andaleadvertising.com

Andale Advertising runs the whole agency. Clients pick a service, pay with a card, then watch the work in their portal. Affiliates earn tracked commissions. The agency side handles clients, payments, reports and invoices from one admin panel.

The risk was all in the money paths. Live Stripe checkout with coupons. Referral tracking that has to hold for 30 days, with a commission ledger behind it. Webhooks for subscriptions and refunds. Twenty-one admin components, each of which has to be right the first time an invoice goes out.

It's live. Real Stripe payments run through it. 540 screens, 28 migrations.

Laravel 11Livewire 3PostgreSQLStripe (live)ElasticEmail
Andale Advertising — live agency SaaS homepage
36Klines of code
540screens
LiveStripe payments

John's Guides Live

americanjohn.com

I built John's Guides as a full digital products business. The part I'm happiest with isn't the storefront. It's the pipeline behind it. 359 certification study guides, everything from DCW caregiver certification to AWS exams to OSHA safety courses. Each one gets researched, written, laid out and packaged as a finished PDF with a cover, a cheatsheet and a cribsheet. One command takes a guide from a source folder to a product the store can sell.

Two storefronts exist because I rebuilt the first one. A static generator came first. Then I moved to a headless commerce system with digital order fulfillment, which handles the catalog and the bundles and the delivery. Transactional mail runs across six domains with rotating DKIM selectors.

It's live and selling. That project taught me more about running a products business than any consulting engagement did.

PythonJinja2MedusaNext.jsPostgreSQLStripe
John's Guides — certification study guide storefront
359products built and live
2storefront builds (static + Medusa)
6domains of transactional mail

Also shipped

Two more systems, both with screens you can look at.

Lono Security — consultancy homepage

Lono Security Live

lonosecurity.com

The production site for my own security consultancy. Services, booking, lead capture, nurture email. It also carries an AI-visibility stack. When someone asks an assistant for a security consultant in Phoenix, the site can come up. Built and deployed in one working session.

Command Center v2 — operations dashboard

Command Center v2 Live

internal ops dashboard

The control room for my automation stack. Twelve pages of pipeline state and worker health, plus live screenshots of what each worker is doing right now. It has a command palette because I live in it all day. Nobody sells a tool like this. I built one.

2026 shipping log

The rest of the year's work: platforms, tools, research and client engagements.

Product What it does Stack Scale
Outreach Campaign Engine The pipeline that does the prospecting work. It scores leads and drafts outreach with AI. Every draft goes in front of a quality panel of four model judges before anything sends. Sending is paced. Replies and bounces suppress the contact automatically. A/B testing ranks which model writes the best copy. Python · LLM panels 1,200/day
Proxy Infrastructure Platform A rotating proxy server I run myself. Its collection arm has harvested 721,000 proxies from more than 2,600 documented sources, and the server validates them across 11 protocol variants. Then it serves them with routing that pins each target to the same exit. MITM detection catches tampered connections. Managed as a service. asyncio · Redis · Docker 721K proxies
mega-search MCP Deep search infrastructure any AI agent can call. Sixteen engines sit behind it: the open web, archives, open directories, device search, even Tor onion sites. Sixteen social platforms too, including Reddit with full comment mining. Built as an MCP server and still maintained. Python · FastMCP 16 engines
Phoenix Builders A contractor's marketing site with a sales operation behind it: CRM, contracts, sales team tracking, commissions for affiliates. Ad campaigns and funnel reports are managed from the same admin. I built it three times, each one more complete than the last. Laravel 13 · Livewire · Filament 19 models
Quant Trading Platform A research platform for systematic trading. It backfills nine million price rows and runs 159 strategies through a daily tournament, then scores the survivors with GPU models that read news and filings. A review team of thirteen agents audits the work. A dashboard browses portfolios, funds and signals. Python · PostgreSQL · Flask 159 strategies
SubOracle A security proxy that sits between automation components and the SaaS APIs they touch. It enforces scoped credentials, route allowlists and read-only rules. Secrets get injected into requests without ever being exposed. OAuth2, HMAC, SigV4 and mTLS all work. Ships with an admin UI and an audit store. Go · SQLite 6.5K LOC
Account Recovery Playbook A playbook for recovering locked or hijacked business accounts. Eighteen revenue platforms covered: marketplaces, payment processors, social, app stores. Intake forms, authorization letters, evidence checklists and escalation paths for each one. Generalized from a real recovery that took eight weeks. SOP library · 24K lines 18 platforms
Voter Portal Security Assessment A security assessment of how U.S. voter portals verify identity, built only from public sources, with Maricopa County as the deep dive. Fifty states surveyed. Findings graded by evidence quality, 543 citations verified, advocacy letters written and ready to send. Research report 543 citations
DNC / TCPA Tracker An app for documenting robocalls and spam texts. It tallies statutory damages the way the law actually counts them, cross-references FCC complaint data and drafts the demand letter. Built after one too many illegal calls. Flask · SQLite 21 MB evidence
GEO & Security Practice Client audits for AI visibility and website security. Scoring methodology, schema fixes, llms.txt deployment, hardening. Ten-plus sites audited and two full engagements delivered, reports and remediation included. Audit toolkit 10+ sites
Upwork Proposal Pipeline An active pipeline for freelancing work. It searches Upwork, gates jobs on money and client quality, then ranks the survivors by expected value per connect. Proposals are drafted and submitted inside platform rate limits, tracked with a ledger. Playwright · Python Active daily

