Miguel Sanz
available PT

Miguel Sanz Boragan Mid-level back-end software engineer · São Paulo, Brazil (UTC−3, 1–2 h ahead of US Eastern) · remote or on-site available · can start immediately

Back-end tested under load, with the source behind every number.

PHP/Laravel, Go and Python/FastAPI, with applied AI: a multi-tenant CRM, a messaging gateway, an API platform, LangGraph agents and a production migration to AWS. 2 years and 8 months in-house (Feb 2024 to Oct 2026) and freelancing since 2023; my last role was at a conversational-AI fintech.

See cases Résumé (PDF)
  • PHP · Laravel
  • Go
  • Python · FastAPI
  • Node · TS
  • PostgreSQL
  • AWS
  • LangGraph
gateway.go · outbox · workers
duration
10 min
rate
900 msg/min
failures
0%
p95
1.05 s
queued / in transitdeliveredsimulation using the load-test numbers (k6, mocked Meta API); 3 illustrative workers, the test used 24

What I delivered, with sources.

Numbers from load tests, CI, evals and the business. Each one links to the case it came from; estimates show the math.

900msg/min

on the Go gateway for 10 min, with 0% failures (mocked Meta API)

source: k6see case →

see evidence 
checks_succeeded...: 100.00% 49505 out of 49505
checks_failed......: 0.00%   0 out of 49505
e2e_first_ms...................: avg=920.04ms min=827ms    med=877ms   max=5.37s p(90)=968ms    p(95)=1.04s
http_req_failed................: 0.00%  0 out of 49505
inbound_message................: 9901   14.97598/s

k6 output for the full run (660 s, including warm-up). Over the measured 600 s window, p95 was 1.053 s.

1,770→ 0 errors

PHPStan/Larastan errors cleared in the multi-tenant Laravel CRM

source: CIsee case →

see evidence 
$ git show fbbf7bea:phpstan-baseline.neon | grep -c 'message:'
1770
$ grep -c 'message:' phpstan-baseline.neon
0

Larastan baseline (level 5): 1,770 error entries in the commit where I added Larastan to the project. Today, none.

120/120on the eval

AI router with 25% to 40% lower p50 latency (estimated) after dropping the reasoning level, without losing accuracy (6 cases × 20 runs)

source: eval (accuracy) + commit (latency)see case →

see evidence 
corta reasoning tokens + latencia em TODO turno (~-40% p50 vs high).
…
Validado N=20 x 6 casos = 120/120; suite de 35 frases-armadilha = 35/35.

Excerpt from the commit message that changed the router (original, in Portuguese). In English: “cuts reasoning tokens + latency on EVERY turn (~-40% p50 vs high) … Validated N=20 x 6 cases = 120/120; 35-trap-phrase suite = 35/35.” The code comment in the same commit estimates ~25%: there was no dedicated benchmark, hence the range.

8operators freed

~100 WhatsApp bots took over the debt-collection messages once sent by hand: about US$ 48k/year (R$ 240k) in manual work (estimate: 8 × ~R$ 2.5k/month)

source: math shown · US$ at R$ 5.05 (Oct 19, 2026)see case →

start
immediately
contract
remote contractor for companies abroad (Deel or similar, paid in USD); in Brazil, full-time employee (CLT) or contractor (PJ)
work setup
São Paulo (hybrid or on-site) or remote · UTC−3, overlaps US business hours and EU afternoons
looking for
mid-level back-end roles
English
intermediate (fluent technical reading), open to interviews in English
education
Bachelor’s in Software Engineering, UNINTER (in progress, 2026–2029)

In-house since 2024, freelancing since 2023.

From freelancing for small businesses to an AI fintech, via large-scale debt collection and data extraction.

mainPHP 8.4 · Laravel · Go · Python · FastAPI · Node.js · TypeScript · PostgreSQL · MySQL · AWS · Docker · LangGraph

qualityPest · PHPUnit · pytest · Go test · PHPStan · mypy · golangci-lint · k6

front-end when neededVue 3 · Inertia · React · React Native

also usedSQL Server · MongoDB · Redis · Java · Spring Boot

  1. Jan 2026 – Oct 2026

    Back-end Software Engineer · Evig

    Back-end and infra for a conversational-AI fintech (Brazil’s Open Finance, WhatsApp and agents). I built the Go messaging gateway and the FastAPI API platform from scratch, was the top contributor to the Laravel CRM (48% of commits), ran the production migration from GCP to AWS end to end, and worked on the finance and credit AI agents. The company shut down in October 2026 after running out of funding.

