John Sabo
Full-stack engineer · Security automation architect

John Sabo

Shipping production systems since 1994

I build and ship software: SaaS platforms, data engines, security infrastructure. Most of it solo. Fifteen products and projects shipped in 2026.

30+
years in production systems
15
products & projects shipped in 2026
19B
rows indexed across the systems I run
14 yrs
GoDaddy ran my WAF unchanged
100K+
lines of code across shipped projects
359
products in my live store
460K
contacts in my outreach engine

Selected work

Three of the fifteen projects I shipped in 2026. All built and deployed solo. Every product name below is a link to its full write-up.

Lono Security

lonosecurity.com

SOAR for everyone, fully managed. Traditional SOAR is priced and sized for large enterprises, and standing one up runs to months. Lono is the other bet: Lono does the integration and automation development the client would otherwise hire a SOAR engineer for, runs the platform, and charges a flat monthly rate. Alerts and events arrive from whatever a client already runs, get correlated and enriched, and land in one ticketing system the whole team works from.

The parts are mine to build and operate. XDR ingestion through orchestration workflows. Enrichment on every indicator: geolocation, ASN, passive DNS, threat feeds, Tor checks. Case management made for cyber and fraud investigations. And a runbook library keyed to MITRE ATT&CK, so an analyst opens a case and the runbook is already on it, with the containment steps and the escalation path for that exact technique.

656 runbooks, one per MITRE technique and sub-technique, generated by script. Live in two weeks instead of the six months a conventional integration asks for.

SOARXDRDFIR case managementIOC enrichmentPythonLaravel 11
Full write-up →
Lono Security — SOAR case view: the IOC attack graph from a brute-force alert
656runbooks, MITRE-keyed
Flatmonthly, fully managed
2 wksto production

Home Staked Pre-launch

homestaked.com

Home Staked is a two-sided marketplace for Arizona businesses. Owners stake their real identity on their listing. That's what makes the reviews and the leads mean something. Consumers search 2.76 million businesses. Owners get a portal for listings, leads, reviews, messages, ads and billing.

The hard part was scale and money. Search had to stay under a second at 2.76 million rows, which took materialized views and trigram indexes. Three admin surfaces needed separate auth guards. Stripe subscription billing had to survive webhook replay without ever granting one payment twice. 172 tests cover it, across 79 migrations.

It's deployed with queue workers and websockets running as managed services. Final audit now, public launch next.

Laravel 12Filament 3PostgreSQLStripe CashierReverbHorizon
Full write-up →
Home Staked — Arizona business directory homepage
56Klines of code
172tests passing
2.76Mdirectory rows, indexed

John's Guides Live

americanjohn.com

I built John's Guides as a full digital products business. The part I'm happiest with isn't the storefront. It's the pipeline behind it. 359 certification study guides, everything from DCW caregiver certification to AWS exams to OSHA safety courses. Each one gets researched, written, laid out and packaged as a finished PDF with a cover, a cheatsheet and a cribsheet. One command takes a guide from a source folder to a product the store can sell.

Two storefronts exist because I rebuilt the first one. A static generator came first. Then I moved to a headless commerce system with digital order fulfillment, which handles the catalog and the bundles and the delivery. Transactional mail runs across six domains with rotating DKIM selectors.

It's live and selling. That project taught me more about running a products business than any consulting engagement did.

PythonJinja2MedusaNext.jsPostgreSQLStripe
Full write-up →
John's Guides — certification study guide storefront
359products built and live
2storefront builds (static + Medusa)
6domains of transactional mail

Also shipped

Andale Advertising — live agency SaaS homepage

Andale Advertising Live

andaleadvertising.com

The whole agency in one build. Clients pick a service and pay by card, then watch the work in their portal. Affiliates earn tracked commissions with a ledger behind them. The agency side runs clients, payments, reports and invoices from one admin panel. Live Stripe checkout, webhooks and 540 screens. Real money runs through it.

Full write-up →

2026 shipping log

The rest of the year's work: platforms, tools, research and client engagements.

