Highlights

I built and largely launched two healthcare software products solo. I did the product, architecture, AI/LLM engineering, DevOps, and security work each one needed, at the time it needed it. Below is the sharpest example from each section. Filter by category, or leave it on all.

  1. 01 · product

    I refused to ship a member-facing outcomes feature that used placeholder statistics. I held it dark instead, behind a hard, multi-part data-and-counsel threshold. (Medical Claim SaaS Platform)

  2. 02 · architecture

    I built the AI-facing payload as a whitelist-constructed object that holds only codes and IDs. Narrative text is structurally excluded before it can reach a prompt, not filtered out after the fact. (Medical Claim SaaS Platform, reasoning service's PHI firewall)

  3. 03 · dev craft

    I found that a third-party SQL parser's traversal missed window specifications and DISTINCT ON clauses entirely, then added a second, unconditional sweep instead of trusting the library's documented API. (Payor Rate Data Platform, query-safety layer)

  4. 04 · devops

    I root-caused a Terraform pipeline problem where an error-suppression flag combined with lost exit codes, letting failed plans report success and silently skip applies. Then I rebuilt the workflow to derive change counts straight from plan output. (Medical Claim SaaS Platform)

  5. 05 · AI/LLM

    I named a failure mode specific to LLM-backed apps. Every backend layer correctly reflected a state change within seconds, but the model kept asserting the old state because it anchored on its own prior turns, invisible to every database-level guard and every test that only asserts on rows. (Payor Rate Data Platform)

  6. 06 · data

    I structurally retired a disk-exhaustion failure class by moving raw-volume staging out of the database into an on-task columnar pre-aggregation step, so database load scales with deduplicated volume instead of raw volume. (Payor Rate Data Platform, capture pipeline)

  7. 07 · security

    I commissioned an independent security review before any real protected health data entered the system. I kept the system restricted to synthetic data until its top-severity finding closed. (Medical Claim SaaS Platform)

  8. 08 · incident

    I deliberately opened a locked-down service's public perimeter for roughly nine minutes to measure real traffic at the API level. I treated the clean result as proof the mechanism works, not as proof it's safe to leave open. (Payor Rate Data Platform)

Happy to walk through any of this in more depth. The specifics are the point.