  2. Feb 2024 – Jan 2026 · then freelance on demand

    Full Stack Engineer · Digital LZ

    Built about 100 WhatsApp debt-collection bots in Node/TS (freeing 8 operators for other roles), a self-service debt-settlement portal and the Robot Portal for monitoring. Since leaving, I do one-off fixes on demand, outside business hours.

  3. Jan 2023 – Jun 2026 · outside business hours

    Freelance Developer · self-employed

    Accusense (Feb–May 2026): news extraction API built from scratch in Laravel and MongoDB, with automatic feed collection, replacing the manual work of 3 operators. Before that: web automation with Puppeteer and a PostgreSQL queue, digital guest check-in in Vue 3 and PHP websites for small businesses.

  4. education

    Software Engineering · UNINTER, in progress (2026–2029)

    Technical diploma in Systems Development from ETEC, a São Paulo state technical school (2023–2025), focused on full stack and cybersecurity. Instituto PROA (career-training program, 2025), Linux Fundamentals (FIAP), Digital Safety and Security Awareness (Cisco) and 3rd place at FIAP’s Java.Xpert Hackathon.

People I’ve worked with vouch for me.

Recommendations received on LinkedIn, translated from Portuguese: from my mentor, my direct manager and a teammate at Evig.

Gabriel Cano (opens in a new tab) Tech Lead at CRMBonus

was my mentor · Oct 2026

Honestly, I’m impressed by how competent and dedicated Miguel is.

His dedication to studying and growing professionally, keeping up with what the market demands, has quickly made him the kind of professional every company wants.

read full

He has a rare grasp of the business side, always looking to make new products possible and to remove the blockers that hold the business team back.

He has broad knowledge of artificial intelligence, from training models to building well-optimized, advanced workflows.

He still has a bright future ahead, but I already see him as a true “one-man company”, since he can single-handedly take on many demands that go well beyond his back-end role.

Julio Barros (opens in a new tab) Founder and CEO at Evig

was my direct manager · Oct 2026

I led Miguel at Evig and I can say without exaggeration: he’s one of those people who raise the bar for the whole team. In a short time he took on very different areas, from infra to AI, and nailed all of them.

read full

He’s the one who ran the migration of our production from GCP to AWS, built our observability from scratch and created the Go messaging gateway that carries our WhatsApp conversations, and held up even under our heaviest load tests. He also played a huge role in our AI solution: he made agent routing much faster without losing accuracy, and built the platform’s RAG copilot.

But what struck me most was the way he works. Miguel is truly meticulous (he tests everything, thinks about security, goes after the root cause of every problem) and still delivers fast. He’s autonomous, takes ownership of what he builds and is a real pleasure to work with.

I recommend Miguel without hesitation. Any back-end, infra or AI team will be lucky to have him around.

Humberto Fernandes (opens in a new tab) Software Engineer · Java back-end and AI

was my teammate at Evig · Oct 2026

I recommend Miguel Sanz Boragan as a Back-end Software Engineer. At Evig, he was responsible for the complete migration of our infrastructure from GCP to AWS, running the project autonomously from planning to execution and finishing it on a tight timeline.

read full

Technically, he stands out in software architecture, PostgreSQL, API development and integrations, with constant attention to system quality and reliability. On top of that, he brings a sense of responsibility, clear communication and a willingness to collaborate with the team. He’s a professional I recommend with complete confidence.

see the originals on LinkedIn (opens in a new tab)

Problem, decision, result.

Professional work in private repositories. I use AI agents day to day; I review, test and own every line I ship. I can walk through the architecture and decisions in a technical interview.

Evig · designed and built from scratch (69% of commits)

WhatsApp messaging gateway in Go

No customer message on WhatsApp could be lost, duplicated or delivered out of order.

900 msg/min · 0% failures · p95 1.05 s

problem

Messages from the CRM and the AI agents had to go out over WhatsApp without duplicates, without losses and in conversation order, even with retries, deploys and several workers in parallel.

decision

Ports & adapters, a PostgreSQL outbox with FOR UPDATE SKIP LOCKED, 3-layer idempotency (webhook receipt, turn dispatch and outbox dispatch) strict ordering per conversation (lane with fencing token) and per recipient in the outbox. 100% coverage gate on every PR; gosec and govulncheck in a nightly job.

result

900 msg/min for 10 min, 0% failures and a p95 of 1.05 s from webhook to reply, in the k6 load test with fixed-delay mocks (200 ms for the AI, 550 ms for Meta): the gateway’s own p95 overhead was 303 ms. 9,901/9,901 delivered over the full run (11 min, including warm-up). It measures the gateway, not WhatsApp end to end.

