Sandon Jurowski

Seattle, WA

Senior/Principal Full-Stack Engineer with 15+ years designing and delivering large-scale web platforms across startups and enterprise. Currently principal engineer and architect across a four-product software portfolio at Point Seven Studio, built on TypeScript and Next.js with Supabase and Railway. Depth in both front-end systems (React, Tailwind, component libraries, canvas and 3D) and backend/cloud architecture (Node.js, NestJS, AWS CDK and Serverless, Docker, PostgreSQL, DynamoDB). Repeated pattern of taking a system from prototype to production alone and then hardening it — authorization sweeps, row-level security, rendered-output verification, config-health gating — rather than leaving it at demo quality. Previously led distributed teams and enterprise IT organizations. Available for contract engagements.

Point Seven Studio (2024 to present)

Sole engineer across a four-product portfolio. Selected work below.

Site generator and multi-tenant commerce platform.

Architected a schema-driven block system: 64 block types validated by Zod, each with an editor, renderer and default-content contract, where adding one is a compile-enforced change rather than a convention.

Built the money path end to end: Stripe Checkout and Stripe Connect with application fees and merchant transfers, platform-fee capture computed pre-tax at draft, refund fee-reversal, and a two-tier commission ledger with residual payouts.

Delivered print-on-demand fulfillment through Lulu and Gelato, with the platform fee taken on margin after the printer base cost, and webhook-driven order sync.

Shipped multi-tenant architecture with host-to-org resolution in middleware, white-label reseller branding, and programmatic custom-domain provisioning through the Vercel and Namecheap APIs.

Led a security remediation across the API surface after introducing anonymous guest sessions: shared auth gates, dozens of mutating routes gated, a privilege-escalation closed, deny-default row-level security on every anon-writable table, webhook signature verification and per-IP rate limiting.

Built verification tooling that inspects the rendered page rather than its inputs, loading the published URL in headless Chromium and asserting on visible copy, reading-order position and computed contrast; its first run found a footer rendering at 1.71 to 1 across all 98 published sites.

Added startup config-health gating and a public status endpoint that answers whether a feature is actually live from the running process rather than from a config file.

Built an in-house electronic signature system with documents fingerprinted by SHA-256 of the exact text presented, frozen against edits by a database trigger once signed, and a self-contained certificate both parties keep.

Prototyped an AWS parity stack on Lambda, API Gateway and CDK as a migration path, then evaluated and deliberately remained on Supabase and Railway for delivery speed at current scale.

Scale: 484 API routes, 704 React components, 738 library modules, 204 Postgres tables across 110 tracked migrations, 478 test files, 695 merged pull requests.

Journaling and creative-writing platform with adjacent products.

Built an autonomous browsing-agent testing engine in which LLM-driven agents drive a real Playwright session toward a goal and calibrate the transcript into a structured findings report, SSRF-guarded, robots-respecting, cost-capped and human-approval-gated before any browse.

Built a client-side-encrypted vault using browser-sealed AES-256-GCM where the server stores only ciphertext and the write path rejects any request carrying a key, with user-held recovery and a panel showing exactly what the server can see.

Built a shared billing and affiliate system on a single subscriptions table discriminated by plan, with a Stripe webhook price-to-plan mapper and a commission ledger idempotent per invoice with automatic refund clawback.

Built a voice-cloning orchestration pipeline covering consent capture, sample handling, caching and cost guardrails on top of ElevenLabs cloning.

Built a deterministic screenplay export from Fountain to FDX and HTML with golden tests, and a smart-glasses intent layer on the Mentra SDK.

Scale: 3,947 commits, 1,823 merged pull requests, 622 sequential SQL migrations, 161 backend route modules, 512 backend service modules, 490 page routes, 129 backend test files.

Residential deck design with code-aware structural output.

Built a structural calculation engine that turns a drawn polygon into beams, joists, footings, stairs and railings with cantilever and span checks and prescriptive ply auto-sizing against IRC R507.5 span tables.

Solved rotated and ledgered-deck framing so framing aligns to the deck's own axis rather than the screen, reconciling two joist generators under ledger-aware flags.

Ran React 19 on Konva and three.js ahead of upstream support through custom webpack shims, with canvas stubbed server-side to survive SSR.

Built a single-source-of-truth materials bill of materials driving both the review estimate and the order card, with an automated pricing-parity harness that fails CI on divergence.

Scale: 1,123 commits, 17 store slices, 49 API route handlers, 33 migrations, 52 Jest test files, 8 Cypress visual-regression specs.

Neighbourhood marketplace spanning permitted home-cook meals, goods and services, and short-term rentals.

Built a statutory compliance engine enforcing two regulatory regimes at the write path, including a timezone boundary where daily caps bucket by placement date while the same-day rule computes in UTC for a Pacific business.

Enforced safety invariants structurally rather than behaviourally: specs read the Prisma schema directly and fail if anyone adds a money column or gives a child a login.

Built payment-claim verification that validates the claim against Stripe rather than trusting a shared secret, failing closed on every uncertain path, closing a live hole where a forged paid status was accepted.

Built four live cross-product API contracts with PII-safe projections, spec-locked field names and per-IP throttling, consumed by a sibling product in production.

Built a separate Go and SST Lambda payments service handling Stripe checkout, webhooks, Connect and refunds.

Scale: 369 commits over nine months, NestJS and Prisma on Railway with a Next.js front end on Vercel.

Health and wellness platform on AWS-native infrastructure.

Built a Next.js application with static and SSR hybrid delivery on AWS Lambda via API Gateway.

Designed a multi-tier architecture using both the Serverless Framework and AWS CDK, and managed S3 hosting, CloudFront distribution, IAM security and CloudWatch observability.

Implemented Secrets Manager, Parameter Store and least-privilege IAM roles for production hardening, and optimized cold starts with esbuild bundling and CloudFront caching.

RiteHite (2024)

Enhanced the React front end and Node.js backend for a warehouse-equipment portal.

Developed and maintained firmware upload and distribution pipelines to device fleets with version control and rollback.

Built automated end-to-end tests in Playwright and conducted load testing and performance benchmarking to scale the system under peak load.

Bayer Crop Science (2021 to 2023)

Built a React front end and Express and GraphQL APIs for crop-science pipeline management.

Designed serverless infrastructure on AWS Lambda for compute, Kinesis for event streaming and SQS for asynchronous queuing.

Coordinated DynamoDB and RDS integration for hybrid storage, used S3 for staging, and deployed with CloudFormation.

Established monitoring, retry logic and error handling with CloudWatch, SNS and dead-letter queues to improve resiliency.

VolunteerCrowd (2021)

Led a global team across Cuba, China and the United States delivering React and React Native MVPs integrated with Salesforce.

Built proxy APIs, caching, Azure DevOps pipelines and server-side-rendered SEO systems.

UC San Diego Enterprise IT (2014 to 2018)

Managed a development team supporting a one-billion-dollar research enterprise.

Delivered an award-winning financial recovery system recognized with the UC System Sautter Award.

UW Madison Medical School (2000 to 2014)

Built full-stack research and HR applications in Rails, PHP and .NET.

Managed enterprise systems including Exchange and Citrix.

HabitForge (2009 to 2016)

Ruby on Rails and later Python on Google App Engine habit-tracking application with more than 250,000 users over a seven-year run.

Listed multiple times among the top ten productivity applications.

Featured in Forbes, PC World, LifeHacker, CNN Money, Shape Magazine, Family Circle, CIO Magazine and Tim Ferriss's The 4-Hour Body.

EDUCATION

B.S. Information Systems, University of Wisconsin-Madison