Full-stack engineer and independent application-security researcher, based in Chiang Mai, Thailand.

I build mobile and web products end to end (TypeScript, React Native / Expo, Node.js, Firebase and GCP). I also test web applications, APIs and smart contracts under authorised bug-bounty and audit programmes, which shapes how I build: authorisation enforced at the data layer, secrets never in the client, and releases verified against the built artefact rather than a green build log.

• firestore-marketplace-rules: tested Firestore security rules for a two-sided marketplace. Role checks, a job status machine and write-once audit records, with 61 emulator tests.
• Enforcing a job state machine in Firestore security rules: the write-up behind that repo.
• A cross-platform services marketplace (iOS, Android and web) built solo and shipped to the App Store and Google Play. See the portfolio.

TypeScript · React · React Native (Expo) · Node.js · Firebase (Auth, Firestore, Cloud Functions) · Python · Playwright · reading and auditing Solidity and Rust

Authorised bug-bounty and audit-competition work. Coverage summaries are on the portfolio; detail of unresolved reports is withheld under responsible disclosure.

Portfolio and contact form: worrachatrph.web.app