trade-offs and limits

  • Outbox in PostgreSQL itself, no broker yet, behind an interface that allows swapping one in: fewer moving parts, with the database as the bottleneck.
  • Load-test ceiling: RDS CPU (70% gate at 20 msg/s; 15 msg/s is the highest confirmed rate, the 15–20 range wasn’t refined), far above the real production peak (41 messages in 5 min).
  • One suspect was the status lookup by provider_message_id, which had no index (Seq Scan in EXPLAIN); a teammate added the index later (migration 015), but no new load run has measured it yet.
  • No reaper yet: if a worker dies mid-send, the message stays in sending and isn’t resent automatically, because there’s no way to know whether Meta already got it. Once its 5-min lease expires, the message merely stops holding back that customer’s next ones. I’d rather resend by hand, after checking with Meta (no written runbook step yet), than risk a duplicate; try it by taking down a worker in the simulation at the top.
  • Meta’s rate limit is still handled reactively.
  • Go
  • PostgreSQL
  • Outbox
  • k6
  • Prometheus

open code: the same pattern rewritten from scratch, reaper included (opens in a new tab)

Evig · top contributor (48% of commits)

Multi-tenant CRM in Laravel

PHPStan 1,770 → 0 · 2,100+ tests · 197 PRs

In a production CRM shared with other devs, with everything going through pull requests (197 of them mine), I took PHPStan/Larastan from 1,770 errors to zero, wrote 94% of the test files (304 of 322), fixed a cross-tenant IDOR vulnerability and upgraded the project to PHP 8.4 / Laravel 13.

see problem, decision and trade-off

Problem: a multi-tenant CRM in production, with other devs working on it at the same time and no static analysis. When I added Larastan (level 5), 1,770 errors showed up; and a route let one company’s admin edit another company’s employees.

Decision: adopt a baseline so the team wouldn’t be blocked, then clear it gradually, in small PRs with tests; every employee lookup is now scoped to the caller’s company, with a 404 for outside IDs and a regression test per route.

Trade-off: a baseline means living with known errors for a while, in exchange for not stopping delivery.

  • PHP 8.4
  • Laravel 13
  • Larastan
  • Pest
  • Inertia + Vue 3

open code: tenant isolation and the IDOR regression tests rewritten from scratch, with idempotent reminders (opens in a new tab)

Evig · infrastructure

Production migration from GCP to AWS

secrets in SSM via OIDC · zero static keys in CI

I ran the move of the production database and instances to RDS and EC2, from planning to execution, with secrets in SSM via OIDC across all projects and observability with Prometheus and Grafana. The incidents that came later are in the log below.

  • AWS
  • OIDC
  • SSM
  • Prometheus
  • Grafana

Evig · AI agent supervisor

Faster AI router without losing accuracy

120/120 in the eval · p50 −25 to 40% (estimated)

I lowered the reasoning level of the router (the supervisor that picks the agent) from “high” to “low”, for 25% to 40% lower p50 latency (estimate from the commit and the code, no dedicated benchmark). “Low” missed ambiguous configuration requests; I fixed that with contrastive examples in the prompt until it was back to 120/120 (6 cases × 20 runs, to measure stability) and 35/35 on a trap-phrase suite. It’s a small suite: it guards against regressions on these cases but doesn’t prove general accuracy.

  • Python
  • LLM
  • evals
  • prompting

Evig · API platform

Modular monolith in FastAPI

100% branch coverage gate in CI

One repository and one quality pipeline for two deployables isolated by import-linter contracts: independent packages and layers that only depend inward. OpenAPI contract locked in CI and connection pool cut from 20 to 8 per replica on the shared database.

  • Python
  • FastAPI
  • PostgreSQL
  • OpenAPI

Evig · Open Finance · credit · contributor

AI agents for finance and credit

every number checked against the data, never made up by the model

On a team building agents on top of Brazil’s Open Finance (open banking), my part was: connecting, refreshing and removing banks with confirmation; the smart-budget agent, with deterministic setup and confirmation of every edit; financial grounding in the prompt; LangGraph threads scoped per session; and, in the supervisor, the credit soft-lock and each agent’s boundaries. The router above is that supervisor, picking which agent handles each message.