Product What it does Stack Scale
Outreach Campaign Engine The pipeline that does the prospecting work. It scores leads and drafts outreach with AI. Every draft goes in front of a quality panel of four model judges before anything sends. Sending is paced. Replies and bounces suppress the contact automatically. A/B testing ranks which model writes the best copy. Python · LLM panels 1,200/day
Proxy Infrastructure Platform A rotating proxy server I run myself. Its collection arm has harvested 721,000 proxies from 2,631 documented sources. The server validates them across 11 protocol variants. Then it serves them with routing that pins each target to the same exit. MITM detection catches tampered connections. Managed as a service. asyncio · Redis · Docker 721K proxies
mega-search MCP Deep search infrastructure any AI agent can call. Sixteen engines sit behind it: the open web, archives, open directories, device search, even Tor onion sites. Sixteen social platforms too, including Reddit with full comment mining. Built as an MCP server and still maintained. Python · FastMCP 16 engines
Phoenix Builders A contractor's marketing site with a sales operation behind it: CRM, contracts, sales team tracking, commissions for affiliates. Ad campaigns and funnel reports are managed from the same admin. I built it three times, each one more complete than the last. Laravel 13 · Livewire · Filament 19 models
Quant Trading Platform A research platform for systematic trading. It backfills nine million price rows and runs 159 strategies through a daily tournament, then scores the survivors with GPU models that read news and filings. A review team of thirteen agents audits the work. A dashboard browses portfolios, funds and signals. Python · PostgreSQL · Flask 159 strategies
SubOracle A security proxy that sits between automation components and the SaaS APIs they touch. It enforces scoped credentials, route allowlists and read-only rules. Secrets get injected into requests without ever being exposed. OAuth2, HMAC, SigV4 and mTLS all work. Ships with an admin UI and an audit store. Go · SQLite 6.5K LOC
Account Recovery Playbook A playbook for recovering locked or hijacked business accounts. Eighteen revenue platforms covered: marketplaces, payment processors, social, app stores. Intake forms, authorization letters, evidence checklists and escalation paths for each one. Generalized from a real recovery that took eight weeks. SOP library · 24K lines 18 platforms
Voter Portal Security Assessment A security assessment of how U.S. voter portals verify identity, built only from public sources, with Maricopa County as the deep dive. Fifty states surveyed. Findings graded by evidence quality, 543 citations verified, advocacy letters written and ready to send. Research report 543 citations
DNC / TCPA Tracker An app for documenting robocalls and spam texts. It tallies statutory damages the way the law actually counts them, cross-references FCC complaint data and drafts the demand letter. Built after one too many illegal calls. Flask · SQLite 21 MB evidence
GEO & Security Practice Client audits for AI visibility and website security. Scoring methodology, schema fixes, llms.txt deployment, hardening. Ten-plus sites audited and two full engagements delivered, reports and remediation included. Audit toolkit 10+ sites
Upwork Proposal Pipeline An active pipeline for freelancing work. It searches Upwork, gates jobs on money and client quality, then ranks the survivors by expected value per connect. Proposals are drafted and submitted inside platform rate limits, tracked with a ledger. Playwright · Python Active daily

About

John Sabo
Mesa, AZ

Thirty years of building systems that stay up. I started in 1994 at an Arizona ISP, designing the state's first shared hosting infrastructure back when hosting took a dedicated server per site. At GoDaddy I built the internal WAF. They ran it for 14 years without replacing a line of code, and when a company spun out of GoDaddy it took the mechanics and resold them. I co-founded a security data company after that. We recovered 400 petabytes of breached data and built a passive DNS platform watching 192 million domains. Then we sold the company. The years after that went to Swimlane SOAR architecture for Fortune 500 clients.

2026 is the year I went all in on building products instead of consulting about them. Sixteen of them shipped and deployed. SaaS platforms. A digital product business. Data pipelines and automation. One person did the work, with AI carrying the mechanical load while I reviewed every line that shipped. It's how a solo engineer delivers what used to take a team a quarter.

Architecture comes before code. Production standards apply from the first commit: tests, migrations, deploy scripts, monitoring. I hand over a running system you can operate without me. If you wanted a zip file, you'd hire someone else.

The way I see a company is the way I see a server: one system made of smaller systems, held in my head all at once. That part deserves its own section. It has one below.

Based: Mesa, Arizona Certs: Swimlane SOAR Architect · Developer · Administrator · Shuffle Developer Availability: remote first, two weeks from offer

The exploded view

The thing I do better than anything else.

An exploded view is an engineering drawing with every part pulled out and laid flat. The relationships between the parts stay visible. That is how I see systems. Give me a company, a platform, a pipeline. Within hours I hold the whole thing in my head: every part, every connection, every place where the connections are weak.

It works the same at any scale. A company is a system made of smaller systems: what it sells, who buys it, how it delivers, what it costs, how it is perceived. A platform is the same idea in code. I see both the same way, micro at the bottom and macro at the top. The seams between the two are where the gaps live.

