Senior Mobile Engineer (Flutter) — Fintech, Payments & Mobile Security
Istanbul, Türkiye · open to relocation (EU Blue Card eligible)
Four years of production Flutter, specialising in the part where an app touches real money. Most recently a crypto & fiat wallet live on the App Store and Google Play — where I owned passwordless auth (passkeys/WebAuthn with step-up re-auth), idempotency across 15+ money-moving flows, SHA-256 intent hashing, crash-safe transaction lifecycles, and a CI/CD pipeline built from scratch.
I also architect and ship end to end: TruAlly is a multi-tenant B2B SaaS I built solo — Laravel 13, 27 bounded domains, 118 migrations, 1,570 tests, and tenant isolation that fails the CI build rather than trusting a convention.
Server-authoritative by default: the client displays and forwards — it never decides.
Most of my recent work lives in private and client repositories, so I published the proof instead — The Lab: seven working simulations of the patterns I ship, hand-coded in vanilla JS with zero libraries.
| Try to break it | |
|---|---|
| 💸 | Replay shield — pay on a dying network, get charged exactly once. Turn idempotency off and watch it triple-charge. |
| 🪝 | Webhook saga — kill the endpoint mid-payment; the incident retries itself to recovery. |
| 🔑 | Challenge–response — sign with a key that never leaves the phone; replay the signature and hit a burned nonce. |
| 💥 | Crash recovery — kill the app mid-transfer; the write-ahead journal + one idempotency key = exactly one charge. |
| 🔌 | Socket resume — reconnect with a cursor, replay the gap, drop the duplicate, ledgers agree to the cent. |
- portfolio — this site + The Lab. Hand-coded, zero frameworks, view-source is the feature.
- Flutter-Financial-Transaction-System — transaction safety in Flutter: idempotent money movement, crash recovery, OTP step-up, with written safety guarantees.
- reckon — a daily puzzle with zero backend: the puzzle is a pure function of the date, so every player worldwide gets byte-identical boards. Determinism proven by a 3-year forward sweep in CI.
Flutter Dart Laravel / PHP 8.3 Node.js Python TypeScript
MySQL PostgreSQL Redis WebSockets / Socket.IO Stripe RevenueCat
WebAuthn / FIDO2 Docker GitHub Actions GitLab CI