Boris Munoz. Español

I build backend and data systems that just keep working.

Senior software engineer · Backend, data and applied AI

I've spent 9+ years building and running production software, much of it custom-built for clients. I've worked everywhere from solo projects to multidisciplinary teams spread across time zones, often leading the technical side.

Now

Building a supply-chain intelligence platform in the open: four small systems that watch PyPI, npm, Hex and Hugging Face for vulnerable and malicious releases. Each one runs on its own.

01Selected work

One platform, four parts

Since the npm worm of September 2025, “is my stack affected?” is a question every engineering team asks. These four projects answer it from different sides. Each is built to keep working when its neighbors are down, which is the point of the whole exercise.

The services run on demand, on infrastructure rebuilt from code. When one isn't running, its link shows a recording, the architecture and the source. Ask for a live demo and it's up in minutes (still in the works).

How the four projects fit together Public sources feed the Warehouse and Radar. The Warehouse publishes a versioned snapshot that seeds Ask and Deps. The Warehouse and Ask send optional events to Radar. PUBLIC SOURCES OSV and OpenSSF reports · PyPI · npm · Hex · Hugging Face · deps.dev · GH Archive ingest own pollers pipeline events usage and cost events publishes daily seeds daily load Warehouse AIRFLOW · DBT · DUCKDB Radar ELIXIR · OTP · LIVEVIEW Snapshot PARQUET + JSON · VERSIONED Ask PYTHON · RAG · AGENTS Deps TYPESCRIPT · TRPC · ZOD How the four projects fit together PUBLIC SOURCES OSV · PyPI · npm · Hex · Hugging Face publishes events daily load Warehouse AIRFLOW · DBT Radar ELIXIR · OTP Snapshot PARQUET + JSON Ask PYTHON · RAG Deps TS · TRPC · ZOD
Own data path Optional link

Every dashed link has a fallback. If the producer is down, the consumer reads the last published snapshot or replays a recorded event log, and says so on screen.

  1. Ask

    Is my stack affected?

    In progress AI engineering · Python service

    A RAG and agent service that answers supply-chain questions with citations, from “was anything in my lockfile hit by the npm worm?” to “is this model safe to load?”

    The decision to ask me about

    The evaluation suite plants prompt-injection text inside READMEs and model cards, the exact place an attacker would put it, and fails CI if Ask follows it.

    • Python
    • FastAPI
    • async httpx
    • Chroma
    • DuckDB
    • Pydantic

    Demo, source and design note when it ships

  2. Warehouse

    One source of truth, published as a contract

    In progress Data engineering · Python

    Ingests registries and security feeds, models them with dbt, and publishes a versioned snapshot that the other three projects read instead of the warehouse's tables.

    The decision to ask me about

    A data-quality gate fails the run when a source starts returning zeros, so a bad upstream day never reaches the marts or the dashboard.

    • Airflow
    • dbt
    • DuckDB
    • BigQuery
    • Parquet

    Demo, source and design note when it ships

  3. Radar

    Malicious releases, as they're reported

    In progress Elixir · Real-time

    A live feed of malicious-package reports, advisories and risky model files across four registries, ranked by severity and filtered to your own stack.

    The decision to ask me about

    One supervised poller per source, each with its cursor in Postgres. Kill one and the feed keeps streaming while it restarts and catches up from where it stopped.

    • Elixir
    • Phoenix LiveView
    • OTP
    • PubSub
    • Postgres

    Demo, source and design note when it ships

  4. Deps

    Paste a manifest, get a risk report

    In progress TypeScript · Full stack

    Reads a lockfile from npm, PyPI or Hex, plus any Hugging Face model ids, and returns a typed report on malicious versions, install scripts, provenance and licenses.

    The decision to ask me about

    Versions are branded per ecosystem. Comparing a PEP 440 version with a semver one is a compile error, and model revisions have no ordering at all.

    • TypeScript
    • Next.js
    • tRPC
    • Zod
    • Neon

    Demo, source and design note when it ships

02Experience

9+ years

  1. 2024 to now

    Senior Software Engineer

    TELUS Digital, digital solutions

    Built scalable platform architecture with microservices to deliver reliable remote IoT camera services for over 100k concurrent customers in Canada. Designed and optimized solutions for seamless platform integration, reducing cloud costs by 60%, increasing interoperability and efficiency while working with multidisciplinary global teams.

  2. 2023 to 2024

    Senior Software Engineer

    Funtec, fintech

    Designed and developed customized software solutions for fintech and administrative operations using TypeScript, Turso/SQLite, Elixir and Docker integrating and deploying on both AWS and GCP. Oversaw team objectives and delegated responsibilities, ensuring 95% on-time task completion.

  3. 2021 to 2023

    Senior Software Engineer

    Bantrab, banking

    Engineered innovative solutions to modernize and update existing systems using TypeScript, Oracle DB, Angular, and MongoDB, rewriting and refactoring legacy code, ensuring stable business-as-usual (BAU) operations and minimizing downtime reaching 99% of availability.

03How this site works

Colophon

This page and the project fallback pages are hand-written HTML and CSS on Cloudflare Pages, with no framework and no build step.

The projects run as containers on a single DigitalOcean Droplet that is created from code when a demo is needed and destroyed afterwards. A Cloudflare Worker sends each project link to the live app when it's up and to its fallback page when it isn't, so no link here ever breaks.

Type
Hanken Grotesk and JetBrains Mono
Hosting
Cloudflare Pages and a Worker
Compute
One Droplet, rebuilt from code
Idle cost
About $1 a month