Samson Tesfaye

Co-founded Solvix Labs PLC in mid 2024: setting direction with my co-founders, deciding what to build first, and turning a product idea into a registered company.

• solvix-labs
• strategy
• operations

Choosing what Axova does and, harder, what it does not. Talking to merchants, scoping releases and cutting features so the core ships.

• axova
• roadmap
• scoping

As CTO I own Axova's architecture, the engineering standards and the security posture, and I review the code that goes to production.

• cto
• architecture
• review

Bringing a product to Ethiopian merchants: positioning, pricing conversations and onboarding. Still learning; selling is a different craft from building.

• sales
• onboarding
• positioning

Swing and day trades on the major pairs, with the occasional scalp when the session is moving. Charts on TradingView, execution on MetaTrader 5.

• majors
• swing
• intraday

Market structure, support and resistance, and session timing. I mark levels on the higher timeframes and only act on the lower ones.

• tradingview
• structure
• sessions

Position size comes from the stop, never from the target. A fixed risk per trade and a journal of every entry keep the account alive through bad weeks.

• sizing
• journal
• drawdown

Where the engineer and the trader meet: writing rules as code, back-testing them, and running the ones that hold up as bots on MetaTrader 5.

• mql5
• pine-script
• backtesting

The same playbook applied beyond currencies: gold most of all, plus the major indices and crypto when they set up cleanly.

• xauusd
• indices
• crypto

I design and build complete websites and web applications, from the database to the interface. Shipped examples: YES Multimedia, Mamy Opticians, Geez Security and the Axova web app.

• next.js
• postgres
• design

Storefronts, checkout flows, point-of-sale and payment integrations. Axova is a full commerce platform; Mamy Opticians is a live storefront; I contributed refunds to the Chapa payment SDK.

• axova
• checkout
• chapa

Login, sessions, permissions and plugins on top of Better Auth. I publish two Better Auth packages on npm and have code merged into the framework itself.

• better-auth
• sessions
• npm

Typed HTTP APIs and background services with Hono, tRPC, PostgreSQL and Redis queues. Most of Axova's services follow this pattern.

• hono
• trpc
• bullmq

Cross-platform iOS and Android apps with React Native and Expo. Nine apps so far, including Axova POS, Axova Go and Axova Marketplace.

• expo
• react-native
• eas

Provisioning and running production systems on AWS with Terraform, Kubernetes and Helm: clusters, databases, caches, storage and CI/CD pipelines for Axova.

• aws
• terraform
• kubernetes

I test web applications for security weaknesses and write reports that developers can act on. It was my day-to-day work on INSA's red team, and I still apply it to everything I ship.

• burp
• recon
• authz

Authorised offensive engagements against real systems: planning, exploitation, documenting the path in, and briefing the people who need to close it.

• insa
• engagements
• reporting

Building software so it is hard to attack in the first place: threat modelling, secure code review and fixing whole classes of bugs rather than single instances.

• appsec
• threat-model
• code-review

Practical understanding of how encryption is used and misused: padding oracles, reused nonces, weak key handling. Mostly learned by breaking it in CTFs.

• ctf
• rsa
• aes

Taking compiled programs apart in Ghidra to find out what they really do, as opposed to what their documentation says.

• ghidra
• static-analysis
• x86

Memory-corruption exploits and ROP chains in CTF settings. Comfortable with the fundamentals; modern mitigations still keep me humble.

• pwn
• rop
• gdb

My primary language, used in strict mode across 43 repositories. I write the types first and treat them as the specification.

• strict-mode
• zod
• node

Every shipped site runs on Next.js. Server components by default, client code only where the browser genuinely needs it.

• app-router
• rsc
• tailwind

The first language I became fluent in. My choice for security tooling, automation and anything that has to exist by tonight.

• scripting
• automation
• ctf-tooling

Where I started. Semantic markup, accessible focus states and a token-driven Tailwind setup like the one behind this site.

• tailwind-v4
• a11y
• layout

Small, fully typed web services. Most of my backends now start as a Hono router.

• edge
• rpc
• middleware

The glue between everything else: scripts, CI steps and my dotfiles.

• pipes
• tooling
• ci

I read far more of it than I write, usually to understand where a program fails. bhnet, my network utility, is written in C.

• memory
• source-dive
• pwn

Designing the screens before building them: flows, hierarchy and states. Axova's merchant apps and this portfolio were designed by me.

• figma
• flows
• systems

Names, marks, colour and voice for products and client sites, so a small company looks as considered as a large one.

• identity
• type
• voice

Most Sundays. Still learning the fundamentals of arrangement and mixing.

• fl-studio
• arrangement
• mixing

Loops that have not yet become finished songs. Finishing them is the current goal.

• drums
• sampling
• groove

Shaping sounds until they feel deliberate rather than accidental.

• synthesis
• fx
• texture