  • Python
  • FastAPI
  • LangGraph
  • Open Finance

Evig · platform copilot · 98% of commits

Multi-tenant RAG copilot

tenant isolation tested · 740 tests

A FastAPI service with conversation memory and RAG over uploaded files: admin documents apply to the whole company, each user’s documents stay private, and a tenant_id in the request body is only used to reject cross-tenant access, with a test for it. Architecture contracts in import-linter and mypy in CI.

  • Python
  • FastAPI
  • RAG
  • PostgreSQL

Accusense · freelance project · 63% of commits

News extraction API

−99% collection cost · ~US$ 21k/year (R$ 107k, estimate)

I built a generic 5-layer extraction engine from scratch in Laravel 12 and MongoDB (no per-site selectors), with feed discovery, deduplication, a queue pipeline and retries with backoff. It replaced the manual collection done by 3 operators (about R$ 3k, ~US$ 600, a month each), who moved to other roles, and costs ~US$ 15/month to run on AWS, and it has collected ~25k articles from 300+ sites. 120+ tests on the engine.

  • Laravel 12
  • MongoDB
  • Queues
  • PHPUnit

Digital LZ · WhatsApp debt collection

Debt-collection bots and self-service settlement portal

8 operators freed · ~US$ 48k/year (R$ 240k, estimate)

About 100 Node/TS + Prisma bots on SQL Server, sending up to 20k messages a day, took over the message sending that 8 operators (~R$ 2.5k, ~US$ 500, a month each) used to do by hand; they moved to other roles. Retries with backoff, business-hours windows and rate control; a dashboard that starts and stops the containers over SSH on the 2 servers; a self-service debt-settlement portal in Laravel with login by CPF (taxpayer ID) and two-step verification over WhatsApp, which closes ~100 settlements a month with no operator.

  • Node.js
  • TypeScript
  • Laravel
  • Docker

Problems I fixed 11

Bugs, incidents and security flaws I diagnosed and fixed. Open one to see the symptom, root cause and fix; each one is backed by one of my commits.

Evig · Jun 2026 The same WhatsApp message arrived several times atomic lock in a shared cache
symptom
Users received the same message more than once in production, but the database showed no duplicate execution.
root cause
The anti-duplication lock used a file cache, and Cloud Run runs 1 to 100 instances, each with its own disk: each one only saw its own lock.
fix
Atomic lock (Cache::add) in a shared PostgreSQL cache, a second content lock (sha256, 24 h), no resend on timeout and removal of a legacy path that also sent messages.
  • Laravel
  • Cloud Run
  • PostgreSQL
  • WhatsApp
Evig · Sep 2026 News campaign sent twice retry_after above the job timeout
symptom
The same campaign reached the same user twice.
root cause
The queue’s retry_after (90 s) was shorter than the job’s run time: another worker picked up the job while the first was still sending.
fix
retry_after of 900 s, above the worker timeout, a per-user-and-campaign lock, a batch named after the campaign, 30/120/300 s backoff and a metric for skipped duplicate sends.
  • Laravel Queues
  • Supervisor
Evig · Sep 2026 Deploys took the CRM down with permission denied idempotent grants on deploy
symptom
After a deploy, the CRM returned 500 with SQLSTATE[42501].
root cause
Migrations ran under another role, which owned the new tables, and ALTER DEFAULT PRIVILEGES without FOR ROLE only covers objects of the role that ran the command.
fix
An idempotent command that grants DML only, right after migrate, default privileges for the migration role and a deploy that fails early on bad config. Documented in a runbook.
  • PostgreSQL
  • Laravel
  • deploy
Evig · Sep 2026 One company’s admin could edit another company’s employees company scope on every lookup
symptom
Any admin who knew the ID could change the email, CPF and phone of another company’s employees, or delete them.
root cause
The update and destroy routes looked the employee up by ID without checking the company (IDOR).
fix
Lookups always scoped to the caller’s company, 404 for outside IDs, a review of the bulk endpoints and regression tests for every path.
  • Laravel
  • multi-tenant
  • PHPUnit
Evig · Jun–Jul 2026 Webhooks could be forged secret from the environment + constant-time comparison
symptom
The webhook signature used a secret hard-coded in the source, and the internal endpoint only checked that an authorization header was present.
root cause
Placeholder values in the code, with no config validation at boot.
fix
Secret from the environment (empty = reject), internal key compared with crypto/subtle, body capped at 1 MiB, boot fails without secrets. Later: signed tokens with single-use nonces, events older than 5 min dropped and rate limiting on public routes.
  • Go
  • HMAC
  • rate limit
see the other 6 problems
Evig · Sep 2026 Login by CPF could cross companies tenant-scoped lookup
symptom
An identity found in another company could open a session or redeem an invite.
root cause
The per-turn identity lookup did not respect the directory’s tenant.
fix
Every lookup respects the tenant; a mismatch becomes “not found” and feeds a metric, an ambiguous invite gets 409, all behind a feature flag.
  • Go
  • multi-tenant
  • Prometheus
Evig · Jul 2026 Production worker consumed the Dev queue worker role pinned per environment
symptom
Commands went unanswered and Dev events were processed with production credentials.
root cause
Two machines shared the same database URL, so the production worker picked up Dev events.
fix
Worker role pinned per environment, a verification runbook that never prints secrets and config validation that doesn’t take down back-end-only workers.
  • Go
  • AWS
  • runbook
Evig · Jun 2026 Message marked as sent without reaching the user lease with reclaim in the outbox
symptom
If the instance died mid-send, every later attempt was skipped as a “duplicate”.
root cause
The idempotency record stayed reserved forever.
fix
Lease-based reclaim with ON CONFLICT DO UPDATE … WHERE, success (200) only on a confirmed send and 409 so the caller retries.
  • Python
  • FastAPI
  • PostgreSQL
Evig · May–Jun 2026 AI could make up numbers in financial answers number guard + deterministic fallback
symptom
The model could cite values that didn’t exist and once showed internal keys to the user.
root cause
The LLM’s answer went to the user without being checked against the data.
fix
Every number must exist in the data snapshot, otherwise it falls back to a deterministic answer; a rule in the output contract, internal identifiers stripped and tests with made-up numbers.
  • LLM
  • guardrails
  • Python
Evig · Aug 2026 100% test coverage, broken boot on real Postgres database contract test
symptom
The authentication service died at startup on a real PostgreSQL.
root cause
A NULL value in the roles column violated a NOT NULL constraint; the tests covered the line, not the database contract.
fix
Bootstrap fix, a migration that merges users duplicated by email (window function) and an SMTP timeout without retry, so temporary passwords aren’t sent twice.
  • Go
  • PostgreSQL
  • SMTP
Digital LZ · Nov 2025 Memory leak in QR code login single finalize + global timeout
symptom
Every WhatsApp reconnect left timers and listeners alive, and memory kept growing.
root cause
The QR flow didn’t clear setInterval or listeners and had no overall timeout.
fix
A single finalize() that removes listeners and timers, a 5 min timeout and cleanup before every reconnect.
  • TypeScript
  • Node.js
  • Baileys

