# Sandon Jurowski

Seattle, WA · sandon.jurowski@pointsevenstudio.com · github.com/jurowski · linkedin.com/in/jurowski

## Professional Summary

Senior/Principal Full-Stack Engineer with 15+ years designing and delivering large-scale web platforms across startups and enterprise. Currently principal engineer and architect across a four-product software portfolio at Point Seven Studio, built on TypeScript and Next.js with Supabase and Railway. Depth in both front-end systems (React, Tailwind, component libraries, canvas and 3D) and backend/cloud architecture (Node.js, NestJS, AWS CDK and Serverless, Docker, PostgreSQL, DynamoDB). Repeated pattern of taking a system from prototype to production alone and then hardening it — authorization sweeps, row-level security, rendered-output verification, config-health gating — rather than leaving it at demo quality. Previously led distributed teams and enterprise IT organizations. Available for contract engagements.

## Technical Skills

- Languages and Frameworks: TypeScript, JavaScript (React, Next.js App Router, Node.js, NestJS, Express), Python, Ruby on Rails, Go, .NET
- UI: Tailwind CSS, Storybook, Radix and shadcn/ui, Konva (2D canvas), three.js and react-three-fiber, responsive design systems
- State and Data: Zustand, TanStack Query, React Hook Form, Zod
- Cloud and DevOps: AWS (Lambda, API Gateway, CloudFront, S3, CDK, Serverless Framework, DynamoDB, Kinesis, SQS, ECS/Fargate), Railway, Vercel, Docker, GitHub Actions, Azure, GCP
- Data: PostgreSQL, row-level security, Prisma, Supabase, DynamoDB, MongoDB, Redis, Qdrant (vector search)
- AI: OpenAI, Anthropic, Replicate, LangChain, retrieval pipelines, cost metering and budget guards for model spend
- Payments: Stripe, Stripe Connect (marketplace payouts, application fees, refunds, tax)
- Testing and Quality: Jest, Playwright, Cypress with visual regression, headless-browser rendered-output verification, contrast gating in CI

## Experience

### Principal Software Engineer and Architect — Point Seven Studio (2024 to present)

- Sole engineer across a four-product portfolio. Selected work below.

### QuickSites — site generator and multi-tenant commerce platform.

- Architected a schema-driven block system: 64 block types validated by Zod, each with an editor, renderer and default-content contract, where adding one is a compile-enforced change rather than a convention.
- Built the money path end to end: Stripe Checkout and Stripe Connect with application fees and merchant transfers, platform-fee capture computed pre-tax at draft, refund fee-reversal, and a two-tier commission ledger with residual payouts.
- Delivered print-on-demand fulfillment through Lulu and Gelato, with the platform fee taken on margin after the printer base cost, and webhook-driven order sync.
- Shipped multi-tenant architecture with host-to-org resolution in middleware, white-label reseller branding, and programmatic custom-domain provisioning through the Vercel and Namecheap APIs.
- Led a security remediation across the API surface after introducing anonymous guest sessions: shared auth gates, dozens of mutating routes gated, a privilege-escalation closed, deny-default row-level security on every anon-writable table, webhook signature verification and per-IP rate limiting.
- Built verification tooling that inspects the rendered page rather than its inputs, loading the published URL in headless Chromium and asserting on visible copy, reading-order position and computed contrast; its first run found a footer rendering at 1.71 to 1 across all 98 published sites.
- Added startup config-health gating and a public status endpoint that answers whether a feature is actually live from the running process rather than from a config file.
- Built an in-house electronic signature system with documents fingerprinted by SHA-256 of the exact text presented, frozen against edits by a database trigger once signed, and a self-contained certificate both parties keep.
- Prototyped an AWS parity stack on Lambda, API Gateway and CDK as a migration path, then evaluated and deliberately remained on Supabase and Railway for delivery speed at current scale.
- Scale: 484 API routes, 704 React components, 738 library modules, 204 Postgres tables across 110 tracked migrations, 478 test files, 695 merged pull requests.

### HiveJournal — journaling and creative-writing platform with adjacent products.

- Built an autonomous browsing-agent testing engine in which LLM-driven agents drive a real Playwright session toward a goal and calibrate the transcript into a structured findings report, SSRF-guarded, robots-respecting, cost-capped and human-approval-gated before any browse.
- Built a client-side-encrypted vault using browser-sealed AES-256-GCM where the server stores only ciphertext and the write path rejects any request carrying a key, with user-held recovery and a panel showing exactly what the server can see.
- Built a shared billing and affiliate system on a single subscriptions table discriminated by plan, with a Stripe webhook price-to-plan mapper and a commission ledger idempotent per invoice with automatic refund clawback.
- Built a voice-cloning orchestration pipeline covering consent capture, sample handling, caching and cost guardrails on top of ElevenLabs cloning.
- Built a deterministic screenplay export from Fountain to FDX and HTML with golden tests, and a smart-glasses intent layer on the Mentra SDK.
- Scale: 3,947 commits, 1,823 merged pull requests, 622 sequential SQL migrations, 161 backend route modules, 512 backend service modules, 490 page routes, 129 backend test files.

