bernhardtwo

About

AppSec · Full-stack · ML

Bernardo Vega.
Security first.

I build web products end to end and then look for the ways they break. Full-stack is the base. ML comes in when the problem needs it.

Email me

I'm a full-stack developer in Hermosillo, Mexico. I work on a personal finance SaaS with Next.js and FastAPI, and I look after the security of its web apps. I'm moving into application security, and the place I want to end up is digital forensics and cybercrime analysis. Open to relocating to Canada.

I like knowing how a thing fails before someone else finds out.

Skills

Security
Web application security, Static malware analysis (PE/ELF), YARA, Audit logging, OIDC
Languages
TypeScript, Python, Swift, SQL
Frontend
Next.js, React, SwiftUI, Tailwind CSS
Backend
FastAPI, NestJS, PostgreSQL
ML
LightGBM, Learning-to-rank, Clustering, LLM agents, MCP
Platform
Docker, GitHub Actions, Cloudflare, Azure

Today

Full-stack
NeuralGT · Remote
Tidelog
Right now · Private beta
AppSec
Studying · HTB Academy

Projects

Tidelog2026
CaseLens2026
LedgerLens2026
GeoPlay Recommender2025
VGC Replay Coach2026

Native app · Private beta · 2026

Tidelog

Your day, in blocks.

A day planner for macOS and iOS. Pick a Jira ticket and the Clockify or Toggl timer runs, pauses on every break, and the rest of the day shifts when you fall behind.

Platforms
macOS · iOS
Timers
Clockify · Toggl
Data
User's iCloud
Tracking
None
  • Native Swift and SwiftUI on Mac and iPhone.
  • Jira tickets drive the Clockify or Toggl timer, which stops on every break.
  • Flexible blocks move on their own when the day slips.
  • No analytics and no tracking. Data stays in the user's iCloud.
  • Landing on Cloudflare Workers, served with no-transform so the CDN injects nothing.

Stack Swift, SwiftUI, Jira API, Clockify API, Toggl API, Cloudflare Workers

tidelog.app

Security

Where I'm going: digital forensics and cybercrime analysis. Where I am: securing the web apps I build.

NeuralGT

At work

I look after the security of the web applications at NeuralGT.

Static malware scanner · Repo private for now

ATFS

Static malware scanner for PE and ELF binaries. It never runs the file. Four layers (hash reputation, YARA, structural heuristics and an ML classifier) each add explainable evidence to the verdict. 0 false positives across 15,473 Windows system binaries.

HTB Academy · CPTS path

Studying

HTB Academy on the CPTS path, with OSCP as the next goal. Networking fundamentals along the way.

Headers · CSP · security.txt

This site

security.txt, a strict Content-Security-Policy and security headers. Check them.

security.txt

Experience

NeuralGT

Viña del Mar, Chile · Remote

Full-stack Web Developer

Jan 2026 - Present · Full-time

Frontend, API integration and web app security on Plenor, a personal finance app for the Chilean market.

  • Build product features end to end, from the Next.js screen to the FastAPI endpoint.
  • Responsible for the security of the product's web applications.
  • Built the dashboard where users see their finances at a glance.
  • Proposed the design conventions the team follows for widgets, dialogs and color.

Stack TypeScript, Next.js, React, Python, FastAPI

Machine Learning Engineer

Aug 2025 - Jan 2026 · Part-time

Machine learning over transaction data for the same product.

  • Worked on models over user transaction behavior with PyTorch and LightGBM, tracked in MLflow.
  • Built a data acquisition pipeline in Python.

Stack Python, PyTorch, LightGBM, MLflow, FastAPI, Docker

Ford Motor Company

Hermosillo, Mexico

Data Analyst

Mar 2024 - Sep 2025

Defect reporting for a vehicle assembly line: an ETL that normalized Excel captures into a CSV several systems consumed, and Power BI dashboards used in weekly production reviews.

  • Automated a daily report that took an hour and a half by hand: a single Excel capture became a clean CSV feeding both the weekly reports and the dashboards.
  • Collected and structured defect records for damaged and disconnected connectors, giving several downstream systems one source instead of spreadsheets re-entered by hand.
  • Introduced the first visualization of this data: Power BI dashboards line leaders read in weekly reviews to see how each crew was doing on registered defects.

Stack SQL, Python, Power BI, Excel, ETL

How I work

  1. 01

    Build it, then break it.

    I go back over what I ship looking for the ways in: auth, scopes, inputs.

  2. 02

    Scope lives below the model.

    When an LLM is in the loop, permissions are enforced in code it can't talk its way around.

  3. 03

    Determinism where it matters.

    In finance the model decides what to compute and explains it. Pure functions compute the numbers.

  4. 04

    Quality as a gate, not a wish.

    Lint, strict types, tests and evals run in CI and block the merge.

tenant-scope.ts
// The scope is set before the model says anything.function readClaim(ctx: TenantCtx, id: ClaimId) {  return db.claims.find({ id, tenantId: ctx.tenantId });}

Contact

Email is the fastest way.

I'm looking for full-stack or application security work, remote or in Canada.

Where
Hermosillo, Mexico · open to relocating to Canada
© 2026 Bernardo VegaNo analytics. No tracking.