Jacob Spradlin

Remote

• Designed, built, and deployed fifteen-plus production applications end to end — schema and RLS policy design, authentication, payments, background jobs, AI features, CI, and deployment — as a solo engineer accountable for uptime and correctness.
• Ship on Next.js (App Router) and TypeScript against Supabase/PostgreSQL, Stripe, and Vercel, with Playwright and Vitest coverage and CI gates that block releases on regressions.
• Run security audits and architecture reviews for client codebases, delivering prioritized findings with severity ratings, reproduction steps, remediation runbooks, and operational recovery playbooks.
• Build AI features on the Claude API in production: streaming assistants, retrieval and ranking pipelines, document extraction, and cost/latency budgeting with retry-on-transient handling.
• Author reusable internal tooling — a portable end-to-end testing agent and a runnable security-audit harness — applied across projects rather than rebuilt per engagement.

AI hiring platform for security-cleared professionals

• Own technical direction and implementation for a two-sided hiring platform serving cleared candidates and defense-sector employers, spanning the web application and a React Native mobile client.
• Built the candidate/role matching system as a two-stage retrieval plus narrative ranking pipeline rather than an opaque score, so employers see the reasoning behind a match.
• Led remediation of a pre-launch architect-class security review covering 100-plus findings: established a finding-by-finding ledger, wrote per-finding runbooks for risky multi-step fixes, and closed 30 P1/P2 findings in four calendar days — the reviewer described the resulting drop in open severity as a dramatic collapse.
• Hardened the platform across Row Level Security, edge-function authorization, AI guardrails, CSP, webhook verification, and account-enumeration surfaces, then wired the resulting checks into CI so the same classes cannot regress.

LastCall Pro — two-sided marketplace with escrowed payments

Next.js · Supabase · Stripe Connect · Vercel Cron

Built the full booking and payment lifecycle for an on-demand marketplace connecting funeral homes with verified workers and suppliers: post, apply, accept, book, capture, hold in escrow, complete, release. Implemented credential and photo-ID verification gated per role, offline ZIP-centroid location matching with no paid geo API, and a server-recorded acknowledgment trail at apply time. Diagnosed and fixed a dormant 24-hour auto-release job that had been deployed but silently 307-redirected by middleware for 96 days, so escrowed payouts never actually transferred; rebuilt it as an hourly cron with a shared-secret guard and per-booking Stripe idempotency keys, then verified the whole path with real test-mode transfers.

Security architecture audit — lending CRM (client confidential)

Node.js · MySQL · Prisma · Redis/BullMQ · React

Fixed-price audit of an active production CRM holding roughly 23,000 lead records. Combined static review with authenticated and unauthenticated live probing to confirm findings behaviorally rather than theoretically. Delivered a prioritized findings report with severity ratings, plus a system control and recovery playbook, an access and ownership audit, and a cost-efficiency review identifying where custom complexity was not paying for itself.

GitHub organization access control — consulting firm

GitHub API · organization policy

Locked down a client organization before she handed repository keys to an outside development vendor: role and seat configuration, branch protection, and permission boundaries, every setting verified against the live GitHub API rather than the settings UI. Handed over a thirteen-slide plain-English guide written for a non-technical owner. Delivered inside a three-day window.

Military Transition Toolkit — content platform with a correctness gate

Next.js · Supabase · Flutter · CI

Consumer platform for service members leaving the military: 900-plus articles, 35 interactive calculators and tools, and a companion iOS app. State-by-state benefits and tax guidance is high-stakes for the reader, so I wrote a verification gate that parses comparison tables, bold-label bullets, and dollar caps against a source-of-truth data file. It surfaced 73 factual contradictions across 28 files, all corrected against primary sources; the gate now runs in prebuild and fails the production build on a regression.