### DeckSketch — residential deck design with code-aware structural output.

- Built a structural calculation engine that turns a drawn polygon into beams, joists, footings, stairs and railings with cantilever and span checks and prescriptive ply auto-sizing against IRC R507.5 span tables.
- Solved rotated and ledgered-deck framing so framing aligns to the deck's own axis rather than the screen, reconciling two joist generators under ledger-aware flags.
- Ran React 19 on Konva and three.js ahead of upstream support through custom webpack shims, with canvas stubbed server-side to survive SSR.
- Built a single-source-of-truth materials bill of materials driving both the review estimate and the order card, with an automated pricing-parity harness that fails CI on divergence.
- Scale: 1,123 commits, 17 store slices, 49 API route handlers, 33 migrations, 52 Jest test files, 8 Cypress visual-regression specs.

### PorchHearth — neighbourhood marketplace spanning permitted home-cook meals, goods and services, and short-term rentals.

- Built a statutory compliance engine enforcing two regulatory regimes at the write path, including a timezone boundary where daily caps bucket by placement date while the same-day rule computes in UTC for a Pacific business.
- Enforced safety invariants structurally rather than behaviourally: specs read the Prisma schema directly and fail if anyone adds a money column or gives a child a login.
- Built payment-claim verification that validates the claim against Stripe rather than trusting a shared secret, failing closed on every uncertain path, closing a live hole where a forged paid status was accepted.
- Built four live cross-product API contracts with PII-safe projections, spec-locked field names and per-IP throttling, consumed by a sibling product in production.
- Built a separate Go and SST Lambda payments service handling Stripe checkout, webhooks, Connect and refunds.
- Scale: 369 commits over nine months, NestJS and Prisma on Railway with a Next.js front end on Vercel.

### Global Wellness — health and wellness platform on AWS-native infrastructure.

- Built a Next.js application with static and SSR hybrid delivery on AWS Lambda via API Gateway.
- Designed a multi-tier architecture using both the Serverless Framework and AWS CDK, and managed S3 hosting, CloudFront distribution, IAM security and CloudWatch observability.
- Implemented Secrets Manager, Parameter Store and least-privilege IAM roles for production hardening, and optimized cold starts with esbuild bundling and CloudFront caching.

### Principal Software Engineer — RiteHite (2024)

- Enhanced the React front end and Node.js backend for a warehouse-equipment portal.
- Developed and maintained firmware upload and distribution pipelines to device fleets with version control and rollback.
- Built automated end-to-end tests in Playwright and conducted load testing and performance benchmarking to scale the system under peak load.

### Senior Software Engineer, Contract — Bayer Crop Science (2021 to 2023)

- Built a React front end and Express and GraphQL APIs for crop-science pipeline management.
- Designed serverless infrastructure on AWS Lambda for compute, Kinesis for event streaming and SQS for asynchronous queuing.
- Coordinated DynamoDB and RDS integration for hybrid storage, used S3 for staging, and deployed with CloudFormation.
- Established monitoring, retry logic and error handling with CloudWatch, SNS and dead-letter queues to improve resiliency.

### Principal Software Engineer and VP of Technology — VolunteerCrowd (2021)

- Led a global team across Cuba, China and the United States delivering React and React Native MVPs integrated with Salesforce.
- Built proxy APIs, caching, Azure DevOps pipelines and server-side-rendered SEO systems.

### Assistant Director — UC San Diego Enterprise IT (2014 to 2018)

- Managed a development team supporting a one-billion-dollar research enterprise.
- Delivered an award-winning financial recovery system recognized with the UC System Sautter Award.

### App Developer, Systems Administrator and IT Director — UW Madison Medical School (2000 to 2014)

- Built full-stack research and HR applications in Rails, PHP and .NET.
- Managed enterprise systems including Exchange and Citrix.

### Creator and Developer — HabitForge (2009 to 2016)

- Ruby on Rails and later Python on Google App Engine habit-tracking application with more than 250,000 users over a seven-year run.
- Listed multiple times among the top ten productivity applications.
- Featured in Forbes, PC World, LifeHacker, CNN Money, Shape Magazine, Family Circle, CIO Magazine and Tim Ferriss's The 4-Hour Body.

## Education

- B.S. Information Systems, University of Wisconsin-Madison