About

Thirty years of building systems that stay up. I started in 1994 at an Arizona ISP, designing the state's first shared hosting infrastructure back when hosting took a dedicated server per site. At GoDaddy I built the internal WAF. They ran it for 14 years without replacing a line of code, and when a company spun out of GoDaddy it took the mechanics and resold them. I co-founded a security data company after that. We recovered 400 petabytes of breached data and built a passive DNS platform watching 192 million domains. Then we sold the company. The years after that went to Swimlane SOAR architecture for Fortune 500 clients.

2026 is the year I went all in on building products instead of consulting about them. Nine of them shipped and deployed. SaaS platforms. A digital product business. Data pipelines and automation. One person did the work, with AI carrying the mechanical load while I reviewed every line that shipped. It's how a solo engineer delivers what used to take a team a quarter.

Architecture comes before code. Production standards apply from the first commit: tests, migrations, deploy scripts, monitoring. I hand over a running system you can operate without me. If you wanted a zip file, you'd hire someone else.

Based: Mesa, Arizona Certs: Swimlane SOAR Architect · Developer · Administrator · Shuffle Developer Availability: remote first, two weeks from offer

What I can build for you

Each one has shipped. The plain sentence is what it does for a business. The monospace line is the stack.

SaaS platforms

A complete online business you can charge money for: accounts, payments, an admin dashboard, the works. I built four this year. What you get makes money on its own, without a team behind it to finish the job.

Laravel 11-13 · Livewire · Filament · Stripe/Cashier · PostgreSQL · multi-tenant auth · queues · websockets · policy-based authorization

AI infrastructure

Custom AI tools that slot into how you already work. Search, analysis, drafting, automation. They can run on your own hardware if you would rather not send data out. I built a search engine that queries 16 sources at once. An image pipeline runs on a local GPU.

MCP servers · Ollama (local + cloud) · Stable Diffusion/ComfyUI · multi-agent orchestration · LLM evaluation · prompt engineering

Automation pipelines

Software that takes over the repetitive work: outreach, data processing, monitoring, form filling. Mine holds 460,000 contacts and sends 1,200 emails a day, each one passing a quality gate before it leaves. No human sits in the loop.

Python asyncio · PostgreSQL ETL · browser automation (Playwright/CDP) · proxy rotation · A/B testing · quality gates · circuit breakers

Security automation (SOAR)

Security tools that respond to threats on their own instead of waiting on an analyst. One SOC team I worked with cut its manual triage load by 87%. The firewall I built at GoDaddy protected their hosting for 14 years. Four SOAR certifications, all current.

Swimlane SOAR (certified Architect/Developer/Admin) · Shuffle · Splunk/SPL · WAF architecture · threat intel integration · IOC tracking · incident response

Data engineering at scale

Collecting and cleaning data at sizes most teams never touch. The largest database I have tuned serves 2.76 million rows and answers searches in under a second. Pipelines I've built move millions of records a day without a human babysitting them.

PostgreSQL (materialized views, GIN trigram, partitioning) · multi-source ETL · scraping at scale · enrichment · deduplication · record linkage

Full-stack web applications

Whole sites and web apps: accounts, databases, payments, admin panels. Marketing sites, e-commerce, internal tools. Everything I deploy comes monitored and documented. You can run it without me.

Laravel · Livewire · Filament · PHP 8.2-8.3 · PostgreSQL/MySQL · Stripe · Tailwind · Vite · Node.js/Medusa · Docker · systemd · nginx/Apache

Working on something?

If you need a platform built, a process automated, or your security team is drowning in manual work, say hello. One sentence about the problem is enough.

john@johnsabo.org