Exploded view diagram: four stacked layers, COMPANY, PLATFORM, DATA, INFRA, with SECURITY standing beside them guarding all four
The drawing: every layer of a system pulled apart, with SECURITY standing over all of them
Company
what it sellswho buyshow it deliverswhat it costshow it is perceived
Platform
authbillingmessagingjobsauditreporting
Data
customersordershistorytelemetrycatalog
Infra
serversqueuesmailproxiesbackupsmonitoring
Security
guards every layer aboveaccessdetectionresponserecovery

What that means when you hire me. I find the gap before it becomes the outage, because most failures live between systems, in the handoff nobody owns or the queue nobody sized. Scope comes out honest, because the map is already in my head when I quote. I can start anywhere: a failing piece or a blank page takes the same first step. Build the map, find the load-bearing parts, work those first.

It looks a little different depending on what the system is. For a company, the map is commercial: revenue, delivery, reputation, where the leaks are. For a platform, it is technical: the request path, the failure modes, the data that has to be right. Most engagements need both, which is why I do both.

Security is the one element that does not sit in a layer. It runs through every one of them: the credential at the platform, the isolation at the data, the perimeter at the infrastructure, the promise a company keeps to its customers. The work is the same shape at every layer: access, detection, response, recovery. That is the version of this drawing I have spent thirty years learning to read. It is usually the fastest way to find what is about to break.

What I can build for you

Each one has shipped. The plain sentence is what it does for a business. The monospace line is the stack.

SaaS platforms

A complete online business you can charge money for: accounts, payments, an admin dashboard, the works. I built four this year. What you get makes money on its own, without a team behind it to finish the job.

Laravel 11-13 · Livewire · Filament · Stripe/Cashier · PostgreSQL · multi-tenant auth · queues · websockets · policy-based authorization

Proof: Andale Advertising · Home Staked · John's Guides

AI infrastructure

Custom AI tools that slot into how you already work. Search, analysis, drafting, automation. They can run on your own hardware if you would rather not send data out. I built a search engine that queries 16 sources at once. An image pipeline runs on a local GPU.

MCP servers · Ollama (local + cloud) · Stable Diffusion/ComfyUI · multi-agent orchestration · LLM evaluation · prompt engineering

Proof: mega-search MCP · Quant Trading Platform · Outreach Campaign Engine

Automation pipelines

Software that takes over the repetitive work: outreach, data processing, monitoring, form filling. Mine holds 460,000 contacts and sends 1,200 emails a day, each one passing a quality gate before it leaves. No human sits in the loop.

Python asyncio · PostgreSQL ETL · browser automation (Playwright/CDP) · proxy rotation · A/B testing · quality gates · circuit breakers

Proof: Outreach Campaign Engine · Upwork Proposal Pipeline

Security automation (SOAR)

Security tools that respond to threats on their own instead of waiting on an analyst. On targeted indicator workflows, one SOC team cut manual triage effort by roughly 87 percent against its own prior baseline. That is a relative reduction on specific workflows, not a uniform SOC-wide metric. The firewall I built at GoDaddy protected their hosting for 14 years. Four SOAR certifications, all current.

Swimlane SOAR (certified Architect/Developer/Admin) · Shuffle · Splunk/SPL · WAF architecture · threat intel integration · IOC tracking · incident response

Proof: Lono Security · SubOracle

Data engineering at scale

Collecting and cleaning data at sizes most teams never touch. The largest database I have tuned serves 2.76 million rows and answers searches in under a second. Pipelines I've built move millions of records a day without a human babysitting them.

PostgreSQL (materialized views, GIN trigram, partitioning) · multi-source ETL · scraping at scale · enrichment · deduplication · record linkage

Proof: Home Staked · Quant Trading Platform · Proxy Infrastructure Platform

Full-stack web applications

Whole sites and web apps: accounts, databases, payments, admin panels. Marketing sites, e-commerce, internal tools. Everything I deploy comes monitored and documented. You can run it without me.

Laravel · Livewire · Filament · PHP 8.2-8.3 · PostgreSQL/MySQL · Stripe · Tailwind · Vite · Node.js/Medusa · Docker · systemd · nginx/Apache

Proof: DNC / TCPA Tracker · Account Recovery Playbook

Working on something?

If you need a platform built, a process automated, or your security team is drowning in manual work, say hello. One sentence about the problem is enough.

john@johnsabo.org