The vendor only made it for Windows. I made it for Linux.

Reverse-engineered USB HID protocols, talking directly to /dev/hidraw. CLI + GUI, .deb, Arch and AppImage packages, a signed Flatpak repository and now a browser version over WebHID (Chrome/Edge), with a demo mode to try it without the device.

/dev/hidraw3capturing…

install from the signed Flatpak repository

flatpak remote-add --user --if-not-exists miguelsanz https://miguelsanzbr.github.io/flatpak/miguelsanz.flatpakrepo

Go and Laravel back-end, with open code.

Company code is private. These three rewrite patterns I used in production from scratch: DDD and hexagonal architecture, TDD, a real PostgreSQL in tests wherever there is a database, and 100% coverage enforced in CI.

Go★ 0

outbox-gateway-demo

Message gateway with a PostgreSQL outbox: FOR UPDATE SKIP LOCKED, lease with fencing token and a reaper. No loss and no order violation under k6, kill -9 included. Ships a realtime dashboard (SSE) with a button to kill a worker and watch the reaper recover.

see on GitHub (opens in a new tab)

Go★ 0

webhook-relay

Receives webhooks, checks HMAC-SHA256 in constant time, blocks replays (5 min window + nonce) and per-IP floods, then forwards with retries. Standard library only, built with TDD, DDD and a hexagonal layout enforced by a test.

see on GitHub (opens in a new tab)

PHP · Laravel★ 0

multitenant-invoicing

Multi-tenant invoicing SaaS: per-company isolation with IDOR regression tests on web and API, and idempotent overdue reminders delivered through outbox-gateway-demo. Pest, Larastan at max level, Inertia + React.

see on GitHub (opens in a new tab)

Available now. Let’s talk.

I’m looking for a mid-level back-end role in São Paulo (hybrid or on-site) or remote, starting immediately: as a remote contractor for a company abroad, or as a CLT employee or PJ contractor in Brazil. I reply quickly by email or on LinkedIn.

Message me on LinkedIn (opens in a new tab)
miguelsanzb.p@gmail.com